0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b

Analysis

max time kernel
27s
max time network
48s
platform
windows7_x64
resource
win7-20220414-en
submitted
27-05-2022 19:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe
Size

250KB
MD5

33035ea32312687fca886e60dcd84466
SHA1

f7e3e5fe5df88f9cd77844a5063cff4851834484
SHA256

0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b
SHA512

b1dbce3b9594c7e85f6a12a5b1282c0e801ed1a8732a29da2a251fa5a853862555cea566f3750962e0d6b05a80c0eb4121e30fa32df780b05a87937861e60469

Score

9^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nst2F5C.tmp\nsJSON.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

50f73ee9e5157.exe

pid process

1464 50f73ee9e5157.exe

pid	process
1464	50f73ee9e5157.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nst2F5C.tmp\nsJSON.dll	upx
behavioral1/memory/1464-77-0x0000000074820000-0x000000007482A000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe50f73ee9e5157.exe

pid	process
676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe
1464	50f73ee9e5157.exe
1464	50f73ee9e5157.exe
1464	50f73ee9e5157.exe
1464	50f73ee9e5157.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

50f73ee9e5157.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hgpnjncplaompocpnonadkcjeanfggga\1\manifest.json	50f73ee9e5157.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe	nsis_installer_2
\ProgramData\SaveSale\uninstall.exe	nsis_installer_1
\ProgramData\SaveSale\uninstall.exe	nsis_installer_2

Modifies registry class 45 IoCs

Processes:

50f73ee9e5157.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\InProcServer32\ThreadingModel = "Apartment"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\InProcServer32	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SaveSale\\50f73ee9e518f.tlb"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\ProgID\ = "SaveSale.1"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\ = "SaveSale"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SaveSale"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\InProcServer32\ = "C:\\ProgramData\\SaveSale\\50f73ee9e518f.dll"	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}\ProgID	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50f73ee9e5157.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66}	50f73ee9e5157.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe

description	pid	process	target process
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe
PID 676 wrote to memory of 1464	676	0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe	50f73ee9e5157.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

50f73ee9e5157.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50f73ee9e5157.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{27E1E9C3-87ED-4CD2-B6D0-5EFFAAB95B66} = "1"	50f73ee9e5157.exe

C:\Users\Admin\AppData\Local\Temp\0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe
"C:\Users\Admin\AppData\Local\Temp\0510e110a1edc11604e54bdf80dc44e1c7d729c1ccb9aa1ea43a473c0de77a9b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:676

C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe
.\50f73ee9e5157.exe /s
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Modifies registry class
- System policy modification
PID:1464

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
60f0a0cb55b789e6697bf39f050252aa

SHA1
d3f11885dc57a600d86c1cae679b2889e42626ea

SHA256
99c2e5d9d169fcadf66f7a9e3cbe563def486bcc70c92891bb19c5ceb68e7e3b

SHA512
b5a90ffe8263d0758c97fe9390ce5d936292c8e2df30e61ee6a4db706b6c5eacfa349fc891997cdc98f399fb677133abf7a88b54cf71f9d8b45a803dbb315728

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\[email protected]\chrome.manifest
Filesize
116B

MD5
6e07a7ff329965feb2931c1e2c9c436d

SHA1
205e88ed0003d7b7c799fea5adfb2cb1db862821

SHA256
56721f4e216acaa15235b0961a2580438affafcb16eaf5c5ab4dfb6b73ac078b

SHA512
100e9fe21a8ec2dd68c944b4ee2f8be16054d6f3dd02085a530f2ed39d25e4751205d0404bf3da50f4ef0084b0ec924765922d1119b5403bc8b9cd5a1825e303

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
4a28fe2d1194d881676ab946ede069d7

SHA1
0f3780441cef6849671d19eff740491d16755566

SHA256
e2001ca8ebaa4d51d6627d68355d99b622702a28c7f5e34b9ed86171738d0b42

SHA512
91df2a21cf5c03502b5e6602ba189039b25b191cfc774c992c8685f62bc16de241292d05ae59a72d5b92db58a2fb643de4d524571456fbe98c6b26414e6641a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\[email protected]\content\zy.xul
Filesize
225B

MD5
ab8b3aa5466d3e683971cd6f489d1a14

SHA1
125861119f101af8102161e723d5bd934be7631b

SHA256
4ee98733d0b022ae1c497fe2fc3f61f793102752da4f4d9a20e9475b5043095b

SHA512
46ce4d552f08bb5f69093eb3db633db25404d5cc63b4677e6d534aa7ed8ef05b9b4dd449a7c3d0f762329cdfbefedc2ef25927f0d3c3f12907abecce1bb5c2e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\[email protected]\install.rdf
Filesize
705B

MD5
7e3fb628022a7e9dbfd6c836beced1d0

SHA1
eb8c7f77ec867b93645e1893ef1eac0dde7c564d

SHA256
61a7ffa8399781ba1a21d946a2dc46d895dff79f195bfca2c035ee66609f8e23

SHA512
00b427d160ff1e9b656a23d4e857700e60aa05b5a93dd7af0a39ee807aab014483dc004ba509e0daa6d67e4d3fc6a853ffafd603921f67f7a47020ee07847fca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e518f.dll
Filesize
116KB

MD5
da161da8bcb9b8032908cc303602f2ee

SHA1
8a2d5e5b32376a40f33d6c9881001425ec025205

SHA256
0648d564b30e13a0819f28e00a9af39a6686a4d29ccd265c7d81548e4fe0f67e

SHA512
39e882a371dbce2484324811bffdd7ae7655b57401d07bf264aced6b5dac0ae326bd1945c536f05d8ab3b92ca03ff056c5a7baf54f7eb477b45fc405ec54052c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e518f.tlb
Filesize
2KB

MD5
1f14de44d0d63a79f91d3fe90badb5fc

SHA1
7fcc921608d2cf40e81cdd9a98e1a15a6ba1f57e

SHA256
bd3d85c0136a66b2af79d4d91c1c5700c8931937b7e554d5ece946760ef4a99c

SHA512
86eb6ebf9eccf1dcb601db827797ac603c0ebe01b6d73318986275c29bd034c8df5f7c79ddf0b19536faf24bdb11e09ac95ea43e8fe75b0ed3dde76dd139883c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\50f73ee9e4f6a2.31113336.js
Filesize
4KB

MD5
a3dfacdd64f4168b4cda072bf3ab7d6a

SHA1
a8d10d1647406252d2e0d9f871c5fefb635411a9

SHA256
6d3f1320c72c2c05fa396382159da4d2062ef590fcaa003f716d157cbdddb5a9

SHA512
80b5d595e25c3b071ec346c610be4f372552efff3e4cf97c2ce867014ce21cd3002b16698e8784d90f37c144c994eb147329b69dfea9a42c6bff340c44acaf22

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\background.html
Filesize
161B

MD5
75beeff3913a3d96049f785d4234db07

SHA1
fc98dd8820d1afba9ea8ba488fcd0e6d2192c393

SHA256
ce9f8df9e49f404dcb38df7dc31b53519375714162d7907a8eb345f537e6af25

SHA512
c9f49bec981c1a5c1bff3cbb27871194cfb5fc9061da500c9be2f2b5399d0455e600018fd0c78469f96f5ef7fc1ee8118703a428f69b1525de2cc771f2396487

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\content.js
Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\lsdb.js
Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\manifest.json
Filesize
475B

MD5
f91cd42bdfe41bcc97d2eb37eafd8bd2

SHA1
c0dd02c8f7959b84bf6583d62ecd308651c37b6d

SHA256
6805fc1de5ccc99d653689693aeb3a390116b024eedc26b0ca00a7296ec422a5

SHA512
8a043a54c40787174c0f167c0083899757803b06100189a9a485d86ebadfa791b83af0e8a502fd34c2b8b20ad9b4c82cf1c302234db69006cf089e0b7179ab2f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\hgpnjncplaompocpnonadkcjeanfggga\sqlite.js
Filesize
1KB

MD5
af565c238a8ac17cd5674ad5807bf7ea

SHA1
fad63cbe6c9c92536c4faa45c976660eff8f69e5

SHA256
cec3a44cf1669b2d61ed44fc2bc9b6ce83832ab4de51650c7830a4f82a03d879

SHA512
99d5df0d2630797b93d6d6cf7b1affc9aacf0e71c9aa0756bae07281cf65c8d2aa0e19d76075c1545a74b78802f69a27c2abb2388a2e06e97858267927290b9a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\settings.ini
Filesize
6KB

MD5
52cbb07463e01a9bfc2c17b0f855629e

SHA1
3904ce4a84b27ad6adcd48d336048019c20a5775

SHA256
a7108f3baf943ac4aeb5d634cb04e263475c22f52d38ee5a836046c870d66706

SHA512
e432487f39549e5c61f226d9ff4dde3ece101961d9bd2033032f68e61a0ea92aa6650b3a4776d03cf9e79e9aa8663d686a06178e8e894959359b7bec4bd744ea

Download Submit
\ProgramData\SaveSale\50f73ee9e518f.dll
Filesize
116KB

MD5
da161da8bcb9b8032908cc303602f2ee

SHA1
8a2d5e5b32376a40f33d6c9881001425ec025205

SHA256
0648d564b30e13a0819f28e00a9af39a6686a4d29ccd265c7d81548e4fe0f67e

SHA512
39e882a371dbce2484324811bffdd7ae7655b57401d07bf264aced6b5dac0ae326bd1945c536f05d8ab3b92ca03ff056c5a7baf54f7eb477b45fc405ec54052c

Download Submit
\ProgramData\SaveSale\uninstall.exe
Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2E61.tmp\50f73ee9e5157.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nst2F5C.tmp\UserInfo.dll
Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nst2F5C.tmp\nsJSON.dll
Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/676-54-0x0000000075EF1000-0x0000000075EF3000-memory.dmp

Filesize
8KB

Download
memory/1464-77-0x0000000074820000-0x000000007482A000-memory.dmp

Filesize
40KB

Download
memory/1464-56-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads