Overview
overview
7Static
static
7f17550df3c...18.exe
windows7-x64
7f17550df3c...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
3$PLUGINSDI...le.exe
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3yourface.exe
windows7-x64
7yourface.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MainInstaller.exe
windows7-x64
7MainInstaller.exe
windows10-2004-x64
7PingMe.exe
windows7-x64
1PingMe.exe
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
7$PLUGINSDI...oc.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
32YourFace_Util.dll
windows7-x64
32YourFace_Util.dll
windows10-2004-x64
3Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15-04-2024 16:08
Behavioral task
behavioral1
Sample
f17550df3cb68018a96b48678322f70b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f17550df3cb68018a96b48678322f70b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
yourface.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
yourface.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
MainInstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MainInstaller.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
PingMe.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
PingMe.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Setup.exe
Resource
win7-20240319-en
Behavioral task
behavioral22
Sample
Setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
2YourFace_Util.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
2YourFace_Util.dll
Resource
win10v2004-20240412-en
General
-
Target
MainInstaller.exe
-
Size
531KB
-
MD5
9ce448dcd7cf13dd950725957361bdff
-
SHA1
5831ff31825ea82d90a2989e0fc0a33b859d5f97
-
SHA256
3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80
-
SHA512
b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f
-
SSDEEP
12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1996 Setup.exe -
Loads dropped DLL 2 IoCs
pid Process 2228 MainInstaller.exe 1996 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral17/files/0x000d00000001224d-2.dat nsis_installer_1 behavioral17/files/0x000d00000001224d-2.dat nsis_installer_2 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1996 Setup.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28 PID 2228 wrote to memory of 1996 2228 MainInstaller.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2228 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=12⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:1996
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
694B
MD52e6b7323e40dc59b8d13b4d6ee9e08e1
SHA1a1d2be0eb5d43c9d8725c36f7ad205d96717d4ee
SHA256732494eb31f29a7dfc75e9c6d94c2e6994e4e433966af488eb6ad58c6fd7944a
SHA512086de294cfd7943d3681528fe031de1d391bbd2a48d9b61ab41f2c013fc9cd02a0cad99a49d16158d26751db84a94fd55a27335f9522c1719e288c53b571b140
-
Filesize
707B
MD50042762065d3d41d09ab001d7f404114
SHA1591576eec974bb2e5f40f885507620c2dc46bf67
SHA256af689a325c461ba10ff76d207f7069032bc385039e99b8d12c850347d61c9111
SHA512f8c8e3e4efb3eca82a1cde6dc844859a8135f238068bbc7ad7388aaf07a5396a5a8f152f91f676dec87a92c7f41a95bcf7031cac39723167a05431f595e45f8c
-
Filesize
505KB
MD55d8d0c08384ad73216d52a2eabc064f5
SHA10fa5c77fd6b6323b926c9648679e063d1bbc8bcc
SHA25630522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
SHA51242a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf