Overview
overview
7Static
static
318fea9d22f...18.exe
windows7-x64
718fea9d22f...18.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows7-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDIR/UAC.dll
windows7-x64
3$PLUGINSDIR/UAC.dll
windows10-2004-x64
3$PLUGINSDIR/inetc.dll
windows7-x64
3$PLUGINSDIR/inetc.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows7-x64
3$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$PROGRAMFI...OG.exe
windows7-x64
7$PROGRAMFI...OG.exe
windows10-2004-x64
7$PLUGINSDI...LL.dll
windows7-x64
3$PLUGINSDI...LL.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows7-x64
3$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows7-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...ec.dll
windows7-x64
3$PLUGINSDI...ec.dll
windows10-2004-x64
3$TEMP/chrome.js
windows7-x64
3$TEMP/chrome.js
windows10-2004-x64
3Analysis
-
max time kernel
134s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240611-en -
resource tags
arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system -
submitted
28-06-2024 05:43
Static task
static1
Behavioral task
behavioral1
Sample
18fea9d22f9468e38fb881fdd631947c_JaffaCakes118.exe
Resource
win7-20240419-en
Behavioral task
behavioral2
Sample
18fea9d22f9468e38fb881fdd631947c_JaffaCakes118.exe
Resource
win10v2004-20240508-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240611-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral7
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win7-20231129-en
Behavioral task
behavioral8
Sample
$PLUGINSDIR/LangDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral9
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240611-en
Behavioral task
behavioral10
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win7-20240508-en
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral13
Sample
$PLUGINSDIR/UAC.dll
Resource
win7-20240508-en
Behavioral task
behavioral14
Sample
$PLUGINSDIR/UAC.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral15
Sample
$PLUGINSDIR/inetc.dll
Resource
win7-20240419-en
Behavioral task
behavioral16
Sample
$PLUGINSDIR/inetc.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral17
Sample
$PLUGINSDIR/linker.dll
Resource
win7-20240221-en
Behavioral task
behavioral18
Sample
$PLUGINSDIR/linker.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral19
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral20
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral21
Sample
$PROGRAMFILES/Toggle Downloader/Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)/$PROG.exe
Resource
win7-20240508-en
Behavioral task
behavioral22
Sample
$PROGRAMFILES/Toggle Downloader/Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)/$PROG.exe
Resource
win10v2004-20240611-en
Behavioral task
behavioral23
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win7-20240419-en
Behavioral task
behavioral24
Sample
$PLUGINSDIR/FindProcDLL.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral25
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win7-20240508-en
Behavioral task
behavioral26
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20240611-en
Behavioral task
behavioral27
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win7-20240611-en
Behavioral task
behavioral28
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20240508-en
Behavioral task
behavioral29
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240611-en
Behavioral task
behavioral30
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
Behavioral task
behavioral31
Sample
$TEMP/chrome.js
Resource
win7-20240221-en
Behavioral task
behavioral32
Sample
$TEMP/chrome.js
Resource
win10v2004-20240508-en
General
-
Target
$PROGRAMFILES/Toggle Downloader/Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)/$PROG.exe
-
Size
863KB
-
MD5
27ecbaf65445d559b5fe36fc9db2fb4f
-
SHA1
3a121e2f920406c91d5293e090ba63b49d81cf55
-
SHA256
eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6
-
SHA512
1ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264
-
SSDEEP
12288:hCzd7N7otPKnsvAH6x0GbQP3XoIq5tLgVHkCAQlvtrN:hCzFvnsm6iGbQ/oIKikelvj
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3484 Au_.exe -
Loads dropped DLL 1 IoCs
pid Process 3484 Au_.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
NSIS installer 2 IoCs
resource yara_rule behavioral22/files/0x00070000000235d8-4.dat nsis_installer_1 behavioral22/files/0x00070000000235d8-4.dat nsis_installer_2 -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2560 wrote to memory of 3484 2560 $PROG.exe 90 PID 2560 wrote to memory of 3484 2560 $PROG.exe 90 PID 2560 wrote to memory of 3484 2560 $PROG.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\$PROG.exe"C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\$PROG.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe"C:\Users\Admin\AppData\Local\Temp\~nsu.tmp\Au_.exe" _?=C:\Users\Admin\AppData\Local\Temp\$PROGRAMFILES\Toggle Downloader\Toggle Downloader Adobe Flash Player (Firefox, Chrome y Opera)\2⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3484
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4116,i,16856304285138459032,14480077487839828721,262144 --variations-seed-version --mojo-platform-channel-handle=4648 /prefetch:81⤵PID:4320
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
14KB
MD5325b008aec81e5aaa57096f05d4212b5
SHA127a2d89747a20305b6518438eff5b9f57f7df5c3
SHA256c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
SHA51218362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
-
Filesize
610B
MD54caa05affdb15d4eec35a8073c5f0cd8
SHA104d90d9d722d480be9171905435e75efe73476cb
SHA256df8602b79b38ce27969dde594f626ea14029b5282561eea7c9d7f63f81f8fe2f
SHA512a5044c46d045517461942fd1c3ef78e51a9467e22f19bf80e99f7112ccfa46a9027280416c9e20d791dcfda2d30ee3d2d2163df58b312eceff53d91dd2baa424
-
Filesize
863KB
MD527ecbaf65445d559b5fe36fc9db2fb4f
SHA13a121e2f920406c91d5293e090ba63b49d81cf55
SHA256eb213336162535fe63cd8870d11cf0341b6c9b365cc2e50e7267596e30c6e8c6
SHA5121ac383eb6b77f489d329928388974cab5c5376860fcb48e6ed0a09d08e7cc2a2663b961e66165b397763a3127e67716a04bcb8bbd69e0318403b9caa2e098264