Overview
overview
7Static
static
7jaffacakes...ic.exe
windows10-2004-x64
7jaffacakes...ic.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...er.dll
windows10-2004-x64
3$PLUGINSDI...er.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...dl.dll
windows10-2004-x64
3$PLUGINSDI...dl.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...le.exe
windows10-2004-x64
7$PLUGINSDI...le.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3MainInstaller.exe
windows10-2004-x64
7MainInstaller.exe
windows11-ltsc_2024-x64
7PingMe.exe
windows10-2004-x64
3PingMe.exe
windows11-ltsc_2024-x64
3Setup.exe
windows10-2004-x64
7Setup.exe
windows11-ltsc_2024-x64
7$PLUGINSDI...ns.dll
windows10-2004-x64
3$PLUGINSDI...ns.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...oc.dll
windows10-2004-x64
5$PLUGINSDI...oc.dll
windows11-ltsc_2024-x64
5$PLUGINSDI...em.dll
windows10-2004-x64
3$PLUGINSDI...em.dll
windows11-ltsc_2024-x64
3$PLUGINSDI...ss.dll
windows10-2004-x64
3$PLUGINSDI...ss.dll
windows11-ltsc_2024-x64
32YourFace_Util.dll
windows10-2004-x64
32YourFace_Util.dll
windows11-ltsc_2024-x64
3AddInstall.js
windows10-2004-x64
3AddInstall.js
windows11-ltsc_2024-x64
3background.html
windows10-2004-x64
3background.html
windows11-ltsc_2024-x64
3Analysis
- max time kernel
150s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
14/10/2026, 11:15
Behavioral task
behavioral1
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral2
Sample
jaffacakes118_UDS.DangerousObject.Multi.Generic.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral3
Sample
$PLUGINSDIR/Banner.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral4
Sample
$PLUGINSDIR/Banner.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral5
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral6
Sample
$PLUGINSDIR/NSISdl.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral7
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral9
Sample
$PLUGINSDIR/bundle.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
$PLUGINSDIR/bundle.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral11
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral13
Sample
MainInstaller.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
MainInstaller.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral15
Sample
PingMe.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
PingMe.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral17
Sample
Setup.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
Setup.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral19
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
$PLUGINSDIR/InstallOptions.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral21
Sample
$PLUGINSDIR/KillProc.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
$PLUGINSDIR/KillProc.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral23
Sample
$PLUGINSDIR/System.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
$PLUGINSDIR/System.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral25
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
$PLUGINSDIR/nsProcess.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral27
Sample
2YourFace_Util.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
2YourFace_Util.dll
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral29
Sample
AddInstall.js
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
AddInstall.js
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
Behavioral task
behavioral31
Sample
background.html
Resource
win10v2004-20260911-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
background.html
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
General
- Target Setup.exe
- Size 505KB
- Sample261014-nc2zza1s3l
- SHA256 30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
- MD5 5d8d0c08384ad73216d52a2eabc064f5
- SHA1 0fa5c77fd6b6323b926c9648679e063d1bbc8bcc
- SHA512 42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
- SSDEEP 12288:6xPm2P17YJbq9VXMLVS+n78L6OdBRdrrf3xr5Uw1jcZQM7gMyZQU:6Jh17YYVV+YGsBH3xr5Uw1jcZQM71yZX
- TLSH T117B422056BC56936DEB658F0203963F996BF97CA2950470B43B13A071E329A7CC05F7E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Loads dropped DLL 5 IoCs
pid Process 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E} Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "C:\\Program Files (x86)\\2YourFace\\bho.dll" Setup.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\NoExplorer = "1" Setup.exe - Drops file in Program Files directory 13 IoCs
description ioc Process File created C:\Program Files (x86)\2YourFace\2YourFace.crx Setup.exe File created C:\Program Files (x86)\2YourFace\bho.dll Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\install.rdf Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\content\ff-overlay.xul Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\content\overlay.js Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\locale\en-US\overlay.properties Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\skin\overlay.css Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\defaults\preferences\prefs.js Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome.manifest Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\content\ff-overlay.js Setup.exe File created C:\Program Files (x86)\2YourFace\ffextension\chrome\locale\en-US\overlay.dtd Setup.exe File created C:\Program Files (x86)\2YourFace\FF8Installer.exe Setup.exe File created C:\Program Files (x86)\2YourFace\uninst.exe Setup.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E} Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "2YourFace Addon" Setup.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32 Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ = "C:\\Program Files (x86)\\2YourFace\\bho.dll" Setup.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ThreadingModel = "Apartment" Setup.exe - Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe 3792 Setup.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:3792
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\nsm2051.tmp\InstallOptions.dll
- Size 14KB
- SHA256 c9cd5c9609e70005926ae5171726a4142ffbcccc771d307efcd195dafc1e6b4b
- MD5 325b008aec81e5aaa57096f05d4212b5
- SHA1 27a2d89747a20305b6518438eff5b9f57f7df5c3
- SHA512 18362b3aee529a27e85cc087627ecf6e2d21196d725f499c4a185cb3a380999f43ff1833a8ebec3f5ba1d3a113ef83185770e663854121f2d8b885790115afdf
- SSDEEP 192:86d+dHXLHQOPiY53uiUdigyU+WsPdc/A1A+2jwK72dwF7dBEnbok:86UdHXcIiY535zBt2jw+BEnbo
- TLSH T1ED622A11778888F3DBD2013EB4533707AF9D5126B4929ED2CA271ECA6D2B05D7EB2346
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2051.tmp\System.dll
- Size 11KB
- SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
- MD5 c17103ae9072a06da581dec998343fc1
- SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
- SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
- SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
- TLSH T1CA325C5993A0C1F3D5A0823C0D973A7B1779722016B14FA3CFA35842AE196D7AC7D227
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2051.tmp\ioSpecial.ini
- Size 733B
- SHA256 71ecf49528474e51ee216f3e4c6fbcd9f5db07a98a121e7c40297660cc1030b3
- MD5 4b3a102d4d88ddb6784417578cb41391
- SHA1 376bb88a1b829d29b41c548407d279a07df06876
- SHA512 06409b91adcc1f85bc6f17dc1d7cd4c712a401a58cb90aa12cc21e85ca13bf4df9f799171c55a580fe77feadf1f5b562b1045f8b6aa05cfee8fe368615daf2a5
- TLSH T133017585445FD369841054D654FA379197D01D3C4B1139F6F4628CC6538DDD386DEDD2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2051.tmp\ioSpecial.ini
- Size 733B
- SHA256 5409cc4a8ec0ab868aba0b9f385ccd15c49fe9ac52bccbd9c62145e60c76184d
- MD5 5fd4ded2bbbc10c5e601c5374c661270
- SHA1 287376efe844ab587f76166c1fceb721eeb955fb
- SHA512 6579b0dcfd2236e0ce7f858ef9f899a19a2b18694afddc83197682581742f6a4bfb8e1ecb7cf95eb19601d58769f9af389b0ecf42b3ea05d4c693f8a27795c78
- TLSH T1930190C8441F9369442054D654FB379197D01D2C4B1138F1F0629886534DDC386DEDE6
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\nsm2051.tmp\nsProcess.dll
- Size 4KB
- SHA256 579a034ff5ab9b732a318b1636c2902840f604e8e664f5b93c07a99253b3c9cf
- MD5 faa7f034b38e729a983965c04cc70fc1
- SHA1 df8bda55b498976ea47d25d8a77539b049dab55e
- SHA512 7868f9b437fcf829ad993ff57995f58836ad578458994361c72ae1bf1dfb74022f9f9e948b48afd3361ed3426c4f85b4bb0d595e38ee278fee5c4425c4491dbf
- SSDEEP 48:iYXzAm8HGJLvwM8GJFd6I7W4JtT2bxNNAa4GsNf+CJ8aYqmtlKdgAtgma1QvtCSJ:lz2mJkpGR6GY74GQ1YqmstgGCtR
- TLSH T10E91D77693D440B2D186093255A31AA31BEDC536035B590EAF835E937F90DFBECB9322
- MD5 SHA1 SHA512 SSDEEP TLSH