Analysis
-
max time kernel
51s -
max time network
51s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
16-06-2024 08:39
Static task
static1
Behavioral task
behavioral1
Sample
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe
Resource
win7-20240508-en
General
-
Target
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe
-
Size
1.5MB
-
MD5
b29ab9daeda57a7b9494bf50e37b556c
-
SHA1
c97d6f7ebda204b6411a00e8fb3b4fd80e62cc33
-
SHA256
9cd82d6a35b48112a4e99f0cbdbd3a18df7738082d7f40f24274debfc5688ec4
-
SHA512
563f8344cddd5b02e9a7da0f11358f3f07a977ac21f1555a45f1d817315d9cdea5c87fc43dba8fc2a59b14e150ae33bb460c7ccdfabe428b14e0413fdeaa0719
-
SSDEEP
24576:lOs6umvEsVB7VzuVB9ejCEvbJ1DZfx3LCkwR2cLh62MpeycxEYY1pSlr3DV8bxO3:B0Dfx3LvcLh62GeqYY1E9/
Malware Config
Extracted
formbook
4.1
cmg
8936199.com
caneryis.com
kkambo.net
lifecoachwoman.com
kardus6.xyz
larvashop.net
stapelskerstbomen.com
dropofluxe.com
1089konstanzter.com
simplelovedlife.com
manderley-condos.com
xexpressx.com
cheshuntcomp.com
chinazhenzhu.com
autoaccessoriesusainc.com
luccagamesawards.com
edwardguimont.com
aljawaheer.com
rootforequality.com
premiumtechiessupport.xyz
ix1e.com
ravomail.com
fastroot.club
fortnitecup.space
47.holdings
northminute.com
cenitcard.com
yumnamccann.com
irelandjoy.com
ohayouapp.com
iaimorganic.com
essecehealthcareotc.com
esanjor.online
shabdhan.com
ipatch.pro
makeassociation.com
promstudios.com
vocenaviagem.com
quanahsays.com
trousersport.guru
stickerzy.club
get4gbroadband.com
txtecnic.com
pricescuisinecrinak.com
clicdrone.com
oxbstwnm.icu
helloboysonline.com
amibagusa.com
igrowtr.com
microbladingpamplona.com
usabakk.com
talent-partner.com
messi-and-ronaldo.com
nwslot.com
beaconpointeportage.care
uciabwd.com
playredpandagames.com
clearyt.com
sonakshidhamija.com
mantinakliyat.com
amusic11.com
salonboardshop.com
nughte.club
kayparkermilf.com
shizukis2.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3040-19-0x0000000000400000-0x000000000042E000-memory.dmp formbook -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exedescription pid process target process PID 4676 set thread context of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exepid process 3040 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe 3040 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exedescription pid process target process PID 4676 wrote to memory of 856 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe schtasks.exe PID 4676 wrote to memory of 856 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe schtasks.exe PID 4676 wrote to memory of 856 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe schtasks.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe PID 4676 wrote to memory of 3040 4676 b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\QZblaErkmXlkhK" /XML "C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmp"2⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\Temp\b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b29ab9daeda57a7b9494bf50e37b556c_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp1E12.tmpFilesize
1KB
MD51e635688c2e6c213fa21e48ccb8876df
SHA14bc04fae52edfae671446ec2e09d79acb3d744a4
SHA25663257f7551d25c526dadd11b24975e68e3890851415cf1ba4354735c0f237d0f
SHA512264d3449f8ac0286c5f0daa4bec3787b1521d7b7cc605557b01699138aaab5bff05546bcb89265a4e81fe1922a89fcd1e251283fb711492a1c0c01b390451519
-
memory/3040-22-0x0000000001630000-0x000000000197A000-memory.dmpFilesize
3.3MB
-
memory/3040-19-0x0000000000400000-0x000000000042E000-memory.dmpFilesize
184KB
-
memory/4676-8-0x00000000054E0000-0x00000000054F8000-memory.dmpFilesize
96KB
-
memory/4676-10-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/4676-5-0x00000000051E0000-0x00000000051EA000-memory.dmpFilesize
40KB
-
memory/4676-6-0x0000000005300000-0x0000000005356000-memory.dmpFilesize
344KB
-
memory/4676-7-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/4676-0-0x0000000074CAE000-0x0000000074CAF000-memory.dmpFilesize
4KB
-
memory/4676-9-0x0000000074CAE000-0x0000000074CAF000-memory.dmpFilesize
4KB
-
memory/4676-4-0x0000000005260000-0x00000000052F2000-memory.dmpFilesize
584KB
-
memory/4676-11-0x0000000006B30000-0x0000000006B86000-memory.dmpFilesize
344KB
-
memory/4676-12-0x0000000006830000-0x0000000006836000-memory.dmpFilesize
24KB
-
memory/4676-13-0x0000000006B80000-0x0000000006BB6000-memory.dmpFilesize
216KB
-
memory/4676-3-0x0000000005770000-0x0000000005D14000-memory.dmpFilesize
5.6MB
-
memory/4676-2-0x0000000005120000-0x00000000051BC000-memory.dmpFilesize
624KB
-
memory/4676-21-0x0000000074CA0000-0x0000000075450000-memory.dmpFilesize
7.7MB
-
memory/4676-1-0x0000000000600000-0x000000000077A000-memory.dmpFilesize
1.5MB