2ea82ede7d8635caf786448ef3c77ad9e1b404e0f0e988b272887743799c456e

Analysis

max time kernel
88s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
03/02/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8b06829c72fd9c7d7d45bd7cb26873f6.exe
Size 255KB
Sample240203-brkb9adfb7
SHA256 2ea82ede7d8635caf786448ef3c77ad9e1b404e0f0e988b272887743799c456e
MD5 8b06829c72fd9c7d7d45bd7cb26873f6
SHA1 60b69e16c7796d11caf064602ac42a1333b1b112
SHA512 554b54bba674bc4f2ffecade73711521778150005f0e0f8aa01cefeaefad21284ed4fe65287c080362ef35e59c98dca47c71dc63c2c11befba577ec97dba4579
SSDEEP 6144:h1OgDPdkBAFZWjadD4s5KhyfyIeEs0JOq:h1OgLdaOcaZ
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000600000001e595-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1456	51556d8f8aeb3.exe

Loads dropped DLL 3 IoCs

pid	Process
1456	51556d8f8aeb3.exe
1456	51556d8f8aeb3.exe
1456	51556d8f8aeb3.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000600000001e595-74.dat	upx
behavioral2/memory/1456-78-0x00000000745E0000-0x00000000745EA000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pocfahkbeinpolkcpidjlhbjnkbgdcjf\1\manifest.json	51556d8f8aeb3.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5880FB49-61BD-3203-011D-F3BFE6C02204}\ = "MagnniPic"	51556d8f8aeb3.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5880FB49-61BD-3203-011D-F3BFE6C02204}\NoExplorer = "1"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5880FB49-61BD-3203-011D-F3BFE6C02204}	51556d8f8aeb3.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000600000002320a-31.dat	nsis_installer_1
behavioral2/files/0x000600000002320a-31.dat	nsis_installer_2
behavioral2/files/0x000200000001e6ca-103.dat	nsis_installer_1
behavioral2/files/0x000200000001e6ca-103.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\ = "MagnniPic"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\MagnniPic\\51556d8f8aeea.tlb"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\InProcServer32\ThreadingModel = "Apartment"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\ProgID	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\InProcServer32	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\InProcServer32\ = "C:\\ProgramData\\MagnniPic\\51556d8f8aeea.dll"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\MagnniPic"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204}\ProgID\ = "MagnniPic.1"	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51556d8f8aeb3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51556d8f8aeb3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 1456	2316	8b06829c72fd9c7d7d45bd7cb26873f6.exe	86
PID 2316 wrote to memory of 1456	2316	8b06829c72fd9c7d7d45bd7cb26873f6.exe	86
PID 2316 wrote to memory of 1456	2316	8b06829c72fd9c7d7d45bd7cb26873f6.exe	86

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51556d8f8aeb3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{5880FB49-61BD-3203-011D-F3BFE6C02204} = "1"	51556d8f8aeb3.exe

C:\Users\Admin\AppData\Local\Temp\8b06829c72fd9c7d7d45bd7cb26873f6.exe
"C:\Users\Admin\AppData\Local\Temp\8b06829c72fd9c7d7d45bd7cb26873f6.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\51556d8f8aeb3.exe
  .\51556d8f8aeb3.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:1456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\MagnniPic\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

51556d8f8aeb3.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\51556d8f8aeb3.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

51556d8f8aeea.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\51556d8f8aeea.dll
Size 115KB
SHA256 d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c
MD5 00ce3831a16a62c6d7ea4b21049e4b22
SHA1 3e48c8d25b196d67722ed20cd36bf3448a4c9136
SHA512 7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619
SSDEEP 3072:7vEsdyJJEWrdpNOx47pJi3p1D+U5caxIC:xU+ytOx47ODC0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

51556d8f8aeea.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\51556d8f8aeea.tlb
Size 18KB
SHA256 ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f
MD5 d5980ff8eb0ef4276fad96fba8fc5018
SHA1 2cb05f8b43aa3ae2f5492f590997eec6ff808fe2
SHA512 30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c
SSDEEP 384:ix+FoLzbS7H88fU+rdHaI0qA9T1dLtFn19hXKwYw:iXbSD5s6HaI0qG1dLjvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

51556d8f8aced0.79514452.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\51556d8f8aced0.79514452.js
Size 4KB
SHA256 57adda04219ff1be0c7141ded9e0f97bb3e50589e9d912138feac977a189a237
MD5 669c0d71ce8ae0cf1d6bc73e9ab314de
SHA1 f030d7469ec35de365863c068771d0c8d67e7029
SHA512 08b4f3cc544506cdf416b35fec6e8f9c59e421fdfec4df81b98a7adf488870ef7253f3cb49f9b7488a164e0b1d0ae78497b821d73a64dd78aed7079155bd7fad
SSDEEP 96:Zh5LJxjTWgUr+Xh+vs3PWdWN0wvpjeXY7/aU7HJJ0vOa7:/NKgUGhg7qpIY7/aU70
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\background.html
Size 161B
SHA256 7226f02acd72b34e2bed5475149133a5950eaad349889074221d31814788a509
MD5 0ba96dfcf775c47fd408abbf9e66ece0
SHA1 7dd1cf44b95ab90189c7932d29163da74d9a9f1b
SHA512 a4326acb734e8c663fb23abd3e5ac2575ba9fb732245f7c52f0c6b47148b155156027957f7341730da6ad90e001d587c9f1b1f4d7b0e3e76c59734f6e6e82514
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\manifest.json
Size 501B
SHA256 14d2911f8603fe7d33b3827315b954cc28d74707d7fef8986c70361fce2546c2
MD5 1c72540eea4664957abc43a5bf88e8f6
SHA1 0d06808d78a91f83b86d0496afb1aee20b1cd33c
SHA512 606fe57c95f5adb8f55206125be17c11da933e24120dff3a14637e58f1514789b1a1be3c45db0d6032fb933acb7f929ce763e3a9131ce754a230bb87745f6541
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\pocfahkbeinpolkcpidjlhbjnkbgdcjf\sqlite.js
Size 1KB
SHA256 1a9338000a08a66174a987a0a2882796927a6d36ce27debcdc7f77ce07a0ec8d
MD5 7bb9694ba7bf4be7808941b5ff38e93a
SHA1 69f9373088977713f4c9e1e2e2dc24acadb8b1f0
SHA512 3f2eb7cecd3f4d59ae1382b238516e254a2f873e3242e2255acd288fc597bb68627c309f74364db7bc1754d65e58cdd52f9585e55a389849eea993dccfb1a23a
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\settings.ini
Size 6KB
SHA256 2923e710704e71b5df9d79e59e01114ad3584ddefbcb08e1eb3f334a2a722348
MD5 9702056cee8019ec57b9e0b69f6e46d6
SHA1 328ac1c77a756a57185be62e2df378cee4f48e9a
SHA512 84512dbdbb447ede9b90c9c6c01feb11f66c03f272012566fac7c8eb6a4cc1bf58059e1eae13db6512d139360770b861ae889f9d61bbf7662f77210d30919169
SSDEEP 192:433fz4ZvFA4xxtvFK3lvPk3iHtW8338voERE0XPI:+oPxnK35k8oGMQEREuI
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 2a61c982ec4c20bf2e28502221ce295e76ae75956fa8619fb34408aa966ff773
MD5 5cd1350ba7b8d99b56beddcb9ad61b1a
SHA1 5ce5d22930ffa6740a9b4607f17e6ad2ce4c2869
SHA512 7b91dc265f44c0e4654f293af88e0aab0e921bc631e6c17131518a6b4d27c87d546dd65c78475ed238709a307f4b451fe54779a9f200567a3c7828dde9b33aac
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 abb66d460c8d1df7d9dc9b1afcb4cd06f9fa7e654553883155cfb2a74cbe6625
MD5 e7f6c562c40dcaf9a4e0406bfde23bb6
SHA1 069c2720d097ce74cab7a350725bf244207f7c80
SHA512 7f4813390e8a76bc610bf3671f3e3c080527493651d8005d102c7a3a17534446e9920898123a07aeafdb5e7e435a75d85d3b128ac494918fe647afa1fda582b7
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 39ca39f299353f79989b7219cf1eeee8b9026ed5243a157e0d06307ff29f1824
MD5 7f9f11abd013205c40c1ab53422ec86c
SHA1 41bdfa9702d15c75baeb974b8687169703426cac
SHA512 16c4201ae6f95186a074d23c3e48473215251203494b086d715a3436bf2f12a090d48392684c696c1b79b29c59f45f0db11cdb05e67b9c6a4e7ca7e0de64ddb8
SSDEEP 192:lo3v4LCvFU235UsZkJn7ERhzehCVqkYTyac76:uv8+Cu1ZkJ4Pze0TyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 714615ad3829a64afdc9d9bded515fd1d7654800cb8659167ea3c4cd1fa53da4
MD5 2ae2ee7b36a9ed40069bffbea8619f88
SHA1 5c731e965bbe0b9ec57655b9c0f1a282da022755
SHA512 91c01c70f14761f7dae385f40def94aafbd83081eafd18dbc733a00c9952f0de10a7ac2630f6d270e08f5a78efe4a0410094bd979d2b3cb0e631e30e15ef34fd
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS4045.tmp\[email protected]\install.rdf
Size 604B
SHA256 4606309c7623d128ac35b9ec551fe75ec1147c3f487aedebb21ff953bc768bc5
MD5 f68385a0386928aa6f8bffcd2d53fcf6
SHA1 4a62322be5c84269ab71952c5b570c95a9d03169
SHA512 e28dd940f2ada2b580b06f82c2b818bc04829f21a0edc6965f121480d3d6fa3ec0c3ca092f5c78f342e623ca72a53f23540f0aa94d2d1d2b24bb2736f19891da
MD5 SHA1 SHA512

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsd4150.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1456-78-0x00000000745E0000-0x00000000745EA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads