Overview
overview
7Static
static
7JaffaCakes...3b.exe
windows7-x64
7JaffaCakes...3b.exe
windows10-2004-x64
7$LOCALAPPD...ds.exe
windows7-x64
7$LOCALAPPD...ds.exe
windows10-2004-x64
7$PLUGINSDI...Ex.dll
windows7-x64
3$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ad.dll
windows7-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows7-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/Time.dll
windows7-x64
3$PLUGINSDIR/Time.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows7-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...ef.dll
windows7-x64
3$PLUGINSDI...ef.dll
windows10-2004-x64
3$PLUGINSDIR/mt.dll
windows7-x64
3$PLUGINSDIR/mt.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows7-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3FM4ffx.exe
windows7-x64
7FM4ffx.exe
windows10-2004-x64
7$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/01/2025, 18:43
Behavioral task
behavioral1
Sample
JaffaCakes118_cfe4e2914eeb43cf09a993c82311273b.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
JaffaCakes118_cfe4e2914eeb43cf09a993c82311273b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/funmoods.exe
Resource
win7-20240903-en
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/funmoods.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win7-20240903-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win7-20241023-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win7-20241010-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Processes.dll
Resource
win7-20241023-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Time.dll
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Time.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win7-20240903-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win7-20240903-en
Behavioral task
behavioral22
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/mt.dll
Resource
win7-20240903-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/mt.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisos.dll
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisos.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
FM4ffx.exe
Resource
win7-20241023-en
Behavioral task
behavioral28
Sample
FM4ffx.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win7-20241010-en
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20241007-en
General
-
Target
$LOCALAPPDATA/funmoods.exe
-
Size
1.6MB
-
MD5
badf0b8e9bc8d7352fb084951255ee4f
-
SHA1
e584634b5565fd81d7258fca86c632c9d3e1cd14
-
SHA256
73db5f6b89963d6692e3c43c8f3e5265ec4512ce87fe652e9ec3a4a0bb036db8
-
SHA512
3b704e3b0d440f1e580cc277c3c68223139f35156b00250ebf9a231f03d5f74bd19bbf948061e7b8be13b9c08aca9f30a0929cfce5a9d5cc3558cd187a05d53e
-
SSDEEP
24576:VtxBMupYpmZICsiWuu0uFYBimEuDYYmTj67rRXFO6BbwZTdNFtr6Ps7QOWxQ6NVN:p6HmZICsfujIvGmTW7rRQakZpt+xQON
Malware Config
Signatures
-
Executes dropped EXE 3 IoCs
pid Process 1804 FM4ie.exe 2056 FM4ffx.exe 3012 funmoodssrv.exe -
Loads dropped DLL 64 IoCs
pid Process 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 1804 FM4ie.exe 1804 FM4ie.exe 1804 FM4ie.exe 1804 FM4ie.exe 1804 FM4ie.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 1804 FM4ie.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 3012 funmoodssrv.exe 1804 FM4ie.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe 2056 FM4ffx.exe -
Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7} FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\ = "Funmoods Helper Object" FM4ie.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\NoExplorer = "1" FM4ie.exe -
Drops file in Program Files directory 7 IoCs
description ioc Process File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsApp.dll FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsEng.dll FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsTlbr.dll FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodsOEM.crx FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\uninstall.exe FM4ie.exe File created C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\bh\funmoods.dll FM4ie.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FM4ffx.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language funmoodssrv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language funmoods.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FM4ie.exe -
NSIS installer 6 IoCs
resource yara_rule behavioral3/files/0x000500000001953a-138.dat nsis_installer_1 behavioral3/files/0x000500000001953a-138.dat nsis_installer_2 behavioral3/files/0x0005000000019515-142.dat nsis_installer_1 behavioral3/files/0x0005000000019515-142.dat nsis_installer_2 behavioral3/files/0x000500000001c758-674.dat nsis_installer_1 behavioral3/files/0x000500000001c758-674.dat nsis_installer_2 -
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Internet Explorer\Toolbar\ FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3} = "Funmoods Toolbar" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A} FM4ie.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\Policy = "3" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppName = "funmoodssrv.exe" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C87FC351-A80D-43E9-9A86-CF1E29DC443A}\AppPath = "C:\\Program Files (x86)\\Funmoods\\funmoods\\1.5.11.16" FM4ie.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\ProgID\ = "esrv.funmoodsESrvc.1" funmoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\InprocServer32 FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\TypeLib\ = "{B12E99ED-69BD-437C-86BE-C862B9E5444D}" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\0 FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ = "IEHostWnd" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\ = "IXmlCnfg" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F03FD9D0-4F2B-497C-8A71-DD41D70B07D9}\ = "escrtAx Object" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\ProgID\ = "funmoods.dskBnd.1" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\HELPDIR funmoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\escort.DLL FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib\Version = "1.0" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32 FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\ = "IesrvXtrnl" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\InprocServer32\ThreadingModel = "apartment" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9DB719C-7156-415E-B49D-BAD039DE4F13}\ = "appCore Object" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{59C63F11-D4E5-46E7-9B8A-EE158DCA83A8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib\Version = "1.0" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\FLAGS\ = "0" funmoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr.1\ = "CescrtHlpr Object" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}\1.0\FLAGS FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\ProxyStubClsid32 FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data\vrsni = "1.5.11.16" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4C272EC-ED9E-4ACE-A6F2-9558C7F29EF3}\Programmable FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\TypeLib FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoods.funmoodsHlpr.1 FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762} FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\TypeLib\Version = "1.0" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\FLAGS funmoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{965B9DBE-B104-44AC-950A-8A5F97AFF439}\ProgID FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75EBB0AA-4214-4CB4-90EC-E3E07ECD04F7}\InprocServer32\ThreadingModel = "apartment" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\funmoodsApp.appCore.1\CLSID FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{2CE5C4B9-6DBE-4528-96FA-C9FF38EF1762}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9} FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8242E89-2F81-484A-AE5B-BA8CAD5B7347}\TypeLib FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\TypeLib FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\esrv.funmoodsESrvc.1 funmoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\AppID = "{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}" funmoodssrv.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{23C70BCA-6E23-4A65-AD2E-1389062074F1}\ = "IxpEmphszr" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{75A4D144-506D-4BE5-81DB-EC7DA1E7F840}\LocalServer32\ThreadingModel = "apartment" funmoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{EA28B360-05E0-4F93-8150-02891F1D8D3C}\Instl\Data FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5DA22CBD-0029-4A09-B757-CF0FAFC488ED}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\TypeLib\ = "{1D085C0A-E4F4-4F66-BDBF-4BE51015BFC3}" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\ = "IEHostWnd" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{34C1FDF7-02C1-4F23-B393-F48B16E071D1}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{295CACB4-51F5-46FD-914E-C72BAAE1B672}\ = "IescrtSrvc" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{960DF771-CFCB-4E53-A5B5-6EF2BBE6E706}\1.0\0 funmoodssrv.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947} FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54291324-7A3D-4F11-B707-3FB6A2C97BD9}\ = "IXtrnlBsc" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\f\CurVer FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C0585B2F-74D7-4734-88DE-6C150C5D4036}\TypeLib\Version = "1.0" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EF0588D6-1621-4A75-B8BE-F4BC34794136}\TypeLib FM4ie.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0D80F1C5-D17B-4177-AC68-955F3EF9F191}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" FM4ie.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{77A6E7D4-4A83-4A9B-A2A0-EF3B125DC29D}\ProxyStubClsid32 FM4ie.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe 2036 funmoods.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1804 2036 funmoods.exe 30 PID 2036 wrote to memory of 1804 2036 funmoods.exe 30 PID 2036 wrote to memory of 1804 2036 funmoods.exe 30 PID 2036 wrote to memory of 1804 2036 funmoods.exe 30 PID 2036 wrote to memory of 2056 2036 funmoods.exe 31 PID 2036 wrote to memory of 2056 2036 funmoods.exe 31 PID 2036 wrote to memory of 2056 2036 funmoods.exe 31 PID 2036 wrote to memory of 2056 2036 funmoods.exe 31 PID 1804 wrote to memory of 3012 1804 FM4ie.exe 32 PID 1804 wrote to memory of 3012 1804 FM4ie.exe 32 PID 1804 wrote to memory of 3012 1804 FM4ie.exe 32 PID 1804 wrote to memory of 3012 1804 FM4ie.exe 32
Processes
-
C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"C:\Users\Admin\AppData\Local\Temp\$LOCALAPPDATA\funmoods.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe"C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ie.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe"C:\Program Files (x86)\Funmoods\funmoods\1.5.11.16\funmoodssrv.exe" /RegServer3⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Modifies registry class
PID:3012
-
-
-
C:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exeC:\Users\Admin\AppData\Local\Temp\FNMD\FM\1.5.11.16\FM4ffx.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2056
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
130KB
MD5673e6109fbc2405238429562ae058f37
SHA1293a96724fc0e772706f108895db321b58051524
SHA2564dae85611b9fd18f44c36f330762ca7dae3842604999d6a5edd3d416b4ab0841
SHA5120d1db02c84d2a7502af966886889a63467fdc310c25076cd1629064f9dc5bda63248ea2cb34757f9e93e341cd89833979c8bdfffab2d09c722c3a20cd244f4c0
-
Filesize
981B
MD53e185672f6b9553f32628f2edc60a416
SHA1268bfaaaa64df5a4991d424aad24a18e69a15bf0
SHA256ff121deda875a14d5aa4d64ae5a94ba8b5b1d6ee3e4535c2dfd7d86fb0db9e98
SHA51248507679cd0c9bd47ac48573ec683e4e648bc32d685ae0dbeb51e4ba53ead5d2d9ba53711cbf4d1b1aeae647335bd0c9d0ff01e0155cc6be8295618a588e565d
-
Filesize
731B
MD5b2ef823200e219430f675f8111d60e33
SHA1a18fc58e0c79bafcb73d82dee9f68700f6d286c4
SHA2563e18a760339181ba0a4d3fd964f1accf4425b1fef0cbe2eda599e93ae43754d2
SHA512e29b7a8e3d20328925761fab00609e06eb97d8d33564f3d5ec3d69a4100581369083c80f07da481082ebe40000ce50921c521f9e5b4f7e660b5d5ef5693e2a44
-
Filesize
781B
MD55234123026f317b431f0dfca9730fa87
SHA13b18a2cd5dc32e373d6e4671afa6257e403463e8
SHA256b8c6700324a62dcd3a102762c859b2f33234d93462ad947bf107f4e99976bc46
SHA51232541dedd4eb1ea4d841fe86fddb5c3dfd62f17cd44e926ba026f93f441303a085fe06fd08277773965cba44ae9dbe84aa6ab22e820b89f5c394336e82a3c65c
-
Filesize
1KB
MD5ddea18dcee5916785f819539a0450bf2
SHA1f047fd1692d084348d8a464e15e28c08bc434d60
SHA2567cc722b22d7b562b4b589bac3c7edb2a77f5a9d144e128cc7d52ddc2a732e082
SHA512737919a160f752335f297263487903421c39cd635fe31de67a335e192e930d838483841cfadc600ad9d454b709a97985a9624f846263abaf15f4740f25e015ed
-
Filesize
342B
MD59e38ebc47fc7a6fc538f320cc86db677
SHA16f987af3fcf33993cfb78ff69a274f4dd8b6777e
SHA256519befa8e828ded7828c125fcc87b0b2043bce12ba8c9fc53524c453c672b6de
SHA512abc7a759434f9f5ad7d2d3e5d2a917cd55c84532a3d31d0c0089584bf7f30eade27f5becb977cb5b0725028a40313722dec660e7529ca5551cbefc7f67fcb1c3
-
Filesize
398B
MD57a27f62f6bbacf599738f532ba00edbc
SHA1a2c64964fdc0c36586f9f30bd0eb443e7d9d13fa
SHA256c357c19e9bfcc893cedccc212e3ee57a6208142eb32c24e228bab2b1e6a92645
SHA51264e1f99234537aa4c89617adc41365c840154232ca52dc789657bd79f60a0c0bc28679b2c92fca537690bbd564aa189ee4e6d19dbf5b1429dc3f5e64bc80d6bb
-
Filesize
463B
MD5f6f3b314a81fe9ccc8d5a79f717b420b
SHA1f49b986a521febe430cb451c8e0c828f15c13c9d
SHA2565b75ea01b411651a11b39272cbad7f727f7a842313357b7a98937ab5b9d0ce91
SHA512eba533ca4685733bdaa74a22614444a683f2e9658aed7428758de8512610dd95bf2a9e63b3b7f349b070c5ec9c306cc025881085da38b8b882494809ffe29be8
-
Filesize
626B
MD5a4355b5c95ad83beb493c39a2a10db76
SHA1e3b2e6ba59a0be7eea516fb81fe136e2179e4224
SHA25676eda8cd6387a9be0933002736368ed0af0e1cb9a8410314121e69f39003f596
SHA512142f973ab35789a954976c025c5807cd0ee3e346bf7aab1ed5e85fb9f5f9496e4e6cd175a484a1f10a56f1b263068659bb7c44d551fc6c70463335ae89fad6b0
-
Filesize
679B
MD502ef1d6825d5cf1c657b2983f375d36f
SHA153969cb23e950d1dbaec5d82145a4b3ce5988c46
SHA256d1c8ec183baffd8dc80e0f1392698bdd91e6bb079be48fa2ca7ece90e0290626
SHA512fd8361b46876200ef0fbcb306b0001a606cfd1c454809c8c8d380773aad071fb1b6ded78e14de5ef61ea4c35b06d20e0de77dadc07ad7b3a22795b3d29b9d54c
-
Filesize
1KB
MD5fc694f25081998be0c61dbd0a006760e
SHA137438c13fc6977785d478729dc854ab5941dccc0
SHA256a8eb2397e4cff7497bc4b530a56ae6738edd4964ae4267c48bd1c74850bd1ce3
SHA512c988560e19f617d1d56017f161a0969ce85b6e33f9fe57f2c8d9645b5ec9c49492b60fa0479b0e5382dc3db07ef86ca7be12f76f885455768df4e34eb6b6ad25
-
Filesize
156B
MD5c357f207642f912eb2137382f6a5c4d9
SHA1d9e690088578041107d1c945639d1d907085c1f6
SHA25670a1f136522b2aa72ba60732e51c4211a5eacc626e0d8bfe4052559d4e79431c
SHA5129720b28f09fef6b0b4c3d9061889c3c1721bd51d3216c3ae05198ee69b8e40a67205474532fa53af457e4da75dc45d7089b3ff5f1ffc99fa13affb9cc24dc81c
-
Filesize
232B
MD5056233599aff6b62930f4a8ef642ed4c
SHA1e0ba83036f599b989043324a669b17bf67500488
SHA256d991cfa854723a3d35554624df103fd690ab345973a927519ef8b2619654a246
SHA512a5a2ac2bf5982a22f75c6b3399cce6535bf77439eb4b467de166c96ecdd1654c366e90b69294e7113d19cdf9c35d64c653528ba0f1270502172d908a97e3d09d
-
Filesize
287B
MD597b6abf77d2f1ecb81d8a76db8e6fa9d
SHA1ea800669d2b65dc79cecc45cc033a8416d4afa4b
SHA256187b4bfbbff4e2e6c074549679426fc498ae733905ace0c4ae94fc51eeed25b8
SHA51280882a08d41bb7a0143f494bb9e562f47935744ef2637577240e2e57fdd2ac9d82aa1dcd24306b2a43ffa2c76d461e6c1a6d01a70a9574207ee83f6977d1a14b
-
Filesize
520B
MD5ce20d062b1e0e25730bc2edd421fcb6b
SHA18cf0ecff7857297ed5546cefdd1215a83dee7b52
SHA2567a5598d1a8a7bfe47225cfb4f89190f8763cdd6d8fd8b0ec39ea05fcee9d2334
SHA512e0c0481e63e1fee938ef6b66b08ade51befdd46b17d2a4f41101c0833c7d177af77af474c2929810c8af49d56db2c12990e81c3e7d571a0b551c91fd054df1af
-
Filesize
575B
MD54f0075bf40dd1d6fcb9d22634b7f6ac1
SHA1ddf7389365de108e55f3a711e123d218cfb60ec9
SHA256832dba55d5b5afa934b677a8b998c2e385267253d5cec643487986866567f370
SHA5127a46a9763ba4c2df4716418a59a67defcc052be3f7007407e671b75048425cb41166517edc7098dc2741144708135c9cff8b57b8c07fb140f01f01fc91ea8668
-
Filesize
14KB
MD5a5f8399a743ab7f9c88c645c35b1ebb5
SHA1168f3c158913b0367bf79fa413357fbe97018191
SHA256dacc88a12d3ba438fdae3535dc7a5a1d389bce13adc993706424874a782e51c9
SHA512824e567f5211bf09c7912537c7836d761b0934207612808e9a191f980375c6a97383dbc6b4a7121c6b5f508cbfd7542a781d6b6b196ca24841f73892eec5e977
-
Filesize
482B
MD50bca66f2603c680153724cdd0dc6a258
SHA1ca29fe07ef83a0bc02a02d5837c5518e161b4f3d
SHA256fd64a0a2b9cd05cbae9df7742027664f94707f9257952b3b912d3c36b8c290aa
SHA5123499f94bb0628cda3288f6ec83f246814c41a8f50ef67a6fa35fe794eddf13ddfa93fb00358df0ee6ead0d1cbd4b6ad5e00c380ef818160dd01dfbb6bb186de0
-
Filesize
825B
MD5877eff4bab965c393f68e4de0573c20f
SHA19d5e1ffae96b999fd528a12e92ec8f71950636c2
SHA2569e8c1b914d96c2acc41844ff944bb86790e176f3f9124d07c4ddfdb71ecc2630
SHA5129487774e0921c87cdc4470a5c6fd0e9c672d6ebad248224db300851873c46eab48a46ed26e7cd125032754aea786f91e569f4c7ac4c927d55d098d1aae9d6061
-
Filesize
876B
MD51dfac73b8db244e3d1bca1905b075ddb
SHA118b3ae1d33827909e75d78bf774b9863e9dc3bf9
SHA25685dc5cdca06c1ca8fc9731b431d0b9c92f39d7e8b9b2916f9defc6889148c078
SHA512f0cb9a6a7a246387928c773296a0632c142c27536b9e39e9d77418c24d65dc6a84d67e98a4a6a70388fbe13bb348d9355b8805ccc3d9e908217ced09d46db5ab
-
Filesize
929B
MD59f1f140967562984c8218b56733e6826
SHA155c298138889dece1d5231d61438aafab17c5752
SHA256bd637c2cbb6fb5221a446cee65053a9723dd2e3481c8c2af3119be14f3dca5ed
SHA5123861e7621a5f301d6fa8cd3238af937282d1d6d763be5d469727812a68c57f39cc22b4c28f2482347db2140e3873bff20fe000e8ddcff604fbdea2f77871083e
-
Filesize
236KB
MD5d5a9ec59fbf50e576b1d3b60ccfb7117
SHA1cc22b0aa6f4b5367865b75f3c0afa788c7f97d8e
SHA256ba6870cd06e5700f918c30ee92391d8a77c99b3fda06372c42b35983ee88253c
SHA51260b4965d7f4ff6df4aedda7ec87a074e1d2c13860a3dea325eb551191e643ea9cbed4efe13c3ea2358a3b896c010b773c1c76ac52be81c0a171796fe988be086
-
Filesize
245KB
MD57f8be790b6614f46adeafd59761abbeb
SHA1a1be7d513d40b1a0af1aa1fd73c2c2b6173ac700
SHA256b1fa4dacf9656e31588eebeca1f831c72a33d9affca07ede0d5f5d113ec14aaf
SHA5124d17c74368543092a8e7604208689bc6a5fc5bcc46c60cfb9255622d031a4265adaa13d7c0b5f410ababed802f29cb89c2dd7d7b1adc1af33fbb5f55e4a8a5ca
-
Filesize
398KB
MD5ffba0384096f7a6c2189009b3c54c8db
SHA1e1e883b9345bd74b0c7e158751c60b0ee2139677
SHA25693587b81f4e717b25a6e5fd2fb7158d7fb825f79af1c02ed0a61d5de15b6327b
SHA5127ea59cd57a0b6ecb1258af1d271dcb68236d0b95fca0d5905d177dd8df980771b0a182a459a6a6f01cb4789433d193306324fa178b88b6ec3677aa5c589571dc
-
Filesize
319KB
MD5fe768a6b82ed2a59c58254eae67b8cf9
SHA13dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
SHA2563ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
SHA5123d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b
-
Filesize
1.1MB
MD5ddcada8c66d56df6e4ef2bbedf2bb865
SHA1059a7f8bb8ed2e99d5153d26ecf986e91c24df19
SHA256abcde03656f4c6f51d4d4c788ece555581b8c7b52bfe1c18ef70678cb3a2e872
SHA51263a3ca5d733cef71cc4ff61d6b5b3dd74613d57bac2b5d41efffbbf64ab6031bde66c0cd7058bf50c047e64e4ee0ef87dff3c7864a18c118521f5711ab69cc91
-
Filesize
7KB
MD5ba4063f437abb349aa9120e9c320c467
SHA1b045d785f6041e25d6be031ae2af4d4504e87b12
SHA25673acba7dd477dfd6cf4249911f4e3c781196c7cf6b28425761dcb2d4f90c36c5
SHA51248a813f55834069f8c6b90740de3df01564a136b0fe637f9f85cc1a19d7f32b1f70205ff2462526508fe3c1962d7c1e8e384c40463e328538aeba28e8d0fb92a
-
Filesize
18KB
MD5994669c5737b25c26642c94180e92fa2
SHA1d8a1836914a446b0e06881ce1be8631554adafde
SHA256bf01a1f272e0daf82df3407690b646e0ff6b2c562e36e47cf177eda71ccb6f6c
SHA512d0ab7ca7f890ef9e59015c33e6b400a0a4d1ce0d24599537e09e845f4b953e3ecd44bf3e3cbe584f57c2948743e689ed67d2d40e6caf923bd630886e89c38563
-
Filesize
56KB
MD5cc0bd4f5a79107633084471dbd4af796
SHA109dfcf182b1493161dec8044a5234c35ee24c43a
SHA2563b5388e13dab53d53e08791f492ed7d3094a0cee51e9841af83ce02534e0621c
SHA51267ba90ec04366e07d0922ffb4dbbb4f12f90b6785b87700adaae29327db9ec2a03d750b229f858db0594f439499d6346fbf1ebc17c77162bf8da027515219ee3
-
Filesize
11KB
MD5c17103ae9072a06da581dec998343fc1
SHA1b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA256dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
SHA512d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
-
Filesize
10KB
MD538977533750fe69979b2c2ac801f96e6
SHA174643c30cda909e649722ed0c7f267903558e92a
SHA256b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
SHA512e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
-
Filesize
4KB
MD57579ade7ae1747a31960a228ce02e666
SHA18ec8571a296737e819dcf86353a43fcf8ec63351
SHA256564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
-
Filesize
194KB
MD56845d147b88de1f005d9c6ebb6596574
SHA164523302e2b1e2ee7a31580d2acac852db3c7e45
SHA256c9ccc486c3353bad0d2819a42203c0db7ba98b4826b6a2b8d4deee832e4d3d8e
SHA512cd4caa6669b5f90ead60579a2e5b01a9cd2d17fd2919651cecda6327acb32e2eb3b9953412c085d50dee89779d2f60df658236fb4c3cc54bed4ae66929590606
-
Filesize
5KB
MD5aac69f856c4540edd4ef7ce6c8571639
SHA12860f55ea9774d631219e66604051e90a43258b7
SHA2566dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
SHA512ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd
-
Filesize
5KB
MD569806691d649ef1c8703fd9e29231d44
SHA1e2193fcf5b4863605eec2a5eb17bf84c7ac00166
SHA256ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
SHA5125e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb