Analysis
-
max time kernel
131s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240910-en -
resource tags
-
submitted
05-10-2024 06:39
General
-
Target
169082792420e874a70c624ab272fb3a_JaffaCakes118.exe
-
Size
324KB
-
MD5
169082792420e874a70c624ab272fb3a
-
SHA1
1e80f99ace4f9971ecde4064a2e53fc971e60bd6
-
SHA256
b6b874a0c9a219eb0beb1d09887e78167c57fe4ca746230382a52b574c9da081
-
SHA512
8605b575c9e4697dafa4404558dc328fa6e356e303d8b7bbb5d1947ba1a6119224c5073d7961a760c2d21bbcf9ae2a2927f0b7a664417242f88ce4ee1dcb01b7
-
SSDEEP
6144:cMCvF3QG2jgIBVNsY9rgTkTi5xJizjZn5+KzcXY156X6xieJ:cHtgG2jbVNLE7ajZn5+dY1IKx
Malware Config
Extracted
formbook
4.1
dn7r
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\169082792420e874a70c624ab272fb3a_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\169082792420e874a70c624ab272fb3a_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 460 -s 2602⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 460 -ip 4601⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
188KB
-
Filesize
1024KB
-
Filesize
4.5MB