Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
22/09/2024, 10:31
General
- Target f1d688be9e2a5fc6af4c629f52fc9a70_JaffaCakes118.exe
- Size 291KB
- Sample240922-mkhevsvdrb
- SHA256 74f09445e1a75b5faa7038d8ab371fd405766dd3d68dcd2eeb4c066e335a2566
Malware Config
Extracted
-
formbook
-
3.9
-
jo
-
equipoarbitral.info
-
isoexercise.com
-
interactivenetworksystems.com
-
mozexnews.com
-
vkebfdkg.com
-
learntoearn.live
-
quomagazine.com
-
milkeknappford.com
-
missdailia.com
-
basames2009.com
-
babybirthdaycheers.com
-
philadelhiaflyers.com
-
saamcm.net
-
deyiclinic.com
-
politicalrubbish.com
-
1e0eighthell.men
-
buenosairespadelcourt.com
-
womenjiao.com
-
lubb26261.com
-
bastacasinosvenska.com
Signatures
- Formbook
Formbook is a data stealing malware which is capable of stealing data.
- Formbook payload 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of FindShellTrayWindow 30 IoCs
- Suspicious use of SendNotifyMessage 30 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1d688be9e2a5fc6af4c629f52fc9a70_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\f1d688be9e2a5fc6af4c629f52fc9a70_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3504-0-0x0000000000920000-0x000000000096E000-memory.dmp
memory/3504-1-0x0000000000920000-0x000000000096E000-memory.dmp
memory/3504-2-0x00000000041D0000-0x000000000451A000-memory.dmp
memory/3504-3-0x0000000000920000-0x000000000096E000-memory.dmp