Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
-
submitted
19-09-2024 19:14
General
-
Target
ec040a29055a7a7fb054c05095970082_JaffaCakes118.exe
-
Size
288KB
-
MD5
ec040a29055a7a7fb054c05095970082
-
SHA1
8c1d5984938ec48f63d3c487857e1e86e104bad3
-
SHA256
8229552b02fb2542bc78668c71bd9fd71b735735778948cf467c5740197bbe01
-
SHA512
137062bf73e119a0856e90c8fa323ffd11438a8d64843f1637a5fd61db2fd03026ef832330d547cc04e34c9f2280d97e359f89f045cb8f73cddc8b9fa4412503
-
SSDEEP
6144:cHeoFv/oW+0jDkRdBnvsLEV5ypPAOkeC:c+WXppW0LEV5yXC
Malware Config
Extracted
formbook
3.9
main
ericspanton.com
reptilelog.com
tv18075.cloud
zifo.ltd
funkyrevival.com
beyondlashesboutique.com
leyi366.net
lumenixfabrika.com
com-appswebsauthorizes.info
filmstreamvf.agency
petftnder.com
btctrader.win
metzger4.win
zexcqz.com
618yiq.info
dralirizaicel.com
alphabarn.com
jingziorg.com
homewardlive.com
byrife.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ec040a29055a7a7fb054c05095970082_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\ec040a29055a7a7fb054c05095970082_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
856KB
-
Filesize
304KB
-
Filesize
1.0MB
-
Filesize
1.7MB