Overview

overview

7

Static

static

3

JaffaCakes...77.exe

windows7-x64

7

JaffaCakes...77.exe

windows10-2004-x64

7

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMPImg/I...er.exe

windows7-x64

7

$TEMPImg/I...er.exe

windows10-2004-x64

7

$PLUGINSDI...os.dll

windows7-x64

3

$PLUGINSDI...os.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$TEMPImg/A....0.exe

windows7-x64

7

$TEMPImg/A....0.exe

windows10-2004-x64

7

$TEMPImg/FVM.exe

windows7-x64

7

$TEMPImg/FVM.exe

windows10-2004-x64

7

$TEMPImg/P...ar.exe

windows7-x64

7

$TEMPImg/P...ar.exe

windows10-2004-x64

7

$PLUGINSDI...up.dll

windows7-x64

3

$PLUGINSDI...up.dll

windows10-2004-x64

3

$PLUGINSDI...ad.dll

windows7-x64

3

$PLUGINSDI...ad.dll

windows10-2004-x64

3

$PLUGINSDI...ns.dll

windows7-x64

3

$PLUGINSDI...ns.dll

windows10-2004-x64

3

$PLUGINSDI...se.dll

windows7-x64

3

$PLUGINSDI...se.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...fo.dll

windows7-x64

3

$PLUGINSDI...fo.dll

windows10-2004-x64

3

Analysis

  • max time kernel
    148s
  • max time network
    148s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    21/01/2025, 16:19

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    $TEMPImg/FVM.exe
  • Size 1.4MB
  • Sample250121-tsrf3asphj
  • SHA256 24f96b0e81b026f81a6d7a3f4c86eb0e4cd86f2e003324c374f69d23445e848e
  • MD5 SHA1 SHA512 SSDEEP
Score
7/10
adwarediscoverystealer

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 25 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Installs/modifies Browser Helper Object 2 TTPs 6 IoCs

    BHOs are DLL modules which act as plugins for Internet Explorer.

    stealeradware
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 12 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 64 IoCs
    adwarespyware
  • Modifies registry class 17 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 13 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$TEMPImg\FVM.exe
    "C:\Users\Admin\AppData\Local\Temp\$TEMPImg\FVM.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Users\Admin\AppData\Local\Temp\GLBE12B.tmp
      C:\Users\Admin\AppData\Local\Temp\GLBE12B.tmp 4736 C:\Users\Admin\AppData\Local\Temp\$TEMPImg\FVM.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Installs/modifies Browser Helper Object
      • Drops file in System32 directory
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2068
      • C:\PROGRA~1\INTERN~1\iexplore.exe
        "C:\PROGRA~1\INTERN~1\iexplore.exe" http://freevideomaster.OurToolbar.com/SetupFinish
        3⤵
        • Modifies Internet Explorer settings
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:2572
        • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2572 CREDAT:275457 /prefetch:2
          4⤵
          • Loads dropped DLL
          • System Location Discovery: System Language Discovery
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          PID:540

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        FREEVI~1.EXE
        • Path C:\PROGRA~2\FREEVI~1\FREEVI~1.EXE
        • Size 37KB
        • SHA256 693bd052006f539de10122c189642d9d2ee959d622f48c583852ce86b689f370
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        UNWISE.EXE
        • Path C:\PROGRA~2\FREEVI~1\UNWISE.EXE
        • Size 149KB
        • SHA256 69b9dd6160524e0eb44905224f5b1747dfce43243c00c11c87f5c2ec55102876
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        toolbar.cfg
        • Path C:\PROGRA~2\FREEVI~1\toolbar.cfg
        • Size 27B
        • SHA256 e7997db5ad40e3f242d1e9a6709aa73442c1ae37e38d9f0ff8bb28610f1be174
        • MD5 SHA1 SHA512
        Submit Download

        3C428B1A3E5F57D887EC4B864FAC5DCC
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\3C428B1A3E5F57D887EC4B864FAC5DCC
        • Size 914B
        • SHA256 cb3ccbb76031e5e0138f8dd39a23f9de47ffc35e43c1144cea27d46a5ab1cb5f
        • MD5 SHA1 SHA512
        Submit Download

        F0ACCF77CDCBFF39F6191887F6D2D357
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357
        • Size 1KB
        • SHA256 df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
        • MD5 SHA1 SHA512
        Submit Download

        3C428B1A3E5F57D887EC4B864FAC5DCC
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\3C428B1A3E5F57D887EC4B864FAC5DCC
        • Size 252B
        • SHA256 b9d88ef708b229c79199348cc80370f29d72d0ab7c77182817fa3b8e33b50a01
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 6381dfd929e25f7fb18fc78648268e6ddd5800eb521c3ac67d0de645a2c60f69
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 eaeff8b9c4e039ef51d28a57ec432ccb189525309629ef6c638bd29c29fe6c42
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 7605fd7f796c9bb009202b8fac3de5f7799486eaca5eb1abb4ac1a20f590e8d0
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 5e2b87283dd504990a195ec8dca9fd369b3a4d1eb50932f5d84ec1c2c29b39af
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 983989194796c8ce6bf7a707df51401ba61710f9760a8b87411b390346c5a8b1
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 2c38bd9e159022070bb35c6bd74693a96fd4e92ba9535d7793464b705e4108a1
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 5d7c644c925467bf9f022de43f576bc2815a2bb5f4c087687b98db78d5eb1149
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 754a925288627bc8a5e9aabbcc09bd4c58bddd2e6d5b581ee2a61ad6392da6d8
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 16451cabe536334202c7f4a7ecd20003273ce685554ced7c3ec4418373e486cc
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 902415adbf58fef0928e3ecefaf73f1ced7bd68707ae9e82ce43d63c04473df5
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 94d7b2d9106fbba360743b6ef7e08e2432025699393339f39a255617711adb7d
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 9e350e7c6ab513e55c8ed21d5478969b0166a49ebd553aa7dad15802033ca71f
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 20b77dd16dcdd2f98f79938896dc75cac2929aee194c6531905bce09d6668d54
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 ef08d15a831cde48709f03b54e9ee479f303612a1b40c8e31493785eac443b54
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 7574dfd8389c47ee2542b211a9f30feceb9138141ea6001a58cd1f7d43d63197
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 ce193401e8ca8038a2b6bcfbc331f679c2b05303469b5616f3fd032caaf2ef04
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 253cf992ff30141582b49e563732df7e8f0cfebd230d8cf3c5850a877b87ecf2
        • MD5 SHA1 SHA512
        Submit Download

        94308059B57B3142E455B38A6EB92015
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
        • Size 342B
        • SHA256 e5dfe2a5fb3fd437b4f1101baa16f7313175670dac7159e38078dfd6ed8d81dc
        • MD5 SHA1 SHA512
        Submit Download

        F0ACCF77CDCBFF39F6191887F6D2D357
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357
        • Size 242B
        • SHA256 e6107acdf8351a469ca120a1c73369d74ea65288eaf8edd72e448974dffc0bf4
        • MD5 SHA1 SHA512
        Submit Download

        Cab257E.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Cab257E.tmp
        • Size 70KB
        • SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Tar257F.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\Tar257F.tmp
        • Size 181KB
        • SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        tbfree.dll
        • Path \PROGRA~2\FREEVI~1\tbfree.dll
        • Size 2.0MB
        • SHA256 c5a1a7cd654ed902e7d98c6a94bf7d55fa6f206c2367a02096016ed051cce307
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        Alert.dll
        • Path \Program Files (x86)\Conduit\Community Alerts\Alert.dll
        • Size 472KB
        • SHA256 aa966e8b93b96dad34ebad419a50d0aa2c69871560b43442a5eba54c1f6d996f
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GLBE12B.tmp
        • Path \Users\Admin\AppData\Local\Temp\GLBE12B.tmp
        • Size 70KB
        • SHA256 bad868f9c97c00136b9013977c591af14f94361113ce11b04e183ec2358e091b
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GLCE15A.tmp
        • Path \Users\Admin\AppData\Local\Temp\GLCE15A.tmp
        • Size 161KB
        • SHA256 a87f19f9fee475d2b2e82acfb4589be6d816b613064cd06826e1d4c147beb50a
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        GLFED21.tmp
        • Path \Users\Admin\AppData\Local\Temp\GLFED21.tmp
        • Size 10KB
        • SHA256 166d7156142f3ee09fa69eb617dd22e4fd248aa80a1ac08767db6ad99a2705c1
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download

        memory/2068-56-0x0000000000AE0000-0x0000000000B5B000-memory.dmp
        Download

        memory/2068-48-0x00000000032F0000-0x00000000034F2000-memory.dmp
        Download

        memory/2572-82-0x0000000002F10000-0x0000000002F20000-memory.dmp
        Download