Analysis
-
max time kernel
134s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
27-08-2024 04:32
General
-
Target
c45a5095dcd3afa44b6636a875a5adcb_JaffaCakes118.exe
-
Size
300KB
-
MD5
c45a5095dcd3afa44b6636a875a5adcb
-
SHA1
e405f17bfe4ea6d9851c629959bad19eabe803fb
-
SHA256
681af20c60faa54a6ce5adc472b7f875d3454929c21963b11a9ab5677edd4a05
-
SHA512
acc628710d6baeb80fc9e9416240282cda8cd5c74c9113e2d9034f85ed4008e68842e598178d9bf6049207b701038fa8a5d1f7da89ff4e495fe91804ca870935
-
SSDEEP
6144:NRKJLSpY9xkS1pTKve5EtpJn+OO8j9fq:NRu+pY9d1p+vKQgJr
Malware Config
Extracted
formbook
4.1
quf
abecla.com
beautiful-journey-nz.com
littlesnj.com
bubfive.com
shoppecancreek.com
campey.store
tacokingsfl.com
tutorialme.com
azbku.com
everis-kids.com
annekatran.com
crownstarhomes.com
angiehsuflow.com
caracasdev.net
itselectricboat.com
tuidrimer.net
motherofreaders.com
tallahasseekidstriathlons.com
buhhoh.com
cudahy68.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\c45a5095dcd3afa44b6636a875a5adcb_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\c45a5095dcd3afa44b6636a875a5adcb_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2224 -s 2682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 2224 -ip 22241⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
1024KB
-
Filesize
73.8MB