Analysis
-
max time kernel
139s -
max time network
123s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
-
submitted
15-10-2024 04:00
General
-
Target
45bc49b996c6040cbc5b28590088104d_JaffaCakes118.exe
-
Size
325KB
-
MD5
45bc49b996c6040cbc5b28590088104d
-
SHA1
23264a17a33e80e733a40b0a83aee67fbc64095a
-
SHA256
f373ecdfd330a404b2b04c84d3382518059b74c98d5d9a2f12d9250321266120
-
SHA512
e8c32984d34597f93bfda58749f2a763a85111d3069a1949e9cb90d2398e9ec91d6504b531140ad2ab72d42e4fd3d93783ff25a2a48d584f6cccef9a1c652870
-
SSDEEP
6144:LbWSyDvTutccGt+Sw6KDLvSqFKPj9gfihKArts:LbWSyDatcJ+p6Kn2Pxgfih
Malware Config
Extracted
formbook
4.1
dn7r
eventphotographerdfw.com
thehalalcoinstaking.com
philipfaziofineart.com
intercoh.com
gaiaseyephotography.com
chatbotforrealestate.com
lovelancemg.com
marlieskasberger.com
elcongoenespanol.info
lepirecredit.com
distribution-concept.com
e99game.com
exit11festival.com
twodollartoothbrushclub.com
cocktailsandlawn.com
performimprove.network
24horas-telefono-11840.com
cosmossify.com
kellenleote.com
perovskite.energy
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 2 IoCs
-
Program crash 1 IoCs
-
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\45bc49b996c6040cbc5b28590088104d_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\45bc49b996c6040cbc5b28590088104d_JaffaCakes118.exe"1⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 112 -s 2522⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 112 -ip 1121⤵
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1024KB
-
Filesize
188KB
-
Filesize
4.5MB