Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17-12-2024 22:57

General

  • Target

    f92d115c8a7e6a38aade6aad038c49dd_JaffaCakes118.exe

  • Size

    734KB

  • MD5

    f92d115c8a7e6a38aade6aad038c49dd

  • SHA1

    81aed899b36ca58821b3c7b06ea56a0e8942a433

  • SHA256

    003516e2f71004adc351d3d03f41c642c5f56f9ea1ac4d3369ec51550e69e0f1

  • SHA512

    f2d643ca42490584364dda4610aedb21a7f872f09cdddb9aef43117a61c296f67128314df532ca9360fcb88435ee4e985634c72e29a6767c33b378eefcc1755e

  • SSDEEP

    12288:5N+NSn2iNeHK7zatLJ8FebazVp5VKhsA1dsGlnVIaVr3ySCp1W9+RP:5NMk1b2l4ebaHnKv3sqIaVr4I+

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

xgmi

Decoy

ivouty.icu

bgilroy.com

dgden.com

grosse-schware.com

mandos.tech

deedv.com

the724lab.com

dulcepicor.com

cupsandkids.com

albertafutsal.com

ponthierandson.com

tiendaewin.com

200garden.com

f9753.com

cognitivehearingspecialist.com

pikypets.com

dimestorecowgirlscompany.com

reefervannetwork.com

umf2.com

yoniwater.com

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 3 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Gathers network information 2 TTPs 1 IoCs

    Uses commandline utility to view network configuration.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 49 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3420
    • C:\Users\Admin\AppData\Local\Temp\f92d115c8a7e6a38aade6aad038c49dd_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\f92d115c8a7e6a38aade6aad038c49dd_JaffaCakes118.exe"
      2⤵
      • Looks for VirtualBox Guest Additions in registry
      • Looks for VMWare Tools registry key
      • Checks BIOS information in registry
      • Checks computer location settings
      • Maps connected drives based on registry
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1916
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\f92d115c8a7e6a38aade6aad038c49dd_JaffaCakes118.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4280
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XmlcHWnTkL.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1688
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XmlcHWnTkL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp54A3.tmp"
        3⤵
        • System Location Discovery: System Language Discovery
        • Scheduled Task/Job: Scheduled Task
        PID:3616
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XmlcHWnTkL.exe"
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2704
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        PID:2636
    • C:\Windows\SysWOW64\ipconfig.exe
      "C:\Windows\SysWOW64\ipconfig.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • System Location Discovery: System Language Discovery
      • Gathers network information
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4488
      • C:\Windows\SysWOW64\cmd.exe
        /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
        3⤵
        • System Location Discovery: System Language Discovery
        PID:1292

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    3d086a433708053f9bf9523e1d87a4e8

    SHA1

    b3ab5d4f282a4c8fe8c3005b8a557ed5a0e37f28

    SHA256

    6f8fd1b8d9788ad54eaeee329232187e24b7b43393a01aeba2d6e9675231fb69

    SHA512

    931ae42b4c68a4507ff2342332b08eb407050d47cf4176137ea022d0f6e513c689e998445a04c6d18d4877391705c586bfce0234632b898d41aaed0957996dfd

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    fa47e5a630bcc5d03fbe924d22edfbbc

    SHA1

    e15872ae7ebb6ede62d7b35f0aa0b94933326d5a

    SHA256

    dee7b2255648b6e8cf1231d460d440dc1c2cd96bd8729be510ae9f2595916497

    SHA512

    26fe1f87bb9da4c3100e39c5f68a757d5dcf82456713ac301d8fd848a2f3828bb282d346351e5d2423810296315c0a2048214c905474d704f16842fc0417ed99

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    b765765d77a17ac7d5d209c9a69c4184

    SHA1

    8d2ac409db9aedd41621a8ac8d63e288d7bf5045

    SHA256

    2c2e2e0bd63aa2496ccb32b1604d5a270f8e631399241e66a863ae7e042ad479

    SHA512

    9536afa7e86f261f945f3510287f9d0dc2be98e5ac1719a7e97c4a1245bf43434e5045e020fd0ec179f9274fd4686493626e11d423bd7953b0958ce9379e8e98

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qnoomifa.sgp.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp54A3.tmp

    Filesize

    1KB

    MD5

    31fd755c01b651ebbd4b425600d945b2

    SHA1

    32e1e11007d6a26f6174d68d47e20b880347cf08

    SHA256

    cbe976d76e39a1f35cbed43fea01d51fc482b4696c8cef088ded25827a36d76a

    SHA512

    a08fba5cd594426032f7badea46219b775426799c96815be342f181b21940e86516a5895c480955b53187618ae5012be4ed9961af1f13aa82eeb40dec3a2fa6b

  • memory/1688-83-0x00000000075B0000-0x00000000075CA000-memory.dmp

    Filesize

    104KB

  • memory/1688-96-0x00000000077B0000-0x00000000077C1000-memory.dmp

    Filesize

    68KB

  • memory/1688-78-0x0000000007450000-0x000000000746E000-memory.dmp

    Filesize

    120KB

  • memory/1688-59-0x0000000007210000-0x0000000007242000-memory.dmp

    Filesize

    200KB

  • memory/1688-79-0x0000000007480000-0x0000000007523000-memory.dmp

    Filesize

    652KB

  • memory/1688-60-0x000000006F670000-0x000000006F6BC000-memory.dmp

    Filesize

    304KB

  • memory/1688-82-0x0000000007BF0000-0x000000000826A000-memory.dmp

    Filesize

    6.5MB

  • memory/1688-84-0x0000000007620000-0x000000000762A000-memory.dmp

    Filesize

    40KB

  • memory/1916-11-0x0000000008ED0000-0x0000000008F74000-memory.dmp

    Filesize

    656KB

  • memory/1916-2-0x0000000005970000-0x0000000005A0C000-memory.dmp

    Filesize

    624KB

  • memory/1916-4-0x0000000005B40000-0x0000000005BD2000-memory.dmp

    Filesize

    584KB

  • memory/1916-3-0x0000000006050000-0x00000000065F4000-memory.dmp

    Filesize

    5.6MB

  • memory/1916-13-0x000000000E6F0000-0x000000000E756000-memory.dmp

    Filesize

    408KB

  • memory/1916-12-0x000000000B650000-0x000000000B684000-memory.dmp

    Filesize

    208KB

  • memory/1916-6-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1916-5-0x0000000005A60000-0x0000000005A6A000-memory.dmp

    Filesize

    40KB

  • memory/1916-10-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1916-1-0x0000000000F70000-0x000000000102E000-memory.dmp

    Filesize

    760KB

  • memory/1916-0-0x00000000749CE000-0x00000000749CF000-memory.dmp

    Filesize

    4KB

  • memory/1916-47-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/1916-9-0x00000000749CE000-0x00000000749CF000-memory.dmp

    Filesize

    4KB

  • memory/1916-8-0x00000000089E0000-0x00000000089F6000-memory.dmp

    Filesize

    88KB

  • memory/1916-7-0x0000000005D10000-0x0000000005D66000-memory.dmp

    Filesize

    344KB

  • memory/2636-44-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2636-109-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/2704-85-0x000000006F670000-0x000000006F6BC000-memory.dmp

    Filesize

    304KB

  • memory/3420-115-0x00000000090D0000-0x000000000921A000-memory.dmp

    Filesize

    1.3MB

  • memory/4280-98-0x00000000078B0000-0x00000000078C4000-memory.dmp

    Filesize

    80KB

  • memory/4280-100-0x0000000007990000-0x0000000007998000-memory.dmp

    Filesize

    32KB

  • memory/4280-22-0x0000000005400000-0x0000000005466000-memory.dmp

    Filesize

    408KB

  • memory/4280-33-0x0000000005D10000-0x0000000006064000-memory.dmp

    Filesize

    3.3MB

  • memory/4280-95-0x00000000078F0000-0x0000000007986000-memory.dmp

    Filesize

    600KB

  • memory/4280-17-0x00000000054E0000-0x0000000005B08000-memory.dmp

    Filesize

    6.2MB

  • memory/4280-97-0x00000000078A0000-0x00000000078AE000-memory.dmp

    Filesize

    56KB

  • memory/4280-66-0x000000006F670000-0x000000006F6BC000-memory.dmp

    Filesize

    304KB

  • memory/4280-99-0x00000000079B0000-0x00000000079CA000-memory.dmp

    Filesize

    104KB

  • memory/4280-21-0x0000000005360000-0x0000000005382000-memory.dmp

    Filesize

    136KB

  • memory/4280-15-0x0000000004D90000-0x0000000004DC6000-memory.dmp

    Filesize

    216KB

  • memory/4280-16-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/4280-106-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/4280-14-0x00000000749C0000-0x0000000075170000-memory.dmp

    Filesize

    7.7MB

  • memory/4280-48-0x0000000006390000-0x00000000063DC000-memory.dmp

    Filesize

    304KB

  • memory/4280-46-0x0000000006350000-0x000000000636E000-memory.dmp

    Filesize

    120KB

  • memory/4488-111-0x0000000000330000-0x000000000035E000-memory.dmp

    Filesize

    184KB

  • memory/4488-110-0x0000000000B60000-0x0000000000B6B000-memory.dmp

    Filesize

    44KB