Overview

overview

7

Static

static

7

JaffaCakes...27.exe

windows7-x64

7

JaffaCakes...27.exe

windows10-2004-x64

7

$LOCALAPPD...ds.exe

windows7-x64

7

$LOCALAPPD...ds.exe

windows10-2004-x64

7

$PLUGINSDI...Ex.dll

windows7-x64

3

$PLUGINSDI...Ex.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...es.dll

windows7-x64

3

$PLUGINSDI...es.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDIR/Time.dll

windows7-x64

3

$PLUGINSDIR/Time.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

$PLUGINSDI...ef.dll

windows7-x64

3

$PLUGINSDI...ef.dll

windows10-2004-x64

3

$PLUGINSDIR/mt.dll

windows7-x64

3

$PLUGINSDIR/mt.dll

windows10-2004-x64

3

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

FM4ffx.exe

windows7-x64

7

FM4ffx.exe

windows10-2004-x64

7

$PLUGINSDI...dl.dll

windows7-x64

3

$PLUGINSDI...dl.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    121s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    19/01/2025, 09:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    FM4ffx.exe
  • Size 319KB
  • Sample250119-lcq7cssldt
  • SHA256 3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
discoveryspywarestealer

Malware Config

Signatures

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery

Processes

  • C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe
    "C:\Users\Admin\AppData\Local\Temp\FM4ffx.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    PID:1664

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        nso1FD4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\nso1FD4.tmp
        • Size 431B
        • SHA256 f9c098578f89a569e880c67f5350c99606916fffb92b65916976b7f30bbf1360
        • MD5 SHA1 SHA512
        Submit Download

        nso2024.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\nso2024.tmp
        • Size 541B
        • SHA256 52d714cbd2b10102fbc7baa52b88995002479ab76e6124a3bf675aecf058e1d2
        • MD5 SHA1 SHA512
        Submit Download

        nst1FF4.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\nst1FF4.tmp
        • Size 486B
        • SHA256 587de7d0e29f8c2a1cd6d73e591182f1c8ee185d9074f59541b142247041edcc
        • MD5 SHA1 SHA512
        Submit Download

        nst20E5.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\nst20E5.tmp
        • Size 877B
        • SHA256 20ff30d2b8acdd71ac080fe275f7818a4b5f3416c18f0b3a7be0def958cfaf40
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.Admin\user.js
        • Size 718B
        • SHA256 7f449d5c81e4711359878d4445fcb8ec0ee83a4898c6c36b97850fd1974709a5
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.Admin\user.js
        • Size 824B
        • SHA256 1d7bf94f6e7644aa28fbfca52d49fdd41796aec23fd407c55a77acbd0a3e80b2
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.Admin\user.js
        • Size 979B
        • SHA256 576a89aad1a8d91503054eaa1374ef147930491b39e4accc17f44e806b0e1d9b
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\user.js
        • Size 830B
        • SHA256 5abe4061c3edbfdeecfaf10f165721d9bee51aa2ed2837a781101210bb42f0e4
        • MD5 SHA1 SHA512
        Submit Download

        user.js
        • Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhzluvd5.default-release\user.js
        • Size 236B
        • SHA256 8942df0a9380a316916fc472c4218bfb372dbde0dd0fa577c78b5db245998070
        • MD5 SHA1 SHA512
        Submit Download

        System.dll
        • Path \Users\Admin\AppData\Local\Temp\nst1EB8.tmp\System.dll
        • Size 11KB
        • SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Time.dll
        • Path \Users\Admin\AppData\Local\Temp\nst1EB8.tmp\Time.dll
        • Size 10KB
        • SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        mt.dll
        • Path \Users\Admin\AppData\Local\Temp\nst1EB8.tmp\mt.dll
        • Size 5KB
        • SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        nsisos.dll
        • Path \Users\Admin\AppData\Local\Temp\nst1EB8.tmp\nsisos.dll
        • Size 5KB
        • SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download