Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2024 11:54
Static task
static1
Behavioral task
behavioral1
Sample
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
Resource
win7-20240611-en
General
-
Target
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
-
Size
441KB
-
MD5
bbcb0c05b905a651f576be8bf298ce53
-
SHA1
0e4db794bb8e7f586c6bb86f775dae90704fa5e3
-
SHA256
97fbf9d45d2a295a9bd6a3666311da6c552993addf93c3e87d9e57c84c39a234
-
SHA512
2e830e58d831b55d20ea9961023c66ad8e6873e6352b526960cea0802b5243212098a0b48a648d9a563d4603b85ce4c9e3f98d997ad10c04aa11c83fa4eab3a6
-
SSDEEP
6144:1El2Nt5vw0cmuypyyv0NZ42COv8XmTjkLm8nfsxF7wjimtzZ:1U2pw0eypyq0Qm82vkLnfOOimt
Malware Config
Extracted
formbook
3.8
h321
localchildbirth.info
greatamericanstudentssa.com
eatcoin.net
leikaiclothong.com
lovingmylife.company
akademiatenisaorzel.info
sy-adm.com
cartoons.group
johnandscotto.com
finalize0.com
sxtaibaifen.com
decarttasarim.com
yourboxshipped.net
processandprosper.com
mallorca-nightlive.com
qchj518.com
hc6hlnxeue.biz
lotochain.com
mettlesom.net
labratbrewing.com
examclasses.loan
paulhumber.com
eiwallet.com
15106882267.com
yzyx66.com
xn--e-yi0b98kvq2c.com
estateagentblogs.com
hashrush.info
yinuxw.info
mathehelden.info
buildersxchange.com
paulanavarro.info
bijoux-fantaisie-argent.net
fvaaevc.com
transfermalagamarbella.com
buqianmao.com
donkisotkitapkafe.com
edithelpers.com
warmia-dom.com
actongenetics.com
slim-cup.com
dirndl-princess.net
superori.com
xituanyuanhm.com
n01.tech
945yanshuang.com
jtmnk.com
mebeland.net
multitranslinkcourier.com
brunchforacausegreenville.com
here4you.online
554027.top
realprogressaustralia.com
signsofswfl.com
ourcrazyveterans.com
bosanjadikaryawan.com
9ldhh.info
musicsiren.com
parsaacollection.com
smart-liquids.com
strafbeschikkingverzet.com
katataktiriesnomikis.com
fengxingyizhan.com
15055304405.com
hacdop.com
Signatures
-
Formbook payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2288-7-0x0000000000400000-0x000000000042A000-memory.dmp formbook -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4112-2-0x00000000010E0000-0x0000000001108000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process target process PID 4112 set thread context of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exepid process 2288 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe 2288 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process Token: SeDebugPrivilege 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exedescription pid process target process PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe PID 4112 wrote to memory of 2288 4112 bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bbcb0c05b905a651f576be8bf298ce53_JaffaCakes118.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2288-7-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/2288-10-0x0000000000EE0000-0x000000000122A000-memory.dmpFilesize
3.3MB
-
memory/4112-0-0x000000007514E000-0x000000007514F000-memory.dmpFilesize
4KB
-
memory/4112-1-0x0000000000650000-0x00000000006C4000-memory.dmpFilesize
464KB
-
memory/4112-2-0x00000000010E0000-0x0000000001108000-memory.dmpFilesize
160KB
-
memory/4112-3-0x00000000056C0000-0x0000000005C64000-memory.dmpFilesize
5.6MB
-
memory/4112-4-0x00000000051B0000-0x0000000005242000-memory.dmpFilesize
584KB
-
memory/4112-5-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB
-
memory/4112-6-0x00000000055F0000-0x000000000568C000-memory.dmpFilesize
624KB
-
memory/4112-9-0x0000000075140000-0x00000000758F0000-memory.dmpFilesize
7.7MB