formbook | 3e8e7c9ebb8ae4bbb723e1974f176f8cb82ec0fb4e1890ee1f4feed08ae76058

General

Target

3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
Size

842KB
MD5

3e07688e4591dc314aacba05ab9166f4
SHA1

3dec12b87aeb0311be975228d29d4314cf8c3cf8
SHA256

3e8e7c9ebb8ae4bbb723e1974f176f8cb82ec0fb4e1890ee1f4feed08ae76058
SHA512

469d672eb21727b6e8795bad8140a76fc221e05d01f611abebace3187d3ddbedbf7112d912f580b0c30176aef187ac3e60e8dfd6353f95aaa6ec8ba59baa633e
SSDEEP

24576:eyB4jL+f3uCoFmyQYzan8qovytjC/xfL6+:Ia3TyXWCvytj0x

Score

10^/10

formbook pu1i discovery rat spyware stealer trojan

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

pu1i

Decoy

academiechaptal.com

kraftcopyagency.com

ds901.com

redtailchillisauce.com

joppamountainclub.com

online-dbm.net

nautilusfoundation.com

psm-gen.com

perpely.com

natwest-services.com

muxviet.mobi

blackmantech.loans

dominantgoal.com

sky-iron.net

sweeten-kneel.xyz

ricardoimports.com

hzzyn.com

cawholesaler.com

tgshydroponics.com

weliketopartytoronto.com

Signatures

Formbook
Formbook is a data stealing malware which is capable of stealing data.
trojan spyware stealer formbook

Formbook payload 1 IoCs

rat

resource	yara_rule
behavioral2/memory/4920-8-0x0000000000400000-0x000000000042E000-memory.dmp	formbook

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\Control Panel\International\Geo\Nation	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3028 set thread context of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
544	schtasks.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
4920	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
4920	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 544	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	98
PID 3028 wrote to memory of 544	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	98
PID 3028 wrote to memory of 544	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	98
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100
PID 3028 wrote to memory of 4920	3028	3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe	100

C:\Users\Admin\AppData\Local\Temp\3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\eqhwKP" /XML "C:\Users\Admin\AppData\Local\Temp\tmp41B7.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:544
- C:\Users\Admin\AppData\Local\Temp\3e07688e4591dc314aacba05ab9166f4_JaffaCakes118.exe
  "{path}"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp41B7.tmp

Filesize
1KB

MD5
3a51453b4e77e806c9c97fd7f97fde57

SHA1
b2e9943055d8fdf99bb98aef469aa780831b48ae

SHA256
bd0a6439c22b3ed002fcec8885ab05b0fd27274ac5efcc859cfbe2a2b0b36420

SHA512
4ff8764f2a0a248fc8241b8efd990e39ae2e1f57a4f45bc87c7279f8a4a8531c0dba76b34469f8638845b23b24954e1767ab6336ed6ed6133eb354acbad1d448

Download Submit
memory/3028-0-0x0000000074D42000-0x0000000074D43000-memory.dmp

Filesize
4KB

Download
memory/3028-1-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/3028-2-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/3028-3-0x0000000074D42000-0x0000000074D43000-memory.dmp

Filesize
4KB

Download
memory/3028-4-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/3028-10-0x0000000074D40000-0x00000000752F1000-memory.dmp

Filesize
5.7MB

Download
memory/4920-8-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/4920-11-0x0000000001020000-0x000000000136A000-memory.dmp

Filesize
3.3MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads