Overview

overview

10

Static

static

1

9dde617fbe...18.rtf

windows7-x64

10

9dde617fbe...18.rtf

windows10-2004-x64

1

Sharing

Copy URL
Twitter E-mail

General

  • Target

    9dde617fbec0417339ab2bfe4ccc3af8_JaffaCakes118

  • Size

    857KB

  • Sample

    240611-mh2qqatcrf

  • MD5

    9dde617fbec0417339ab2bfe4ccc3af8

  • SHA1

    8b2ee2277b339c23e48c3aa93a570e8932aa6160

  • SHA256

    a841cd61602019eeb2af295482f83c89032aa25c59457a83a1a3f2c275961989

  • SHA512

    d0538086f3a1e676a442bd0518e1eec3367bd4f5c5e92b8e104ee3811336fc186ace34c8eaf3b113353609ffc1855005a075f5b188454652f442dc61234c83f8

  • SSDEEP

    24576:FNjlDxKqaS4LQHn5r1Yb8bdt/EtOc+xuNjll:m

Score
10/10
formbookch49persistenceratspywarestealertrojan

Malware Config

Extracted

Family

formbook

Version

3.8

Campaign

ch49

Decoy

splashingsuits.com

risingchefs.com

lalune.photo

naturedocclinic.com

sz-dgm.com

dialitica.com

tabletoprentalsnj.com

gullonthebay.net

sszhvip.com

402man.com

365bdc.net

opensourcenoself.com

aarhaluxuryresort.com

gvs-cargo.com

lwhwdx.info

fiw.biz

prismpaintingmi.com

ollie.email

dqrbj.com

tuanlongan.com

Targets

    • Target

      9dde617fbec0417339ab2bfe4ccc3af8_JaffaCakes118

    • Size

      857KB

    • MD5

      9dde617fbec0417339ab2bfe4ccc3af8

    • SHA1

      8b2ee2277b339c23e48c3aa93a570e8932aa6160

    • SHA256

      a841cd61602019eeb2af295482f83c89032aa25c59457a83a1a3f2c275961989

    • SHA512

      d0538086f3a1e676a442bd0518e1eec3367bd4f5c5e92b8e104ee3811336fc186ace34c8eaf3b113353609ffc1855005a075f5b188454652f442dc61234c83f8

    • SSDEEP

      24576:FNjlDxKqaS4LQHn5r1Yb8bdt/EtOc+xuNjll:m

    Score
    10/10
    formbookch49persistenceratspywarestealertrojan

    • Formbook

      Formbook is a data stealing malware which is capable of stealing data.

      trojanspywarestealerformbook

    • Process spawned unexpected child process

      This typically indicates the parent process was compromised via an exploit or macro.

    • Formbook payload

      rat

    • Adds policy Run key to start application

      persistence

    • Executes dropped EXE

    • Loads dropped DLL

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Exploitation for Client Execution

1
T1203

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks