Overview
overview
7Static
static
7jaffacakes...en.exe
windows10-2004-x64
7jaffacakes...en.exe
windows11-ltsc_2024-x64
7$LOCALAPPD...ds.exe
windows10-2004-x64
7$LOCALAPPD...ds.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...Ex.dll
windows10-2004-x64
3$PLUGINSDI...Ex.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ad.dll
windows10-2004-x64
3$PLUGINSDI...ad.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...es.dll
windows10-2004-x64
3$PLUGINSDI...es.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/Time.dll
windows10-2004-x64
3$PLUGINSDIR/Time.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...fo.dll
windows10-2004-x64
3$PLUGINSDI...fo.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ef.dll
windows10-2004-x64
3$PLUGINSDI...ef.dll
windows11-ltsc_2024-x64
3$PLUGINSDIR/mt.dll
windows10-2004-x64
3$PLUGINSDIR/mt.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...os.dll
windows10-2004-x64
3$PLUGINSDI...os.dll
windows11-ltsc_2024-x64
3FM4ffx.exe
windows10-2004-x64
7FM4ffx.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3Analysis
- max time kernel
149s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
14/10/2026, 03:59
Behavioral task
behavioral1
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
jaffacakes118_not-a-virus.HEUR.AdWare.NSIS.DealPly.gen.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$LOCALAPPDATA/funmoods.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$LOCALAPPDATA/funmoods.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/ExtractDLLEx.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/IEFunctions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/InetLoad.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
$PLUGINSDIR/Processes.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
$PLUGINSDIR/Processes.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
$PLUGINSDIR/Time.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
$PLUGINSDIR/Time.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/UserInfo.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/chrmPref.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/mt.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/mt.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsisos.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsisos.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
FM4ffx.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
FM4ffx.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target FM4ffx.exe
- Size 319KB
- Sample261014-eka2savy3r
- SHA256 3ac3c700060a0487060724f3fd22faf70d5f633e69401641964d7ba4d6e6e570
- MD5 fe768a6b82ed2a59c58254eae67b8cf9
- SHA1 3dad9bf5011fb73b9be2fe6c601bb6281a3ceaf6
- SHA512 3d8caadc61ea127bd0e3d01f35274a2ebfa34a0ac12b0932988300d011347f74a09c2bf3c85e58bfbe5200288c6e6f100b4f08916d23e56d7b52a70130aad14b
- SSDEEP 6144:Ve34G2ct7JdUwA2UL4iCPfAHfWpR+0BmiBEaiXLoyX:Et9BHjAupYMmyk7R
- TLSH T13264E0C792B281A3D7D1C7B008BA822F9F35DD4911A14DD34ADDBD7A2D72A42DB31836
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 64 IoCs
pid Process 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe 4720 FM4ffx.exe - Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FM4ffx.exe
Processes
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsnCB22.tmp
- Size 597B
- SHA256 fbab85b197cfeb3470d61775e1f1c4d552367b0c82f1d415ae9bdb790636f7de
- MD5 bc635769ac07010a9f56b09066c625b4
- SHA1 4f729e854034a974173393d7971eaaa69d9ee81b
- SHA512 a48dc1524850177eb77f5000f281ecdfa89bbfd925f5ea9f3a355e7de2cdabe17058ded80478404df5740bad9fff9ae386f8e956ca928241ad997cee57229ac9
- TLSH T1ECF04464975C8F1FDEB4B1E48C546325A5E1207A3AEF799202B05162901CBBC11DB9BF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nssCA51.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nssCA51.tmp\Time.dll
- Size 10KB
- SHA256 b4a95a455e53372c59f91bc1b5fb9e5c8e4a10a506fa04aaf7be27048b30ae35
- MD5 38977533750fe69979b2c2ac801f96e6
- SHA1 74643c30cda909e649722ed0c7f267903558e92a
- SHA512 e17069395ad4a17e24f7cd3c532670d40244bd5ae3887c82e3b2e4a68c250cd55e2d8b329d6ff0e2d758955ab7470534e6307779e49fe331c1fd2242ea73fd53
- SSDEEP 192:oNcwTweFbs9t2n2Sgiga65/aHdaGZavaJIYX4Hw2:oNcwBFg22SEw47CPU
- TLSH T129225C72D3C5C5FBC8A442B0180F761A411157ABC4748F4BE7F3508AAB60A5DAEBDB23
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nssCA51.tmp\mt.dll
- Size 5KB
- SHA256 6dc2644a389feeef9e0ac65e2c8b01fc18ca6e53b253f10efffcb117e0a852dd
- MD5 aac69f856c4540edd4ef7ce6c8571639
- SHA1 2860f55ea9774d631219e66604051e90a43258b7
- SHA512 ebacc8117c44d298ae519705510285c576932761b3c7b697eeb91cb7620150ebe551102d1ab83d68f4c78e1496b191a55ad8f78c491f5b4af456c4de6ad72dcd
- SSDEEP 48:am+jZiVMdzNNqdugTvfbAMHpyncQk7IZigYyPSx1A8v1XlWzNKjW1Qg/BTv:zKiVMdhwr7k0pycQBZtJuA8vUQi1QkN
- TLSH T1E4B188B25AF99CB1C01A87BAD0DB6947189D5F0403D402AB9F531D1779156EBB522283
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nssCA51.tmp\nsisos.dll
- Size 5KB
- SHA256 ba79ab7f63f02ed5d5d46b82b11d97dac5b7ef7e9b9a4df926b43ceac18483b6
- MD5 69806691d649ef1c8703fd9e29231d44
- SHA1 e2193fcf5b4863605eec2a5eb17bf84c7ac00166
- SHA512 5e5e0319e701d15134a01cb6472c624e271e99891058aef4dfe779c29c73899771a5b6f8b1cd61b543a3b3defeaecaa080c9cc4e76e84038ca08e12084f128eb
- SSDEEP 48:6EyuygeHCfxwU5x+6kx/k1gONv27oBc2OkIrHHl:VeHCf2762kKsu7oGjkIrn
- TLSH T147C17513BB1455F1C0AC09B1617E5622D3FAA11C14D8620DAFC05D3B6DEC9A57E6D70B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\extensions\[email protected]\content\imgs\flgs\cn.png
- Size 472B
- SHA256 7058233b5bdfdd4279e92e9dfe64bd4a61afd7e76d97dba498ce1d5777b92185
- MD5 a82ff00f39eff54062328b4474c33dbc
- SHA1 9c7185e038ea1000382fb1b14b88f3e9f2d99c14
- SHA512 be801e5bbd51f6edb324dcd5b19239c64e011bb559e976875b2bcfe71b6a6eb1fd210454cc60402e7aeb6560e3ea6f277b1ca1eb4ff81bbb3dd99c3175a625f7
- TLSH T1F2F054C863BD3CB1C1CA41A218036A98D2334D2505EB83F01D038C808572FC395FD313
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\extensions\[email protected]\content\imgs\flgs\il.png
- Size 431B
- SHA256 5432e244f03e3973153451b1ec88d649459580eab66e2df936fe2f70f2fed823
- MD5 a135fcdefe8a391b416bdb102476e12b
- SHA1 69193e287d1aff860283b7bfec58268cc1a22cce
- SHA512 7aa881a7bf15107198f9ac1ff5b7583b7c0f501bfc6ca88c938501881d67972ce826c757a5c3ac7e3bbacab76abe2438b217bfccb1dd04c4beaacc5608c619e9
- TLSH T143E02384314082BD8C3A37F314220220AE330E0A10A383679603F97910F2214D4C1683
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\extensions\[email protected]\content\imgs\flgs\jp.png
- Size 420B
- SHA256 5efce88ac7228ea159bcf7fd1cc56d73c19428394218706524bac0e9151d4c61
- MD5 10958397bc7c25c746e6e122365c003c
- SHA1 3c5b175471d77c6e813a140c6859bca53952d9d3
- SHA512 de6380d995a3f7ba70e05112332a4ba72f88ac2aa2f502a308d3f979197dc0a75c9822012b491c7f2f95519571ad6ca15b757b10a05cb95dc7006b0bde650ea3
- TLSH T138E0F1A2AA503D76C95C4FE1B98649A0E0728CA408358BCACB099E240E76B5DD5E09D7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\extensions\[email protected]\content\imgs\flgs\us.png
- Size 609B
- SHA256 36cce5cae3d2e0045b2b2b6cbffdad7a0aba3e99919cc219bbf0578efdc45585
- MD5 968591e0050981be9fa94bd2597afb48
- SHA1 dd9e149e2b5ad59dd8b4b262f5fdeb5cc10ecf43
- SHA512 ba8e09654cff264d428b1b3cf6df764699c6a754f2db329643881fb75cc8647a9c2777f05bb8c0d81b9d648d345796ffdb14fd231e2bb1caf71530098d12f219
- TLSH T19CF002C1FB856AE9E16A52610D7A16701C07C3A4217640A46C26DED41929F0DC2D8221
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0inymrgq.default-release\user.js
- Size 830B
- SHA256 2a837317cb6b285fb5c713a0045577564db912d91342ab7da62dbf190571d878
- MD5 1ad971e7dc162272771434635f86da02
- SHA1 34b23646f1d449c34270f3b087e570d327285601
- SHA512 22813b88beb8d40cf1048c5cfc9fcd7f2381b7e2457dbaf88a118f1cf4c521faacbbaeb709573c73ec1d42c9e9baa7fe9aa664d271a497e1851f3ec0bb18d158
- TLSH T1C6015364184C8F0EDF78B1E4DC40A329E6E424353AEE799203F490B29228B7440EB1BB
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xynr4oz2.Admin\user.js
- Size 431B
- SHA256 06df6ab198c045a72525e19e0da9cffe91f386698596bd6e3b6884cbfaaf5fa7
- MD5 e0b09c4980a09762f16b6b2a06a01812
- SHA1 0e974dbb706350f29e14c9e46df62e6bf8032731
- SHA512 f5c4a12427a87d3a40432f3ee1e141c201c0e19a785c94ea209fad05fb6d2c32ab6da1e658a1b07fa3db356552ca6dbb6cf0e2a6902b47f61824c816f4d5646d
- TLSH T1D5E0E564835C4E4FE9B8B1E48C14732165B270BA3EEF7C9242711562901CB7C22DBDAF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xynr4oz2.Admin\user.js
- Size 1KB
- SHA256 60837c7ca6feaf5d07262249090d29f2a0f9458e9f226307c21262356684c121
- MD5 62ad136fe26bab30cdf88d36c5c3b806
- SHA1 ae69d2cd8f33562f1a5d8bd9484ca561331d5add
- SHA512 3deba93ab706a5de9d7133caedd46b9d8b71fe7ee771ec33c8c2a7d5ad358fa429958fa9ba608ff39f8dff5251fc7f780549d0fa4a8aec20aedd8198cb28654c
- TLSH T12B110E64594C8F0FEFB8B1E4CC006325A6F114767AEE798203F490729128B7450EB5BB
- MD5 SHA1 SHA512 TLSH