Analysis
-
max time kernel
140s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
17-06-2024 00:27
Static task
static1
Behavioral task
behavioral1
Sample
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe
-
Size
525KB
-
MD5
b5f4ecf1a13b7ef894523c990b963a84
-
SHA1
7dfdc4f3d25f6b11c73e3eba0ffa5925c23ee7e2
-
SHA256
157d4620189778ea181eb65ebcba012dc8c7af3a9a9cf3ceb6560daf91df940c
-
SHA512
862e55e6619f072a8a0da44c63ddd6e1a7fd1a23daa0b4244a305b61c06d95a4ec1b158760990958163dce21042bf74bf6f083f37c8fcbb74bb001836476f0e4
-
SSDEEP
6144:4n7MUMpVvo8i72Kqwiymx1IOkmykNnK5+gWxKbqQEskb+LOHwr6X/7cH9bMf2n8H:4kVvfA3FmXBykNn2bqFskuBr/qnp5
Malware Config
Extracted
formbook
3.9
private
epsilonducts.net
stateofpunjab.com
followthegirl.com
parol2.men
hungryforlondon.com
comercializadorafqe.com
sippinteawithlynnmarie.com
qianbi.group
tbfuk.com
ladybosscbdoil.com
reginatowingservices.com
avangardmerefa.com
rn-structure.com
skymansionexpatriate.com
eloiseantonie.com
leegardenapartmentsbeijing.com
selfievideochallenge.com
kay-lubcke.com
buybitcoininmalta.com
pusatgrosirgamismuslimah.com
jxanqi.com
mauiecoretreatcenter.com
transitionsales.com
jeanvivine.com
elisekirstenspeaks.com
sewff.com
bolecrie.com
mehrgaeste.net
aggregate-deutschland.com
interac-mobilityrefund.com
elitewatchseries.com
xn--6cv63oijs65m.online
nikgroupnet.com
dvizesol.com
dowemarketing.com
enlightenpdx.com
soycubaseattle.com
bestoffloydcounty.com
doriftie.link
rocks4u.store
chegoweb.com
thomrosh.com
china-blockchain.net
tonibonji.com
readysteadywish.com
albarakab.com
a-la-kart.com
harvestinfluencers.com
sukusuku467.com
danacellars.com
travimiller.com
hashflare.men
diplokopophits.com
hazel.coach
emobil-treff.info
largooffice.com
keithhumberger.com
ellepunk.com
heighttechnologies.com
holycalls.com
quoptics.com
nationsolarnyc.com
obatpembesarpenistangerang.com
bbb489.com
slacktracks.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2404-12-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Executes dropped EXE 1 IoCs
Processes:
notepad.exepid process 2404 notepad.exe -
Loads dropped DLL 8 IoCs
Processes:
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exeWerFault.exepid process 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe 2996 WerFault.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exedescription pid process target process PID 1788 set thread context of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2996 2404 WerFault.exe notepad.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exepid process 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exenotepad.exedescription pid process target process PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 1788 wrote to memory of 2404 1788 b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe notepad.exe PID 2404 wrote to memory of 2996 2404 notepad.exe WerFault.exe PID 2404 wrote to memory of 2996 2404 notepad.exe WerFault.exe PID 2404 wrote to memory of 2996 2404 notepad.exe WerFault.exe PID 2404 wrote to memory of 2996 2404 notepad.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\b5f4ecf1a13b7ef894523c990b963a84_JaffaCakes118.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\temp\notepad.exeC:\Windows\temp\notepad.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2404 -s 363⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\Temp\notepad.exeFilesize
1.1MB
MD534aa912defa18c2c129f1e09d75c1d7e
SHA19c3046324657505a30ecd9b1fdb46c05bde7d470
SHA2566df94b7fa33f1b87142adc39b3db0613fc520d9e7a5fd6a5301dd7f51f8d0386
SHA512d1ea9368f5d7166180612fd763c87afb647d088498887961f5e7fb0a10f4a808bd5928e8a3666d70ff794093c51ecca8816f75dd47652fd4eb23dce7f9aa1f98
-
memory/1788-0-0x0000000074371000-0x0000000074372000-memory.dmpFilesize
4KB
-
memory/1788-1-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1788-2-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1788-23-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/1788-25-0x0000000074370000-0x000000007491B000-memory.dmpFilesize
5.7MB
-
memory/2404-7-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2404-9-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2404-10-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2404-12-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB