Overview

overview

7

Static

static

7

JaffaCakes...d5.exe

windows7-x64

7

JaffaCakes...d5.exe

windows10-2004-x64

7

$PLUGINSDI...SC.dll

windows7-x64

3

$PLUGINSDI...SC.dll

windows10-2004-x64

3

$PLUGINSDI...em.dll

windows7-x64

3

$PLUGINSDI...em.dll

windows10-2004-x64

3

$PLUGINSDI...rs.dll

windows7-x64

3

$PLUGINSDI...rs.dll

windows10-2004-x64

3

$PLUGINSDI...ec.dll

windows7-x64

3

$PLUGINSDI...ec.dll

windows10-2004-x64

3

$PLUGINSDI...on.dll

windows7-x64

5

$PLUGINSDI...on.dll

windows10-2004-x64

5

$PROGRAMFI...er.exe

windows7-x64

3

$PROGRAMFI...er.exe

windows10-2004-x64

3

$PROGRAMFI...32.dll

windows7-x64

3

$PROGRAMFI...32.dll

windows10-2004-x64

3

$PROGRAMFI...en.dll

windows7-x64

3

$PROGRAMFI...en.dll

windows10-2004-x64

3

$PROGRAMFI...ce.exe

windows7-x64

1

$PROGRAMFI...ce.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    104s
  • max time network
    143s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30/03/2025, 21:02 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    $PROGRAMFILES/SoftwareUpdater/AppsUpdater.exe

  • Size

    98KB

  • MD5

    feb6acf13060d20705f1c30ba6e35254

  • SHA1

    62d950ddd65fbf0d62dbddd9ad8d520ddb8d85e0

  • SHA256

    c998944a3203bd2f80c8844c56d84abf9af2cb7a624be09eb373691bdeed3981

  • SHA512

    62cb4a96ed197c8bece71b20a3a9fda0692fab3279e943a72bc37b7c1494f145c16353e36e0594799fc613585004ef250fe7450d85e17cbdb96132e9da18d8da

  • SSDEEP

    3072:A4BD4B0wxpH0b9HT6dmRfSp52S/W6W4B1:++T6EIpW0

Score
3/10
discovery

Malware Config

Signatures

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftwareUpdater\AppsUpdater.exe
    "C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\SoftwareUpdater\AppsUpdater.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of SetWindowsHookEx
    PID:3464

Network

  • flag-us
    DNS
    xmlinstcp.portal-factory.com
    AppsUpdater.exe
    Remote address:
    8.8.8.8:53
    Request
    xmlinstcp.portal-factory.com
    IN A
    Response
    xmlinstcp.portal-factory.com
    IN CNAME
    panel-rica-miel.littio.com
    panel-rica-miel.littio.com
    IN CNAME
    panel-rica-miel-master.littio.com
    panel-rica-miel-master.littio.com
    IN A
    37.187.169.167
  • flag-us
    DNS
    www.uplstatsone.com
    AppsUpdater.exe
    Remote address:
    8.8.8.8:53
    Request
    www.uplstatsone.com
    IN A
    Response
    www.uplstatsone.com
    IN CNAME
    panel-rica-miel.littio.com
    panel-rica-miel.littio.com
    IN CNAME
    panel-rica-miel-master.littio.com
    panel-rica-miel-master.littio.com
    IN A
    37.187.169.167
  • flag-us
    DNS
    tse1.mm.bing.net
    Remote address:
    8.8.8.8:53
    Request
    tse1.mm.bing.net
    IN A
    Response
    tse1.mm.bing.net
    IN CNAME
    mm-mm.bing.net.trafficmanager.net
    mm-mm.bing.net.trafficmanager.net
    IN CNAME
    ax-0001.ax-msedge.net
    ax-0001.ax-msedge.net
    IN A
    150.171.28.10
    ax-0001.ax-msedge.net
    IN A
    150.171.27.10
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239353582480_11Y0WDW5HLDOO8GP5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239353582480_11Y0WDW5HLDOO8GP5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 647849
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 0CB516FB4F734BDFA747BDEA859BA9CE Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:15Z
    date: Sun, 30 Mar 2025 21:03:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 585223
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: CFA455E0B7404882BAA401831BEAFEE4 Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:15Z
    date: Sun, 30 Mar 2025 21:03:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388214_1UWGHWC2WCGKUMA6H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239339388214_1UWGHWC2WCGKUMA6H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 679925
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: 7CD1827E0BC34711BD3A208EB42736CA Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:15Z
    date: Sun, 30 Mar 2025 21:03:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 401499
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: C297BA05A94248F9A4D6BE9852BD572D Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:15Z
    date: Sun, 30 Mar 2025 21:03:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239353582481_1UFRZG7HSKJ6VOM8D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239353582481_1UFRZG7HSKJ6VOM8D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 645633
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: A0EB3D1885A643B1ADF8BC39EB57667D Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:15Z
    date: Sun, 30 Mar 2025 21:03:14 GMT
  • flag-us
    GET
    https://tse1.mm.bing.net/th?id=OADD2.10239339388215_16IMSQNWG15X43RXM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    Remote address:
    150.171.28.10:443
    Request
    GET /th?id=OADD2.10239339388215_16IMSQNWG15X43RXM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/2.0
    host: tse1.mm.bing.net
    accept: */*
    accept-encoding: gzip, deflate, br
    user-agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19041
    Response
    HTTP/2.0 200
    cache-control: public, max-age=2592000
    content-length: 495498
    content-type: image/jpeg
    x-cache: TCP_HIT
    access-control-allow-origin: *
    access-control-allow-headers: *
    access-control-allow-methods: GET, POST, OPTIONS
    timing-allow-origin: *
    report-to: {"group":"network-errors","max_age":604800,"endpoints":[{"url":"https://aefd.nelreports.net/api/report?cat=bingth&ndcParam=QUZE"}]}
    nel: {"report_to":"network-errors","max_age":604800,"success_fraction":0.001,"failure_fraction":1.0}
    accept-ch: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Mobile, Sec-CH-UA-Model, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version
    x-msedge-ref: Ref A: B554B9E2544B4501A0B08E7BC60513D1 Ref B: LON04EDGE0807 Ref C: 2025-03-30T21:03:16Z
    date: Sun, 30 Mar 2025 21:03:15 GMT
  • flag-us
    DNS
    c.pki.goog
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    142.250.187.227
  • flag-gb
    GET
    http://c.pki.goog/r/r1.crl
    Remote address:
    142.250.187.227:80
    Request
    GET /r/r1.crl HTTP/1.1
    Cache-Control: max-age = 3000
    Connection: Keep-Alive
    Accept: */*
    If-Modified-Since: Thu, 25 Jul 2024 14:48:00 GMT
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 304 Not Modified
    Date: Sun, 30 Mar 2025 20:51:00 GMT
    Expires: Sun, 30 Mar 2025 21:41:00 GMT
    Age: 788
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Cache-Control: public, max-age=3000
    Vary: Accept-Encoding
  • 37.187.169.167:80
    xmlinstcp.portal-factory.com
    AppsUpdater.exe
    260 B
     5
  • 37.187.169.167:80
    www.uplstatsone.com
    AppsUpdater.exe
    260 B
     5
  • 150.171.28.10:443
    https://tse1.mm.bing.net/th?id=OADD2.10239339388215_16IMSQNWG15X43RXM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90
    tls, http2
    125.4kB
     3.6MB
     2605
    2597

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239353582480_11Y0WDW5HLDOO8GP5&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360264291_1OMXAE3VFGJI9A76K&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388214_1UWGHWC2WCGKUMA6H&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239360264303_1FV8HLP8B8WOIRSCV&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239353582481_1UFRZG7HSKJ6VOM8D&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Response

    200

    HTTP Request

    GET https://tse1.mm.bing.net/th?id=OADD2.10239339388215_16IMSQNWG15X43RXM&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90

    HTTP Response

    200
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    12
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 150.171.28.10:443
    tse1.mm.bing.net
    tls, http2
    1.2kB
     6.9kB
     15
    13
  • 37.187.169.167:80
    www.uplstatsone.com
    AppsUpdater.exe
    260 B
     5
  • 37.187.169.167:80
    www.uplstatsone.com
    AppsUpdater.exe
    260 B
     5
  • 142.250.187.227:80
    http://c.pki.goog/r/r1.crl
    http
    384 B
     354 B
     4
    3

    HTTP Request

    GET http://c.pki.goog/r/r1.crl

    HTTP Response

    304
  • 8.8.8.8:53
    xmlinstcp.portal-factory.com
    dns
    AppsUpdater.exe
    74 B
     164 B
     1
    1

    DNS Request

    xmlinstcp.portal-factory.com

    DNS Response

    37.187.169.167

  • 8.8.8.8:53
    www.uplstatsone.com
    dns
    AppsUpdater.exe
    65 B
     155 B
     1
    1

    DNS Request

    www.uplstatsone.com

    DNS Response

    37.187.169.167

  • 8.8.8.8:53
    tse1.mm.bing.net
    dns
    62 B
     170 B
     1
    1

    DNS Request

    tse1.mm.bing.net

    DNS Response

    150.171.28.10
    150.171.27.10

  • 8.8.8.8:53
    c.pki.goog
    dns
    56 B
     107 B
     1
    1

    DNS Request

    c.pki.goog

    DNS Response

    142.250.187.227

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3464-0-0x0000000074842000-0x0000000074843000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3464-1-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-2-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-3-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-4-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-5-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-6-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-7-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

  • memory/3464-8-0x0000000074842000-0x0000000074843000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3464-9-0x0000000074840000-0x0000000074DF1000-memory.dmp

    Filesize

    5.7MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.