Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
30-08-2024 23:09
Static task
static1
Behavioral task
behavioral1
Sample
cbd7b03a1410f9d9c404a33020c2c49f_JaffaCakes118.msi
Resource
win7-20240704-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
cbd7b03a1410f9d9c404a33020c2c49f_JaffaCakes118.msi
Resource
win10v2004-20240802-en
windows10-2004-x64
16 signatures
150 seconds
General
-
Target
cbd7b03a1410f9d9c404a33020c2c49f_JaffaCakes118.msi
-
Size
484KB
-
MD5
cbd7b03a1410f9d9c404a33020c2c49f
-
SHA1
46873e92417016950176968517a80cd4f83f2927
-
SHA256
659b0101cf2a80010a2254f632a3964ca0917c65694e6cdcdb258f2ea36c30b4
-
SHA512
8b4163b6d94a3fdc71331461626bf9b6a4af1687e9f155a55122d6152ed12e1d2880c4dd01b6b3ee7f953fed247e35b09d6b28a78c115b4dae8488e451767c2c
-
SSDEEP
12288:uE4cI068+xWfFSAUadblygLj69i4r8dO2C7qM:uEB6kNBlygy9brsO2C7qM
Malware Config
Extracted
Family
formbook
Version
3.9
Campaign
ai
Decoy
theapschool.com
riseupfloridakeys.com
xn--mgbb2awa9dm20i.com
apnee-coach.com
christianmarketinggifts.com
eurothereum.biz
solutionfull.com
equifaxqsecurity2017.com
roboeye-tech.com
living-isar.immo
cable-online-zone.sale
parfumirza.com
civilizationsprice.com
zealasia.com
billet-bateau-tanger.com
andrewkurtsummers.net
darylandkaitlyn.com
ddaak.com
seattlepetadventures.com
iopuern.online
1000miningtest.com
brickellwatches.com
axinema.com
hondudiariohn.com
xn--lcyxc.com
handymanbrevard.biz
itsanodd.world
ancoinc.net
kalkulatorlokat.online
digestivewellnessrichmond.com
chestercountypaconstable.com
kaifenggs.com
thongtintienao.com
flynow.site
thebearlive.com
anitanewby.com
wwwjinsha645.com
valuesaudience.com
ksh774.com
wwwbonobos.com
hbbileita.com
authoreonico.com
bradfordhill.info
doxservr.com
rjwlkj.com
quhong.site
tanegashima.rocks
betteremploymentsolutions.com
staftw.com
unchained-blockchain.com
xn--rhq379ir3s.com
gehrhardt.news
lanicobridal.com
dontgetvolusion.com
midiomalinea.com
timbrownphotos.com
oliodolivadama.com
willtobeonesself.com
zstartupspace.com
facilitonsnouslavie.com
uaevas.com
mpheffernan.com
vzkfreight.com
aspenportal.com
hacdop.com
Signatures
-
Formbook payload 2 IoCs
resource yara_rule behavioral1/memory/2616-16-0x0000000000400000-0x000000000042A000-memory.dmp formbook behavioral1/memory/2616-29-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\L: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\H: msiexec.exe File opened (read-only) \??\M: msiexec.exe File opened (read-only) \??\N: msiexec.exe File opened (read-only) \??\T: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\G: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\X: msiexec.exe File opened (read-only) \??\Z: msiexec.exe File opened (read-only) \??\A: msiexec.exe File opened (read-only) \??\B: msiexec.exe File opened (read-only) \??\Q: msiexec.exe File opened (read-only) \??\U: msiexec.exe File opened (read-only) \??\Y: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\V: msiexec.exe File opened (read-only) \??\I: msiexec.exe File opened (read-only) \??\J: msiexec.exe File opened (read-only) \??\K: msiexec.exe File opened (read-only) \??\O: msiexec.exe File opened (read-only) \??\P: msiexec.exe File opened (read-only) \??\R: msiexec.exe File opened (read-only) \??\W: msiexec.exe File opened (read-only) \??\S: msiexec.exe File opened (read-only) \??\E: msiexec.exe File opened (read-only) \??\Z: msiexec.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2864 set thread context of 2616 2864 MSI9E06.tmp 36 PID 2616 set thread context of 1244 2616 MSI9E06.tmp 21 PID 2616 set thread context of 1244 2616 MSI9E06.tmp 21 -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\Installer\MSI9DB6.tmp msiexec.exe File opened for modification C:\Windows\Installer\MSI9E06.tmp msiexec.exe File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe File created C:\Windows\Installer\f769c3f.msi msiexec.exe File opened for modification C:\Windows\Installer\f769c3f.msi msiexec.exe File created C:\Windows\Installer\f769c42.ipi msiexec.exe File opened for modification C:\Windows\Installer\ msiexec.exe File opened for modification C:\Windows\Installer\f769c42.ipi msiexec.exe -
Executes dropped EXE 2 IoCs
pid Process 2864 MSI9E06.tmp 2616 MSI9E06.tmp -
Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs
pid Process 3044 msiexec.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language MSI9E06.tmp -
Modifies data under HKEY_USERS 43 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2820 msiexec.exe 2820 msiexec.exe 2616 MSI9E06.tmp 2616 MSI9E06.tmp 2616 MSI9E06.tmp -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2616 MSI9E06.tmp 2616 MSI9E06.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3044 msiexec.exe Token: SeIncreaseQuotaPrivilege 3044 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeSecurityPrivilege 2820 msiexec.exe Token: SeCreateTokenPrivilege 3044 msiexec.exe Token: SeAssignPrimaryTokenPrivilege 3044 msiexec.exe Token: SeLockMemoryPrivilege 3044 msiexec.exe Token: SeIncreaseQuotaPrivilege 3044 msiexec.exe Token: SeMachineAccountPrivilege 3044 msiexec.exe Token: SeTcbPrivilege 3044 msiexec.exe Token: SeSecurityPrivilege 3044 msiexec.exe Token: SeTakeOwnershipPrivilege 3044 msiexec.exe Token: SeLoadDriverPrivilege 3044 msiexec.exe Token: SeSystemProfilePrivilege 3044 msiexec.exe Token: SeSystemtimePrivilege 3044 msiexec.exe Token: SeProfSingleProcessPrivilege 3044 msiexec.exe Token: SeIncBasePriorityPrivilege 3044 msiexec.exe Token: SeCreatePagefilePrivilege 3044 msiexec.exe Token: SeCreatePermanentPrivilege 3044 msiexec.exe Token: SeBackupPrivilege 3044 msiexec.exe Token: SeRestorePrivilege 3044 msiexec.exe Token: SeShutdownPrivilege 3044 msiexec.exe Token: SeDebugPrivilege 3044 msiexec.exe Token: SeAuditPrivilege 3044 msiexec.exe Token: SeSystemEnvironmentPrivilege 3044 msiexec.exe Token: SeChangeNotifyPrivilege 3044 msiexec.exe Token: SeRemoteShutdownPrivilege 3044 msiexec.exe Token: SeUndockPrivilege 3044 msiexec.exe Token: SeSyncAgentPrivilege 3044 msiexec.exe Token: SeEnableDelegationPrivilege 3044 msiexec.exe Token: SeManageVolumePrivilege 3044 msiexec.exe Token: SeImpersonatePrivilege 3044 msiexec.exe Token: SeCreateGlobalPrivilege 3044 msiexec.exe Token: SeBackupPrivilege 2908 vssvc.exe Token: SeRestorePrivilege 2908 vssvc.exe Token: SeAuditPrivilege 2908 vssvc.exe Token: SeBackupPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeLoadDriverPrivilege 2600 DrvInst.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeDebugPrivilege 2864 MSI9E06.tmp Token: SeDebugPrivilege 2616 MSI9E06.tmp Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeRestorePrivilege 2820 msiexec.exe Token: SeTakeOwnershipPrivilege 2820 msiexec.exe Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3044 msiexec.exe 3044 msiexec.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 2820 wrote to memory of 2864 2820 msiexec.exe 34 PID 2820 wrote to memory of 2864 2820 msiexec.exe 34 PID 2820 wrote to memory of 2864 2820 msiexec.exe 34 PID 2820 wrote to memory of 2864 2820 msiexec.exe 34 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 PID 2864 wrote to memory of 2616 2864 MSI9E06.tmp 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1244 -
C:\Windows\system32\msiexec.exemsiexec.exe /I C:\Users\Admin\AppData\Local\Temp\cbd7b03a1410f9d9c404a33020c2c49f_JaffaCakes118.msi2⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:3044
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\Installer\MSI9E06.tmp"C:\Windows\Installer\MSI9E06.tmp"2⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2864 -
C:\Windows\Installer\MSI9E06.tmp"C:\Windows\Installer\MSI9E06.tmp"3⤵
- Suspicious use of SetThreadContext
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:2616
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "0000000000000498" "0000000000000308"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2600
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
663B
MD5433ed0e98c3cf03525fc76e2421ca0ec
SHA12c3c8c96db6766eeba3b4960bf4df86bfd443d51
SHA256e70fe6dc0765ff796c5ef9c020b77f888af2e970533542180adcd71186be2716
SHA512303f980e3c3877ff7d75bc41e90e6e7435fbe6fb7b252e409ab1d75bf14b0c6c2d73e856638373542cba38b7ec7a12cd2d84077a4628015c86e936a62666f27f
-
Filesize
457KB
MD5d69de5541de05d308fdd0c50b7497b34
SHA101ce85209b6eeaf53b3e63648927bcd3b6bd2d70
SHA256c7eed03a4b3a89f0a0fbbf3eed98fa639f7187a31a5b0e8c7a97d0278b2d159c
SHA512f2a9a7590d8f36402cca038ce9235ad6f91f41c63cb0ce4dc9b51b6f831f1a54dc31abe018ac41c941eb96f1e3d20f6dba938767abb6888a478334164cb41fe0