Analysis
-
max time kernel
104s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
-
submitted
08-09-2024 13:39
General
-
Target
d47cb61772024784a91b552885b4d0c9_JaffaCakes118.exe
-
Size
825KB
-
MD5
d47cb61772024784a91b552885b4d0c9
-
SHA1
9572f6651e59ea8474abbb5b6ea4fd32e1d19603
-
SHA256
f41ce77e4a64ef9beba0ef431bba14adc1f79e978aa93b70eeeef9873700f7ab
-
SHA512
b6f27ccd48005ab231b2ab65345a64a5fe610cc178fb488c4463e57aa01db4124b228279be2c9fb5306587450d62b1f994db0bb2d69b725986986f9730e29dec
-
SSDEEP
24576:mzWBFVAOs3mBOzqsYSltm1ruR3Wr6ZWIcY8DqSiI5rYNXPD:mSzVAOaV1+1k3A6YKrI58NXPD
Malware Config
Extracted
formbook
3.9
ch
hfhsh.com
innerlightmemoirs.com
qinmingshengshi.net
kambansal.com
oodlsofart.com
eyesofmidfl.com
bjcjpme.com
trafficsiren.com
drinky.world
mamaesabetudo.com
dulcevitae.com
climatecrap.com
sparte7.com
senken.net
davidkullman.com
testerreviews.com
justjesusministries.com
happyhealthyou.fitness
askanauautoinsuranceok.live
confettiicouture.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47cb61772024784a91b552885b4d0c9_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\d47cb61772024784a91b552885b4d0c9_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
844KB
-
Filesize
844KB
-
Filesize
3.3MB
-
Filesize
844KB