Overview
overview
10Static
static
10d4164b1dab...05.exe
windows7-x64
3d4164b1dab...05.exe
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...gs.dll
windows7-x64
3$PLUGINSDI...gs.dll
windows10-2004-x64
3$TEMP/ulicense.rtf
windows7-x64
4$TEMP/ulicense.rtf
windows10-2004-x64
1FarmFrenzy...ca.exe
windows7-x64
9FarmFrenzy...ca.exe
windows10-2004-x64
9FarmFrenzy...rp.exe
windows7-x64
1FarmFrenzy...rp.exe
windows10-2004-x64
1JNGLoad.dll
windows7-x64
3JNGLoad.dll
windows10-2004-x64
3Squall.dll
windows7-x64
1Squall.dll
windows10-2004-x64
1htmlayout.dll
windows7-x64
9htmlayout.dll
windows10-2004-x64
9wrapper.dll
windows7-x64
9wrapper.dll
windows10-2004-x64
9Analysis
-
max time kernel
141s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
30-06-2024 02:26
Behavioral task
behavioral1
Sample
d4164b1dab1337e28d3ce097a32b8635c893e1acaaf7136e745b90c44ee2cf05.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
d4164b1dab1337e28d3ce097a32b8635c893e1acaaf7136e745b90c44ee2cf05.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsDialogs.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral7
Sample
$TEMP/ulicense.rtf
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
$TEMP/ulicense.rtf
Resource
win10v2004-20240508-en
Behavioral task
behavioral9
Sample
FarmFrenzy3_America.exe
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
FarmFrenzy3_America.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral11
Sample
FarmFrenzy3_America.wrp.exe
Resource
win7-20240220-en
Behavioral task
behavioral12
Sample
FarmFrenzy3_America.wrp.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral13
Sample
JNGLoad.dll
Resource
win7-20240419-en
Behavioral task
behavioral14
Sample
JNGLoad.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
Squall.dll
Resource
win7-20240508-en
Behavioral task
behavioral16
Sample
Squall.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
htmlayout.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
htmlayout.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral19
Sample
wrapper.dll
Resource
win7-20240508-en
Behavioral task
behavioral20
Sample
wrapper.dll
Resource
win10v2004-20240611-en
General
-
Target
FarmFrenzy3_America.exe
-
Size
2.2MB
-
MD5
fb831b4880832939cb71438709315419
-
SHA1
adb4898e9cb378d85e3a8aa9687a83ab57f8d0a3
-
SHA256
45358426457118f34ec7b91f181164ce7f7713f136329c78d9f3f331c209b441
-
SHA512
41449b6f46bfb2c4b3f27066ee641219698f6a61913713e0225dd6746937a33f5e921f1a5c1b0aee6cd7e33761a093e2d711eae8d3d8520e62c364be477b601c
-
SSDEEP
49152:fsZFqt6yszz3ZYWyoTLPFJn6OVlTmJMBnulCVtsYo5:UmY/3vyoTjFJ6OnTWMBulCPs
Malware Config
Signatures
-
UPX dump on OEP (original entry point) 2 IoCs
Processes:
resource yara_rule behavioral10/memory/4336-3-0x0000000000E30000-0x0000000000FE9000-memory.dmp UPX behavioral10/memory/4336-26-0x0000000000E30000-0x0000000000FE9000-memory.dmp UPX -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
FarmFrenzy3_America.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3665033694-1447845302-680750983-1000\Control Panel\International\Geo\Nation FarmFrenzy3_America.exe -
Processes:
resource yara_rule behavioral10/memory/4336-3-0x0000000000E30000-0x0000000000FE9000-memory.dmp upx behavioral10/memory/4336-26-0x0000000000E30000-0x0000000000FE9000-memory.dmp upx -
Processes:
FarmFrenzy3_America.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FarmFrenzy3_America.exe -
Modifies registry class 9 IoCs
Processes:
FarmFrenzy3_America.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.key FarmFrenzy3_America.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ FarmFrenzy3_America.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5248F3-00C3-5F7E-14E8-A27E8358DB7A}\TypeLib FarmFrenzy3_America.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node FarmFrenzy3_America.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5248F3-00C3-5F7E-14E8-A27E8358DB7A}\TypeLib\1000 = "1799337" FarmFrenzy3_America.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.key\ = "regfile" FarmFrenzy3_America.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID FarmFrenzy3_America.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5248F3-00C3-5F7E-14E8-A27E8358DB7A} FarmFrenzy3_America.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC5248F3-00C3-5F7E-14E8-A27E8358DB7A}\TypeLib\1000 = "1799336" FarmFrenzy3_America.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
FarmFrenzy3_America.exepid process 4336 FarmFrenzy3_America.exe 4336 FarmFrenzy3_America.exe 4336 FarmFrenzy3_America.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FarmFrenzy3_America.exe"C:\Users\Admin\AppData\Local\Temp\FarmFrenzy3_America.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of SetWindowsHookEx
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4044,i,7977653611488681184,6839495125838449898,262144 --variations-seed-version --mojo-platform-channel-handle=1276 /prefetch:81⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4336-0-0x0000000000400000-0x0000000000833000-memory.dmpFilesize
4.2MB
-
memory/4336-1-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB
-
memory/4336-2-0x0000000000E30000-0x0000000000FE9000-memory.dmpFilesize
1.7MB
-
memory/4336-9-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4336-8-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4336-15-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB
-
memory/4336-14-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/4336-13-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/4336-12-0x0000000002B00000-0x0000000002B01000-memory.dmpFilesize
4KB
-
memory/4336-11-0x0000000002AD0000-0x0000000002AD1000-memory.dmpFilesize
4KB
-
memory/4336-10-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/4336-7-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4336-6-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/4336-5-0x0000000002AE0000-0x0000000002AE5000-memory.dmpFilesize
20KB
-
memory/4336-4-0x00000000028F0000-0x0000000002925000-memory.dmpFilesize
212KB
-
memory/4336-3-0x0000000000E30000-0x0000000000FE9000-memory.dmpFilesize
1.7MB
-
memory/4336-19-0x0000000000400000-0x0000000000833000-memory.dmpFilesize
4.2MB
-
memory/4336-21-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB
-
memory/4336-26-0x0000000000E30000-0x0000000000FE9000-memory.dmpFilesize
1.7MB
-
memory/4336-27-0x00000000028F0000-0x0000000002925000-memory.dmpFilesize
212KB
-
memory/4336-28-0x0000000002B50000-0x0000000002B51000-memory.dmpFilesize
4KB
-
memory/4336-34-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB
-
memory/4336-40-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB
-
memory/4336-46-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB
-
memory/4336-70-0x0000000010000000-0x000000001017D000-memory.dmpFilesize
1.5MB