4fff76415eb67091731b6118f6970441d8274d94fcfd2bceeb6c40f3ef5bfc8a

Analysis

max time kernel
119s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 08:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e8b5559ada01565c7c8dfab35d9e15e.exe
Size

249KB
MD5

5e8b5559ada01565c7c8dfab35d9e15e
SHA1

08e33cd8ec655e1e4fe5fee3e710a4271b811aea
SHA256

4fff76415eb67091731b6118f6970441d8274d94fcfd2bceeb6c40f3ef5bfc8a
SHA512

032ca81487f85d976f6f5b1864d7e1f4c2039da9d8bbf45718d41e5af76b1f101a57ac0f6ab22f9cbb1f17726afe5fb95b522cf37022cb6214e16afc65ab32ab
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5K5NlcGEGpGXo6zIFrMgLN5o:h1OgLdaOkNlc6d+Tgp5o

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0005000000019597-77.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2728	50e68dcbe259e.exe

Loads dropped DLL 5 IoCs

pid	Process
2288	5e8b5559ada01565c7c8dfab35d9e15e.exe
2728	50e68dcbe259e.exe
2728	50e68dcbe259e.exe
2728	50e68dcbe259e.exe
2728	50e68dcbe259e.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019597-77.dat	upx
behavioral1/memory/2728-80-0x00000000748F0000-0x00000000748FA000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jjpebcfipadjmonbkepgmmhgdcmpfcpf\1\manifest.json	50e68dcbe259e.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\ = "Zoomex"	50e68dcbe259e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\NoExplorer = "1"	50e68dcbe259e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000018b75-30.dat	nsis_installer_1
behavioral1/files/0x0006000000018b75-30.dat	nsis_installer_2
behavioral1/files/0x000500000001959f-100.dat	nsis_installer_1
behavioral1/files/0x000500000001959f-100.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\InProcServer32\ThreadingModel = "Apartment"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Zoomex\\50e68dcbe25d7.tlb"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\InProcServer32	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\ProgID\ = "Zoomex.1"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Zoomex"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\ = "Zoomex"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\ProgID	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e68dcbe259e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB}\InProcServer32\ = "C:\\ProgramData\\Zoomex\\50e68dcbe25d7.dll"	50e68dcbe259e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28
PID 2288 wrote to memory of 2728	2288	5e8b5559ada01565c7c8dfab35d9e15e.exe	28

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50e68dcbe259e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{5FD3C1C8-1BB1-7F60-86B8-FABE2DCB6DCB} = "1"	50e68dcbe259e.exe

C:\Users\Admin\AppData\Local\Temp\5e8b5559ada01565c7c8dfab35d9e15e.exe
"C:\Users\Admin\AppData\Local\Temp\5e8b5559ada01565c7c8dfab35d9e15e.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\50e68dcbe259e.exe
  .\50e68dcbe259e.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Zoomex\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
68990e5e625bc2e364cb9616e4767c45

SHA1
53392ad62c7a57c650947a7ca308fd5b14d5fc94

SHA256
cb3dc2d8ea875a96c86f91f3118477918d617a8163b2a75f19dde559f885af8b

SHA512
6b7614c02ce8bd65bfe03b2738f0912fdfca8fd947c2cb0a396661cb5c7bcc6d57e694d5e83191e9045634317f67cb29620f04ea2498ff23598b367142d89f96

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
43f5a75677b5f14aee4cd92910ed67db

SHA1
709b91cb33a5abbc533748785053e6149fb76f88

SHA256
9ac23fb791733f87ce5e9512d19c50e6458008c40238a08c0e053e76d2594532

SHA512
a5a4c5d65da033ee64562fd712d70c336278652c5cf5d90bbaa99a40f12200cf6ca5593f4e4938eeab5519b22af73eb93faff489662f0044751417f0cd76ba71

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
09129a04b19792b0074d0c09fa728c2b

SHA1
1def8eee2dc7cd87a81140dc8a502df057a960ec

SHA256
e6e6101aae739908d8d06b8903ff7519956637bca3737d49638abda3593eea9d

SHA512
f93d659063ae86dbc37eb8d465c99d289a8c542ec839e706bcda4ed5b48610af117de4ef705e58824fcf48f5dd033de8e9d47db8791b66e379c3e2fa40fdafcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
ee9deaf055f4ca34decffa160eeae80d

SHA1
849d586c1a08f85f454212a8754113a3a68fc5d4

SHA256
d592534b70c46723d5a69ee10151e8b5942e38d87bd77f517a7ce46d25c98dc2

SHA512
bbafcbfa889e7f459203b75a1fd2a792ece0c1e956f4bd34debfd0ec342b18761f68fe150cee0b4839cd5b6bd52edbaae7d61f15de6915aea238a15eb290fd0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\[email protected]\install.rdf

Filesize
700B

MD5
642763e5f4b96fbbb31a7dcac2de2a6d

SHA1
51d27a4bb6fbd79ba3b6bb8535a92bd65fcbfca1

SHA256
bea0cade66d49b87f82b355072fc6c0e61f687d760931215afabf5dcff994780

SHA512
502a3a4e6b4ca601d4c7641344426ea7e15ba564894a394a62c50f7cab2f47d996189dce00f55b30859aa585521b719632ae71684cc08ea055770f0110529244

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\50e68dcbe25d7.dll

Filesize
115KB

MD5
6696822add17061dc0bb8ee5b42cc2d4

SHA1
d4622558ba366f2f94560da301a81c6c16f95a3c

SHA256
73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125

SHA512
0f1946ce002441d010f67156f67b9d18e01ba35edfeb66ce8096467d3126b547e5040032253275b173f2dba9bce983775f360d83ec026986b55cb85e4b63f099

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\50e68dcbe25d7.tlb

Filesize
2KB

MD5
096a65b8a695249d5d554776f1eeace3

SHA1
2f2506b886a59b4408b23653d8734004ec2dda6d

SHA256
a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568

SHA512
6e832caff1951b4fdb489997af5736fdbafa1de5573f629fc6798666bffd0ca0715311ce6590202cc970cce4492d94994a588547bb579bf70bc264683bc45cdc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\50e68dcbe23b08.68135455.js

Filesize
4KB

MD5
e7d16a3281bbf7d2c22c91e43d95e7d6

SHA1
4c9aea62938fe6aa2e21872824d609591c76ddf6

SHA256
2c66900622d13bc32314e65bf8b2c6817913b8326e4bda49c02b38117e6bedbe

SHA512
06de4ee090a56f532a12a598c2b3b50fe2fcd8f94f6589ec96ce4dba5001aa02ab054cdcc7cfe693391d7c5fe35c74889c444de33ccc159d23095bab7441a661

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\background.html

Filesize
161B

MD5
15522f84c69f263f3a8c8be60c5279d6

SHA1
b462b083af3f13c54751f24115720337b8da1bea

SHA256
eab1a6fcbac1e29a475c801be24c762bbc1d61ad22d44a3f15870754f0cb77eb

SHA512
da4fe681a0fb5b31fc4b59bceb9af577963490adbcbe3a869b5eeb8f77adf55090b003b3fc8df4f3fa4f08002c34560a44be974f66b2e24e6bd0c94ea14c5ff9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\manifest.json

Filesize
475B

MD5
95b6b9aa3a3730d6d373a68eb5b411c9

SHA1
05cc71bfa2d2a2a18e169def790cca29f757dd3e

SHA256
5ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e

SHA512
5a178056071d0c94d2cfdf72a60403fbf9703cc28abe560f1f04fc2e073188f595c6bb3b687c7e2654899e103a229fe123c41af8aebbe189c9854ed71d8c672e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\jjpebcfipadjmonbkepgmmhgdcmpfcpf\sqlite.js

Filesize
1KB

MD5
faf6ed59ddce12055abb63fbd1f3697d

SHA1
3a9cdcaf7f117ae1f2dd9859fca368203ff744b3

SHA256
621b1cae251f5ba23618b328173a9f7a1104081887434d0682e79f08f7ef8104

SHA512
4896fd977cf1a0644f221102ec1b35101fa3b1822ed78c628042330a7a1ba5e817a3f277cca9555d3026ea1d83fc8bf93741c2b3078969fadbe33d32f2fa8937

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\settings.ini

Filesize
7KB

MD5
584ccf861b4523c98aac5eb83fef6967

SHA1
97a9223293b9c3cf213ba82160811001c5c1a7cb

SHA256
885a5e03c8f2b720704c533ebd1a514a78b262f1d7dd62483ca66373b99e43aa

SHA512
c08799d29114b9c63f095b850df3cde3b9e3a3f42faf1f0282ffb44926a5e4afa1642c063bef5824b10de3181b587ee1c74277c7489cbff8ccb6d6ad48424b9b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7F8C.tmp\50e68dcbe259e.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E4.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nst80E4.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2728-80-0x00000000748F0000-0x00000000748FA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads