0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608

Analysis

max time kernel
41s
max time network
46s
platform
windows7_x64
resource
win7-20220414-en
submitted
29-05-2022 15:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe
Size

255KB
MD5

367989bff7947352a9c0a47e7f6d5b5b
SHA1

bcb7b73e8860c18b52d48a46a393feaa49aa36b3
SHA256

0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608
SHA512

849bbeb2d13fd4f59f1f6c920e709a071fbf033a4ffefd7c3d5da6a9d1457e4a69b1bf489ac4767167ba5c63e93f301431fd8435a52cdf472afb1ab9a62f45bf

Score

9^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd1E6.tmp\nsJSON.dll	acprotect

Executes dropped EXE 1 IoCs

Processes:

512659c9dd6c9.exe

pid process

1656 512659c9dd6c9.exe

pid	process
1656	512659c9dd6c9.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\nsd1E6.tmp\nsJSON.dll	upx
behavioral1/memory/1656-75-0x0000000074660000-0x000000007466A000-memory.dmp	upx

Loads dropped DLL 5 IoCs

Processes:

0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe512659c9dd6c9.exe

pid	process
452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe
1656	512659c9dd6c9.exe
1656	512659c9dd6c9.exe
1656	512659c9dd6c9.exe
1656	512659c9dd6c9.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

512659c9dd6c9.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\feajjofnpnjopfnphifophojepkcpbpa\1\manifest.json	512659c9dd6c9.exe

Installs/modifies Browser Helper Object 2 TTPs
BHOs are DLL modules which act as plugins for Internet Explorer.
stealer adware

Modify Registry
T1112

Browser Extensions
T1176
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

NSIS installer 8 IoCs

installer

Processes:

resource	yara_rule
\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_1
\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_2
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_1
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe	nsis_installer_2
\ProgramData\Search-NewTab\uninstall.exe	nsis_installer_1
\ProgramData\Search-NewTab\uninstall.exe	nsis_installer_2

Modifies registry class 45 IoCs

Processes:

512659c9dd6c9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\InProcServer32\ThreadingModel = "Apartment"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\InProcServer32	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\ProgID\ = "Search-NewTab.1"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\ = "Search-NewTab"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Search-NewTab\\512659c9dd702.tlb"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Search-NewTab"	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\InProcServer32\ = "C:\\ProgramData\\Search-NewTab\\512659c9dd702.dll"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0}\ProgID	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	512659c9dd6c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	512659c9dd6c9.exe

Suspicious use of WriteProcessMemory 7 IoCs

Processes:

0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe

description	pid	process	target process
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe
PID 452 wrote to memory of 1656	452	0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe	512659c9dd6c9.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

512659c9dd6c9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	512659c9dd6c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{80EC30E2-143E-0FB0-800C-3767AB0D24E0} = "1"	512659c9dd6c9.exe

C:\Users\Admin\AppData\Local\Temp\0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe
"C:\Users\Admin\AppData\Local\Temp\0e008bc5fd68415ef674dc9cc1eb06c409b14e8d7dbed4bdcb5769fdeccdc608.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:452

C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe
.\512659c9dd6c9.exe /s
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Modifies registry class
- System policy modification
PID:1656

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\[email protected]\bootstrap.js
Filesize
2KB

MD5
0dcf7d12e9d9c8fdebe5cee1ed05c07e

SHA1
062d84ffd3e34cc04b3b3d77c17914342dc4c342

SHA256
d557c2d3aaee4be506e48d35a127a0296069ea6915f6862dea53171dc9c262e8

SHA512
f6e616663bf80a7b40201ae00c1921f73a3ba205a8e5abdee9e0430d6ffb9eb11a9200e49f840c8a9828c9dbf8c36195f1667625387bd0b6cfe5ee65c6e8d717

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\[email protected]\chrome.manifest
Filesize
116B

MD5
a1b120d1de481e916949a1e6e60598e4

SHA1
c9794118954705a575e16b0bc98b2c61095c1b84

SHA256
77e9ca7b227c78a6d92a63607d8a07a72aa65e1d41df46295b116727c15c2795

SHA512
1b789b4ca8abce255b79042b548d8fce6b55d72f91b749a15e13dabd80c99e807ab9e83185824b849b7a01cd2c475ebf8eccd0d9fbbed6604f310802df906bd7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\[email protected]\content\bg.js
Filesize
8KB

MD5
6a6631527b0c94af37d4afa8deed88bf

SHA1
deaf92ca067eac707ded6d90072388396baa99b3

SHA256
6c131e6d00919ea67e783838ce23a18f69dd38575b9eb817d93d57955b04ffd4

SHA512
2bb1cb39ef1394e24ccbe03204d054fad226cb9969983f4af253ce3d18124d97311db81170d915b42220d8311f34649c75513cfa5f0f324de75cf630d842d6da

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\[email protected]\content\zy.xul
Filesize
225B

MD5
64f80dd79e7c396adfd37ddbe87fd325

SHA1
a2b3efd07d6e97a0e88b27b4db19385d6d3183e4

SHA256
3e6190eaa702fc03e6ea37cc1073ccad6c911a3de6fc3d771f7ccd1248b8e469

SHA512
bdc7dba07dee88a073053dab073c7c18f70125b2b33ebb075651054c43d1c8e0e682bd8e0fe1c26b184e601dbf765e6bd2084913abb53989dfd7a572bf5b15c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\[email protected]\install.rdf
Filesize
709B

MD5
e1f9f8c358af4f6e15367b3204829548

SHA1
67a20f872d61d3700c3a839c51ad3630256c3d85

SHA256
77bdacbe54258100e4f56ce5b8016e8f6f6d22a8adfa9554085aad15d1fd0715

SHA512
2e198025625d4e6b410868623635bd85599e856fe87f41b9f922bae32e8a536b5118b47b3b10d4fe9c30f7c43a3c8ea7fefba4307af2acac00f90582b3a5b3c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd702.dll
Filesize
115KB

MD5
00ce3831a16a62c6d7ea4b21049e4b22

SHA1
3e48c8d25b196d67722ed20cd36bf3448a4c9136

SHA256
d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c

SHA512
7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd702.tlb
Filesize
18KB

MD5
d5980ff8eb0ef4276fad96fba8fc5018

SHA1
2cb05f8b43aa3ae2f5492f590997eec6ff808fe2

SHA256
ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f

SHA512
30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\512659c9dd4da9.38588432.js
Filesize
4KB

MD5
1746596dd2e0da899ccdfb5e2c7d142a

SHA1
6c54f9e67c89b0dfb3667e44825fb7235bfe0ce8

SHA256
20eda6846987efb3f04aeca17310cf9ce26cc23cf3f6585c8949daca18ac342c

SHA512
94bea1d6d6cf710a1fdef63d31d94c4f1e9419617b39b40a403524ce1cd00ed9ea0e648219932ad369fdaaaadaef217af05f7bc9224c0e51781fa50e0c2817f3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\background.html
Filesize
161B

MD5
e78bf3134f1002c5c63035c8a03a2c42

SHA1
2af430f1318ea9203f4ef8ec521886eb08215e17

SHA256
c8ac9fc5def2b740a7cb897b7e7f8e1e7172a351efb183007a3e4c7c4ab8aba8

SHA512
364a52cfd0e7263ca5477b6c4f3bac413e72b4a4970b5f793b31f6f1bde6cb0fbaba7c773f6cb5c43738a8dedb6d8387fd61edb4cb926a8cf0ba2b3be8ef46e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\content.js
Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\lsdb.js
Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\manifest.json
Filesize
505B

MD5
cb55de6031ed813c4ae5e18af51d1aaf

SHA1
53b3389e9eed5bca07f03a329989e984ea4820a3

SHA256
9579b04f0d8a7413b00955ba20b441a74bfa6da032fa65b50cf8d36fedebfd2e

SHA512
ef449e779847535800d856af3a0995b9dc02975480a3a82e0aff7d71e2ff6d801d946344fc987a949080089a381dd659b854f87ec8f84378e9dd8dc923d92117

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\feajjofnpnjopfnphifophojepkcpbpa\sqlite.js
Filesize
1KB

MD5
cced5800844d1f26a6b4545c9c6c365b

SHA1
c975fcac0ea84a3e94d96d6988adc923e7108fd2

SHA256
91e686fd17d70b0d5413d1407f0e36120a15b5f2b07788005a889ef5b5d8e601

SHA512
adba920fac9fc09233788ceb14a49076645679901067563f48240659d45a497e750a1d2574e10ee2800c243bc02bbaa3b90a9a6ee967c290622bf8a78ac39c25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\settings.ini
Filesize
6KB

MD5
8132ea3ca90589654176d6588609cf23

SHA1
beda38bcd2920baa6c7e5c87e46c93e91b50d3f0

SHA256
27a13b47b275e75104702e8293b1c0f39cc8082bad5f55a0f46d655235868dd8

SHA512
cc3f6d9b7b439b68fcb0fbeb3de1c6d111402c629485e36b71a8551c6f4f2f7a9792a761e5d10993f239f19ccdf1577f90574915d999799bb0c570a21a309654

Download Submit
\ProgramData\Search-NewTab\512659c9dd702.dll
Filesize
115KB

MD5
00ce3831a16a62c6d7ea4b21049e4b22

SHA1
3e48c8d25b196d67722ed20cd36bf3448a4c9136

SHA256
d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c

SHA512
7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619

Download Submit
\ProgramData\Search-NewTab\uninstall.exe
Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
\Users\Admin\AppData\Local\Temp\7zSFDB1.tmp\512659c9dd6c9.exe
Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1E6.tmp\UserInfo.dll
Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsd1E6.tmp\nsJSON.dll
Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/452-54-0x0000000075361000-0x0000000075363000-memory.dmp

Filesize
8KB

Download
memory/1656-56-0x0000000000000000-mapping.dmp

Download
memory/1656-75-0x0000000074660000-0x000000007466A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads