Overview
overview
10Static
static
1010307f9873...18.exe
windows7-x64
710307f9873...18.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
34dotsLangu...er.exe
windows7-x64
14dotsLangu...er.exe
windows10-2004-x64
1Free MOV T...al.url
windows7-x64
1Free MOV T...al.url
windows10-2004-x64
1FreeMOVToM...er.exe
windows7-x64
1FreeMOVToM...er.exe
windows10-2004-x64
6GlowButton.dll
windows7-x64
1GlowButton.dll
windows10-2004-x64
1MediaSlider.dll
windows7-x64
1MediaSlider.dll
windows10-2004-x64
1Uninstall.exe
windows7-x64
7Uninstall.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3ffmpeg.exe
windows7-x64
10ffmpeg.exe
windows10-2004-x64
10license_agreement.rtf
windows7-x64
4license_agreement.rtf
windows10-2004-x64
1mplayer.exe
windows7-x64
1mplayer.exe
windows10-2004-x64
1Analysis
- max time kernel
149s - max time network
136s - platform
windows10-2004_x64 - resource
win10v2004-20240419-en - resource tags
arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system - submitted
03/05/2024, 09:28
Behavioral task
behavioral1
Sample
10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral2
Sample
10307f9873c21ae7ec3f55b6ddc8e0c3_JaffaCakes118.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
4dotsLanguageDownloader.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral12
Sample
4dotsLanguageDownloader.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
Free MOV To MP3 Converter 4dots - User's Manual.url
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral14
Sample
Free MOV To MP3 Converter 4dots - User's Manual.url
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
FreeMOVToMP3Converter.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral16
Sample
FreeMOVToMP3Converter.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
GlowButton.dll
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral18
Sample
GlowButton.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
MediaSlider.dll
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral20
Sample
MediaSlider.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
Uninstall.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral22
Sample
Uninstall.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240220-en
windows7-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
ffmpeg.exe
Resource
win7-20240419-en
windows7-x64
Behavioral task
behavioral26
Sample
ffmpeg.exe
Resource
win10v2004-20240419-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
license_agreement.rtf
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral28
Sample
license_agreement.rtf
Resource
win10v2004-20240426-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
mplayer.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral30
Sample
mplayer.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
General
- Target FreeMOVToMP3Converter.exe
- Size 552KB
- Sample240503-lfc4xade94
- SHA256 d2deba67d610a2577c1cab394288bf912551236d2b865af9c3118f1994e6664b
- MD5 43aaff879b04b066ba3af58f928fe16a
- SHA1 1184e52fd39d0df097f27086eaca679a9a2fa9da
- SHA512 771e2cb6471358c4ec66aa23c9e48cbc1d9bd0458b733d9d9c76c77c9d864588ad1c45523e7ab6368e0523dec3796958aba15446fc67c2e0c3c80d1f9cecd75b
- SSDEEP 12288:IBewdnVyN+uRQq0TVdWutgnLnbTvpOFFTyKbmbnz:6ewdnYSq0TVdafvpmTyqmbnz
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini FreeMOVToMP3Converter.exe File opened for modification C:\Windows\assembly\Desktop.ini FreeMOVToMP3Converter.exe - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly FreeMOVToMP3Converter.exe File created C:\Windows\assembly\Desktop.ini FreeMOVToMP3Converter.exe File opened for modification C:\Windows\assembly\Desktop.ini FreeMOVToMP3Converter.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FreeMOVToMP3Converter.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz FreeMOVToMP3Converter.exe - Suspicious behavior: EnumeratesProcesses 53 IoCs
pid Process 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe 3084 FreeMOVToMP3Converter.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3084 FreeMOVToMP3Converter.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FreeMOVToMP3Converter.exe"C:\Users\Admin\AppData\Local\Temp\FreeMOVToMP3Converter.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3084
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3212
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:388