Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240611-en -
resource tags
arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system -
submitted
18-06-2024 11:54
Static task
static1
Behavioral task
behavioral1
Sample
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
-
Size
441KB
-
MD5
bbcb0c05b905a651f576be8bf298ce53
-
SHA1
0e4db794bb8e7f586c6bb86f775dae90704fa5e3
-
SHA256
97fbf9d45d2a295a9bd6a3666311da6c552993addf93c3e87d9e57c84c39a234
-
SHA512
2e830e58d831b55d20ea9961023c66ad8e6873e6352b526960cea0802b5243212098a0b48a648d9a563d4603b85ce4c9e3f98d997ad10c04aa11c83fa4eab3a6
-
SSDEEP
6144:1El2Nt5vw0cmuypyyv0NZ42COv8XmTjkLm8nfsxF7wjimtzZ:1U2pw0eypyq0Qm82vkLnfOOimt
Malware Config
Extracted
formbook
3.8
h321
localchildbirth.info
greatamericanstudentssa.com
eatcoin.net
leikaiclothong.com
lovingmylife.company
akademiatenisaorzel.info
sy-adm.com
cartoons.group
johnandscotto.com
finalize0.com
sxtaibaifen.com
decarttasarim.com
yourboxshipped.net
processandprosper.com
mallorca-nightlive.com
qchj518.com
hc6hlnxeue.biz
lotochain.com
mettlesom.net
labratbrewing.com
examclasses.loan
paulhumber.com
eiwallet.com
15106882267.com
yzyx66.com
xn--e-yi0b98kvq2c.com
estateagentblogs.com
hashrush.info
yinuxw.info
mathehelden.info
buildersxchange.com
paulanavarro.info
bijoux-fantaisie-argent.net
fvaaevc.com
transfermalagamarbella.com
buqianmao.com
donkisotkitapkafe.com
edithelpers.com
warmia-dom.com
actongenetics.com
slim-cup.com
dirndl-princess.net
superori.com
xituanyuanhm.com
n01.tech
945yanshuang.com
jtmnk.com
mebeland.net
multitranslinkcourier.com
brunchforacausegreenville.com
here4you.online
554027.top
realprogressaustralia.com
signsofswfl.com
ourcrazyveterans.com
bosanjadikaryawan.com
9ldhh.info
musicsiren.com
parsaacollection.com
smart-liquids.com
strafbeschikkingverzet.com
katataktiriesnomikis.com
fengxingyizhan.com
15055304405.com
hacdop.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1080-11-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1408-2-0x00000000005A0000-0x00000000005C8000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process target process PID 1408 set thread context of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exepid process 1080 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process target process PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 1408 wrote to memory of 1080 1408 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1080-5-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1080-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1080-7-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1080-11-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/1080-13-0x0000000000860000-0x0000000000B63000-memory.dmpFilesize
3.0MB
-
memory/1408-0-0x00000000741BE000-0x00000000741BF000-memory.dmpFilesize
4KB
-
memory/1408-1-0x0000000000CE0000-0x0000000000D54000-memory.dmpFilesize
464KB
-
memory/1408-2-0x00000000005A0000-0x00000000005C8000-memory.dmpFilesize
160KB
-
memory/1408-3-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/1408-4-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB
-
memory/1408-12-0x00000000741B0000-0x000000007489E000-memory.dmpFilesize
6.9MB