Overview
overview
7Static
static
7f17550df3c...18.exe
windows7-x64
7f17550df3c...18.exe
windows10-2004-x64
7$PLUGINSDI...er.dll
windows7-x64
1$PLUGINSDI...er.dll
windows10-2004-x64
1$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...le.exe
windows7-x64
3$PLUGINSDI...le.exe
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3yourface.exe
windows7-x64
7yourface.exe
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3MainInstaller.exe
windows7-x64
7MainInstaller.exe
windows10-2004-x64
7PingMe.exe
windows7-x64
1PingMe.exe
windows10-2004-x64
1Setup.exe
windows7-x64
7Setup.exe
windows10-2004-x64
7$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...oc.dll
windows7-x64
7$PLUGINSDI...oc.dll
windows10-2004-x64
7$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows7-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
32YourFace_Util.dll
windows7-x64
32YourFace_Util.dll
windows10-2004-x64
3Analysis
-
max time kernel
136s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20240412-en -
resource tags
arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system -
submitted
15-04-2024 16:08
Behavioral task
behavioral1
Sample
f17550df3cb68018a96b48678322f70b_JaffaCakes118.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
f17550df3cb68018a96b48678322f70b_JaffaCakes118.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral13
Sample
yourface.exe
Resource
win7-20240221-en
Behavioral task
behavioral14
Sample
yourface.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240215-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral17
Sample
MainInstaller.exe
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
MainInstaller.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral19
Sample
PingMe.exe
Resource
win7-20231129-en
Behavioral task
behavioral20
Sample
PingMe.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral21
Sample
Setup.exe
Resource
win7-20240319-en
Behavioral task
behavioral22
Sample
Setup.exe
Resource
win10v2004-20240412-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/KillProc.dll
Resource
win7-20240221-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240221-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win7-20240215-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20240412-en
Behavioral task
behavioral31
Sample
2YourFace_Util.dll
Resource
win7-20240220-en
Behavioral task
behavioral32
Sample
2YourFace_Util.dll
Resource
win10v2004-20240412-en
General
-
Target
MainInstaller.exe
-
Size
531KB
-
MD5
9ce448dcd7cf13dd950725957361bdff
-
SHA1
5831ff31825ea82d90a2989e0fc0a33b859d5f97
-
SHA256
3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80
-
SHA512
b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f
-
SSDEEP
12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2680 Setup.exe -
Loads dropped DLL 1 IoCs
pid Process 2680 Setup.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral18/files/0x000400000001e970-3.dat nsis_installer_1 behavioral18/files/0x000400000001e970-3.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 2680 3592 MainInstaller.exe 86 PID 3592 wrote to memory of 2680 3592 MainInstaller.exe 86 PID 3592 wrote to memory of 2680 3592 MainInstaller.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Users\Admin\AppData\Local\Temp\Setup.exeC:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=0 /NOTIFY=0 /FFR=1 /FFP=12⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
505KB
MD55d8d0c08384ad73216d52a2eabc064f5
SHA10fa5c77fd6b6323b926c9648679e063d1bbc8bcc
SHA25630522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
SHA51242a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
694B
MD553e2f20cafa67b9042f3979793f60d47
SHA193980f88d7540af7f06de3455e72e1cf1562999e
SHA25674f2c8277533936dcdb459efe7c9715499f31b9a2c054b611b9ab73a1aa5ca39
SHA5120debdbfb681e1998e147de0c96eade4b422c1a76e0c3e5da0fcb44e6559d0efb7f49c022971cfec0ea2e11804591e8f5843e4312b0c1f9e806a1f537716d36bb