Analysis

  • max time kernel
    148s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-12-2024 04:33

General

  • Target

    fe740e7999ea046c611b6af048228301_JaffaCakes118.exe

  • Size

    846KB

  • MD5

    fe740e7999ea046c611b6af048228301

  • SHA1

    b11b855d1328255503fd2e3d86260293af0fef8a

  • SHA256

    e53afd0b5fd432a725fce3ee514f9bf7e58b54b06c096640c0672faf7eb209b5

  • SHA512

    c6eef694077d945c92dab79d1f99b349d71fa65f0a9dbece5a86f9e400e85c9c6b0ffd8d2236e4cde1ab97728762262bc6e2272a33e9f561418d3c56ce16f617

  • SSDEEP

    24576:AAsnEguXVgHgteHLHyLWf6A1Ti2KIzoGsrq34MeWjc:3tFWfV4MeWj

Malware Config

Extracted

Family

formbook

Version

4.1

Campaign

qg0x

Decoy

guruguyd.com

martiallawtcg.com

minervamerch.com

websiteseotools.net

productionsrassembleurs.com

tarcanlaroto.com

zoloftmusic.com

waseet.club

mtelphinstonemasonicsociety.com

indertechstore.com

iostdefi.net

juxrams.info

magwearhouse.com

ellerey.com

jointhekkk.com

wednesdaytravel.com

nineban.icu

westcoastk95.com

parkcityruthschris.com

monicarodri.design

Signatures

  • Formbook

    Formbook is a data stealing malware which is capable of stealing data.

  • Formbook family
  • Formbook payload 1 IoCs
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Looks for VMWare Tools registry key 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 9 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\fe740e7999ea046c611b6af048228301_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\fe740e7999ea046c611b6af048228301_JaffaCakes118.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Maps connected drives based on registry
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3812
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\fe740e7999ea046c611b6af048228301_JaffaCakes118.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:740
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hfeCcdsnBnrre.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:5116
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\hfeCcdsnBnrre" /XML "C:\Users\Admin\AppData\Local\Temp\tmp7460.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2980
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\hfeCcdsnBnrre.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3648
    • C:\Users\Admin\AppData\Local\Temp\fe740e7999ea046c611b6af048228301_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\fe740e7999ea046c611b6af048228301_JaffaCakes118.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4296

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

    Filesize

    2KB

    MD5

    968cb9309758126772781b83adb8a28f

    SHA1

    8da30e71accf186b2ba11da1797cf67f8f78b47c

    SHA256

    92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a

    SHA512

    4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

    Filesize

    18KB

    MD5

    de6045be96e3fa34c3cfd3ae2166fd6e

    SHA1

    a9178f6b6cdaf550af13fd776ae41847480aad12

    SHA256

    58896ba86c004f1a922093562fac61fdc5d1d6ee6514d6c388970892df931698

    SHA512

    8c8aa7ddac33f20d3f912ad5aea612f7d5e096f727b13c1db994456319f602a7d5417ff69e57999943a94d9b32fc94d155442652f2920a115833df6f62c5f8ef

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_otkdtuev.lba.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp7460.tmp

    Filesize

    1KB

    MD5

    3d3203315a8fd20a32c9de16344e0908

    SHA1

    9727786fdd4ccffda568f33a1e1651e9b29d20d1

    SHA256

    e8a4eed02d0cf6bf99b10085eb3b12a3acfb9e884c3cbfa78bb5fc1ae52168be

    SHA512

    b98ae161453158e467cd1c8f49e9fd6b6518dba770f842215b3e2b0e7546314ede90387da9869438f6dccda52548436568cab9e9b4d377a00adbfd530671e397

  • memory/740-76-0x0000000007CD0000-0x0000000007CDA000-memory.dmp

    Filesize

    40KB

  • memory/740-15-0x0000000003020000-0x0000000003056000-memory.dmp

    Filesize

    216KB

  • memory/740-110-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/740-36-0x0000000006940000-0x000000000695E000-memory.dmp

    Filesize

    120KB

  • memory/740-102-0x0000000007F80000-0x0000000007F88000-memory.dmp

    Filesize

    32KB

  • memory/740-101-0x0000000007FA0000-0x0000000007FBA000-memory.dmp

    Filesize

    104KB

  • memory/740-100-0x0000000007EA0000-0x0000000007EB4000-memory.dmp

    Filesize

    80KB

  • memory/740-99-0x0000000007E90000-0x0000000007E9E000-memory.dmp

    Filesize

    56KB

  • memory/740-98-0x0000000007E60000-0x0000000007E71000-memory.dmp

    Filesize

    68KB

  • memory/740-97-0x0000000007EE0000-0x0000000007F76000-memory.dmp

    Filesize

    600KB

  • memory/740-75-0x0000000007C60000-0x0000000007C7A000-memory.dmp

    Filesize

    104KB

  • memory/740-24-0x0000000005B00000-0x0000000005B66000-memory.dmp

    Filesize

    408KB

  • memory/740-16-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/740-17-0x0000000005CB0000-0x00000000062D8000-memory.dmp

    Filesize

    6.2MB

  • memory/740-18-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/740-19-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/740-23-0x0000000005860000-0x0000000005882000-memory.dmp

    Filesize

    136KB

  • memory/740-74-0x00000000082A0000-0x000000000891A000-memory.dmp

    Filesize

    6.5MB

  • memory/740-73-0x0000000007B40000-0x0000000007BE3000-memory.dmp

    Filesize

    652KB

  • memory/740-35-0x0000000006350000-0x00000000066A4000-memory.dmp

    Filesize

    3.3MB

  • memory/740-38-0x00000000069D0000-0x0000000006A1C000-memory.dmp

    Filesize

    304KB

  • memory/740-61-0x0000000006F10000-0x0000000006F42000-memory.dmp

    Filesize

    200KB

  • memory/740-72-0x0000000006EF0000-0x0000000006F0E000-memory.dmp

    Filesize

    120KB

  • memory/740-62-0x000000006F890000-0x000000006F8DC000-memory.dmp

    Filesize

    304KB

  • memory/3648-87-0x000000006F890000-0x000000006F8DC000-memory.dmp

    Filesize

    304KB

  • memory/3812-8-0x0000000004E40000-0x0000000004E96000-memory.dmp

    Filesize

    344KB

  • memory/3812-10-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/3812-7-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/3812-3-0x000000000A0E0000-0x000000000A17C000-memory.dmp

    Filesize

    624KB

  • memory/3812-4-0x000000000A730000-0x000000000ACD4000-memory.dmp

    Filesize

    5.6MB

  • memory/3812-5-0x000000000A180000-0x000000000A212000-memory.dmp

    Filesize

    584KB

  • memory/3812-14-0x00000000082A0000-0x0000000008306000-memory.dmp

    Filesize

    408KB

  • memory/3812-13-0x0000000006810000-0x0000000006844000-memory.dmp

    Filesize

    208KB

  • memory/3812-6-0x0000000002500000-0x000000000250A000-memory.dmp

    Filesize

    40KB

  • memory/3812-2-0x0000000006FA0000-0x000000000703E000-memory.dmp

    Filesize

    632KB

  • memory/3812-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

    Filesize

    4KB

  • memory/3812-12-0x00000000061E0000-0x0000000006282000-memory.dmp

    Filesize

    648KB

  • memory/3812-11-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/3812-1-0x0000000000030000-0x000000000010A000-memory.dmp

    Filesize

    872KB

  • memory/3812-9-0x0000000005BC0000-0x0000000005BD6000-memory.dmp

    Filesize

    88KB

  • memory/3812-42-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/4296-40-0x0000000000400000-0x000000000042E000-memory.dmp

    Filesize

    184KB

  • memory/5116-111-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/5116-37-0x0000000074BE0000-0x0000000075390000-memory.dmp

    Filesize

    7.7MB

  • memory/5116-77-0x000000006F890000-0x000000006F8DC000-memory.dmp

    Filesize

    304KB