Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
-
submitted
18-06-2024 14:25
General
-
Target
bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe
-
Size
348KB
-
MD5
bc699327b7d8fe4f35d0128c292158c4
-
SHA1
bdd93c01e4e08f21997db4d436ba898291c0bf7a
-
SHA256
eced2406f4bcba0e0e017c9215b07ac0e5b1e2a3ba962753c5cc3cca88aee9ca
-
SHA512
c65f68bd98ac6512a57b0552bb450acd14b237bc59ace12fc17bbef7f3a49a4e41aac86ebc5ae3c038ca79095d22282cd0bf43bb7b40d91ab54411d0b9438fc2
-
SSDEEP
6144:xVGzABRwv6pZN9VOHsidU65apfSxYr9Ad:xVGzEiWZN9It55arOd
Malware Config
Extracted
formbook
3.8
hx300
uniquepure.com
xn--mkr60t8otfk4a.com
npulrk.com
xzzjmy.com
3dleatherwallpanel.com
0r1twohot.men
zealtolearn.com
jokes-about.com
lomalan.com
tv17882.info
dajerkstop.com
rwzst.info
krematoriumniederrhein.com
scentprintluxury.com
embeducate.com
barbarawilliford.com
awesoppy.com
taonongwei.com
notasmallworld.net
perthmohssurgery.com
Signatures
-
Formbook
Formbook is a data stealing malware which is capable of stealing data.
-
Formbook payload 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of UnmapMainImage 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe"C:\Users\Admin\AppData\Local\Temp\bc699327b7d8fe4f35d0128c292158c4_JaffaCakes118.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/840-2-0x0000000000400000-0x000000000042A000-memory.dmpFilesize
168KB
-
memory/840-4-0x0000000077670000-0x0000000077746000-memory.dmpFilesize
856KB
-
memory/840-7-0x0000000072940000-0x0000000072A60000-memory.dmpFilesize
1.1MB
-
memory/840-6-0x000000000BEA0000-0x000000000C1A3000-memory.dmpFilesize
3.0MB
-
memory/840-8-0x000000000BEA0000-0x000000000C1A3000-memory.dmpFilesize
3.0MB