584c8cebd10c8c65ba296ca76e8008fb24c708690a5af3d55d384e9fd5ca768b

Analysis

max time kernel
118s
max time network
118s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
21/03/2024, 03:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
$PLUGINSDIR/bundle.exe
Size 1.4MB
Sample240321-ejenksbd37
SHA256 c919043ac844a08523b83e22071824de50998307b11e719503d08cf2d532f847
MD5 2d1a8fe877c2c3a251d9b064438fa132
SHA1 af6eed972b2c3d819c20b1cca83b91b1819fb4f5
SHA512 86d57ba82c93a1dea122b993b9f735cbf080efc6ce8bdea76f4585edc39a936ca043c05123976c15d5a9edaa6a55d0888fbf6434f2fea5c2d4e9eae30434f24d
SSDEEP 24576:GPOaKA8LjZ6hD2La+5mPIalInV/CpGkL7QB2BSAVv+6GsB93xXvAwsj6DQM71Wnw:Q8YWaDwae/oGi722QAVv+TsBDvArj68M
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery evasion spyware stealer trojan

Malware Config

Signatures

Executes dropped EXE 6 IoCs

pid	Process
2504	MyBabylonTB.exe
2932	Setup.exe
1824	MainInstaller.exe
924	Setup.exe
1640	PingMe.exe
2076	PingMe.exe

Loads dropped DLL 17 IoCs

pid	Process
2876	bundle.exe
2876	bundle.exe
2504	MyBabylonTB.exe
2820	rundll32.exe
2820	rundll32.exe
2820	rundll32.exe
2820	rundll32.exe
2932	Setup.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2128	rundll32.exe
2876	bundle.exe
1824	MainInstaller.exe
924	Setup.exe
1824	MainInstaller.exe
2876	bundle.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	rundll32.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "C:\\Program Files (x86)\\2YourFace\\bho.dll"	Setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\NoExplorer = "1"	Setup.exe

Drops file in Program Files directory 13 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\skin\overlay.css	Setup.exe
File created	C:\Program Files (x86)\2YourFace\uninst.exe	Setup.exe
File created	C:\Program Files (x86)\2YourFace\bho.dll	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\install.rdf	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\content\ff-overlay.js	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\locale\en-US\overlay.properties	Setup.exe
File created	C:\Program Files (x86)\2YourFace\2YourFace.crx	Setup.exe
File created	C:\Program Files (x86)\2YourFace\FF8Installer.exe	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\defaults\preferences\prefs.js	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome.manifest	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\content\ff-overlay.xul	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\content\overlay.js	Setup.exe
File created	C:\Program Files (x86)\2YourFace\ffextension\chrome\locale\en-US\overlay.dtd	Setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral9/files/0x0006000000014588-213.dat	nsis_installer_1
behavioral9/files/0x0006000000014588-213.dat	nsis_installer_2
behavioral9/files/0x000600000001221d-220.dat	nsis_installer_1
behavioral9/files/0x000600000001221d-220.dat	nsis_installer_2

Modifies Internet Explorer settings 1 TTPs 12 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\User Preferences	Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\User Preferences\88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 = 01000000d08c9ddf0115d1118c7a00c04fc297eb010000009b106788dea7af4d98683a8983feb7c6000000000200000000001066000000010000200000002c682cf1b7db93adbaa1f3eeeed540abca8d2c268c70d98b0ae010a338baabbc000000000e8000000002000020000000fc93d27b6a786022363d394cbecc5a1011fe125289455e1b98c25081c19bf80c50000000a5c86a425ceb993ebf658c3bca2cf87486c299b51f18bed9cdd8126f517c333bc6e9f8481dd505d2ec058e7dcaf92f078ad174e2a5271e289b9fe7d94efdbd0e8dbd46f696a50c37085245d755a90c9b40000000aa54676ed12f2ad3269b999a55ec699844f003d402fd94920bdb5043c197c1e9072757b5af7734985491775509f9d9859093a0d2acc80e32346358a264f30032	Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID=\|URI="	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\DisplayName = "Search the web (Babylon)"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\SuggestionsURLFallback = "http://api.bing.com/qsml.aspx?query={searchTerms}&maxwidth={ie:maxWidth}&rowheight={ie:rowHeight}&sectionHeight={ie:sectionHeight}&FORM=IE11SS&market={language}"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\URL = "http://search.babylon.com/?q={searchTerms}&affID=109035&babsrc=SP_ss&mntrId=0a614580000000000000f2ef6e19f123"	Setup.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPageShow = "1"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\SearchScopes\DefaultScope = "{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}"	Setup.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\IECookies = "\|affilID=\|trkInfo=\|visitorID="	rundll32.exe

Modifies Internet Explorer start page 1 TTPs 1 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://search.babylon.com/?affID=109035&babsrc=HP_ss&mntrId=0a614580000000000000f2ef6e19f123"	Setup.exe

Modifies registry class 9 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ThreadingModel = "Apartment"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Prod.cap	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32\ = "C:\\Program Files (x86)\\2YourFace\\bho.dll"	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Prod.cap\Info = 433f39789c636262604903622146b36a434b6767175713035d0343134b5d130337435d476343635d7303130b13275313571763e35a06010101e628154100172e0a2b	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}	Setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\ = "2YourFace Addon"	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1185823F-F22F-4027-80E5-4F68ACD5DE5E}\InProcServer32	Setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Test.cap	Setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\TEST.CAP	Setup.exe

Modifies system certificate store 2 TTPs 4 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b812000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b810b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb57485053000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b060105050703030f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	Setup.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce09000000010000002a000000302806082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030353000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c01400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e000000740068006100770074006500000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68	Setup.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2932	Setup.exe
2932	Setup.exe
2932	Setup.exe
2932	Setup.exe
2932	Setup.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	2932	Setup.exe
Token: SeTakeOwnershipPrivilege	2932	Setup.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2876 wrote to memory of 2504	2876	bundle.exe	28
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2504 wrote to memory of 2932	2504	MyBabylonTB.exe	29
PID 2820 wrote to memory of 2576	2820	rundll32.exe	31
PID 2820 wrote to memory of 2576	2820	rundll32.exe	31
PID 2820 wrote to memory of 2576	2820	rundll32.exe	31
PID 2820 wrote to memory of 2576	2820	rundll32.exe	31
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 2876 wrote to memory of 1824	2876	bundle.exe	34
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 924	1824	MainInstaller.exe	35
PID 1824 wrote to memory of 1640	1824	MainInstaller.exe	36
PID 1824 wrote to memory of 1640	1824	MainInstaller.exe	36
PID 1824 wrote to memory of 1640	1824	MainInstaller.exe	36
PID 1824 wrote to memory of 1640	1824	MainInstaller.exe	36
PID 2876 wrote to memory of 2076	2876	bundle.exe	37
PID 2876 wrote to memory of 2076	2876	bundle.exe	37
PID 2876 wrote to memory of 2076	2876	bundle.exe	37
PID 2876 wrote to memory of 2076	2876	bundle.exe	37

C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe
"C:\Users\Admin\AppData\Local\Temp\$PLUGINSDIR\bundle.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Users\Admin\AppData\Local\Temp\MyBabylonTB.exe
  C:\Users\Admin\AppData\Local\Temp\\MyBabylonTB.exe /aflt=babsst /babTrack="affID=109035" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds -notb
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Setup.exe" /aflt=babsst /babTrack="affID=109035" /srcExt=ss /instlRef=sst /S /mhp /mnt /mds -notb
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Modifies Internet Explorer settings
    - Modifies Internet Explorer start page
    - Modifies registry class
    - Modifies system certificate store
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2932
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1E8B03~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache URI|http://babylon.com
      4⤵
      Loads dropped DLL
      Checks whether UAC is enabled
      Modifies Internet Explorer settings
      Suspicious use of WriteProcessMemory
      PID:2820
    - - C:\Program Files (x86)\Internet Explorer\IELowutil.exe
        
        "C:\Program Files (x86)\Internet Explorer\IELowutil.exe" -embedding
        5⤵
        
        PID:2576
  - - C:\Windows\SysWOW64\rundll32.exe
      C:\Windows\SysWOW64\\rundll32.exe C:\Users\Admin\AppData\Local\Temp\1E8B03~1\IECOOK~1.DLL,UpdateProtectedModeCookieCache trkInfo|http://babylon.com
      4⤵
      Loads dropped DLL
      Modifies Internet Explorer settings
      PID:2128
- C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe
  C:\Users\Admin\AppData\Local\Temp\MainInstaller.exe /PID=104 /SUB= /NOTIFY=0 /FFP=0 /SILENT=1
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1824
- - C:\Users\Admin\AppData\Local\Temp\Setup.exe
    C:\Users\Admin\AppData\Local\Temp\Setup.exe /PID=104 /NOTIFY=0 /FFR=1 /FFP=0 /S
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Drops file in Program Files directory
    - Modifies registry class
    PID:924
- - C:\Users\Admin\AppData\Local\Temp\PingMe.exe
    "C:\Users\Admin\AppData\Local\Temp\PingMe.exe" http://www.outbrowse.com/install.php?publisher=104&bundle=2YourFace&product=2YourFace&status=0
    3⤵
    - Executes dropped EXE
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\PingMe.exe
  "C:\Users\Admin\AppData\Local\Temp\PingMe.exe" http://www.outbrowse.com/install.php?publisher=104&bundle=2YourFace&product=Babylon&status=
  2⤵
  - Executes dropped EXE
  PID:2076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015
Size 67KB
SHA256 b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
MD5 753df6889fd7410a2e9fe333da83a429
SHA1 3c425f16e8267186061dd48ac1c77c122962456e
SHA512 9d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
SSDEEP 1536:4vHkVfDISE//aDY0WAXTF+0daIpyFQaqPZkatNjgkFOE4/JZZWnEn6:4vHKfMSeKFXdBcmnXkksE40E6
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup2.zpb

Path C:\Users\Admin\AppData\Local\Babylon\Setup\Setup2.zpb
Size 3KB
SHA256 d49ec47f5d27a09a17e00a6eb78f49a761c9f5881ec81fb07cc49fd0a5f287b2
MD5 5e6230b3b16798e23720958756ac6d9e
SHA1 c7bcb001c48a67d4c9d6e70e92473ebd85b30585
SHA512 6b1c132f0e4fc2ca6b5e8d807671c586d84e044e4db8380682fd4d071160177c0f7e7a6afae3ee74a4fbd5c65aca0c0876948f5a42deafdbb685c5b7989b5aae
MD5 SHA1 SHA512

Submit Download

BExternal.dll

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\BExternal.dll
Size 126KB
SHA256 fcee9d5c80b11b82add301e142dea2b40b05f0839ef7cd0a8b0fff84a67eccd0
MD5 743acbf54eb091066be6ab3cb12c5988
SHA1 43a205985790c47a7e611fa2d3cab9b4eb59121f
SHA512 014cf6b9896a2f76b8d110bce862c46a56471ae74582cbae7af672af49ae052d7827fc28806dbe80c911d05c4688d7e08ef486bc7d7acc2b05fa7b2b3f2a3689
SSDEEP 1536:ipquadh0SvYmLlegRTgcRigdn32EFt6vKGNUvMGcBpYyEPf1cM5KMn+WCb4:ipquG6CNTydq2EFtekcvQF5KM+W3
MD5 SHA1 SHA512 SSDEEP

Submit Download

BabyTBConf.ini

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\BabyTBConf.ini
Size 578B
SHA256 3ba4e8ea9fdd053ddb21e2e2683a86c93bc7545fa626466ebe74994efcf1d212
MD5 19de5789de5dad1316fa20e4fa190818
SHA1 83ca35188c111c8e25644285dd73df7e1299abb9
SHA512 241a3f36c719d19a15cc049e39f17fab9ac64254403c183b62700b48035be0d8c8a6d6f440ed407c3571da9948cc61d575d84baf4b42b13720bdc37c95089f4e
MD5 SHA1 SHA512

Submit Download

Babylon.dat

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Babylon.dat
Size 12KB
SHA256 7029ed42440ab0b23c76c2800871002151776f927cc77855590e79b31b96838c
MD5 adbb6a655ae518830ba1afefdb84668f
SHA1 a1be53d99a67fff011ea035c310588e635c718e1
SHA512 b5ddfa301fdcd852a35c6b8a5d4eed78c43bc250d7e2c7d95b548d5f5ce216f2b9f5eabf5e1c0c87691d735fc1ac7a33a5c236c5560a4777ef7bf75510f0b228
SSDEEP 192:IDqG5umjGVILJ7hzEJboFI1BI1x7RQ1EGqoEie/XeS8k0oP0dNdNhkAU0RSB2rBe:fG8m3JyJb71C1x7RQqu+0RSll
MD5 SHA1 SHA512 SSDEEP

Submit Download

blueStar.png

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\blueStar.png
Size 14KB
SHA256 008aebc73a7bd79e914db753b83a385c1aac320ebbcf4ead8fa49f74e3f30f22
MD5 a7fcdf142648bac756fcfe06a31f42e4
SHA1 4df99b119c183c821ed1bf0f825536318c9c3353
SHA512 ddd8571b02909ede720af8e27044e126002a749719f41fe65d44004a5165ebfd90e5cca007e6014194de510a0076862839ecd056bf0043113337ab25086037eb
SSDEEP 384:zJXE050VuGbvjS42rJemPNStj1ulEMWr/5ehSN1/IqCme7YB:R350YGbvUrJ8tpulEbMhSN1InxMB
MD5 SHA1 SHA512 SSDEEP

Submit Download

eula.html

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\eula.html
Size 79KB
SHA256 f7f4148b58242a889a8694d734e49ca96bdad63d7fa5d5be130acfa9414b5cb5
MD5 1b73a781f7f5b0d61624bd97050a2ed0
SHA1 01b848625761d5dede115e8599e4c72f126f8a3c
SHA512 76eb4cd01eae14b0050802ad4cd0e401e2e65705d4d4b8c25e3632bd24745ec85df129c51332500823953755314a51907f0a713d0c2011054490acebc9c2787f
SSDEEP 1536:nStK805SVSAWxAskeTWAz2Tkk/IfjfXUOh+dNNTTdK+pX4rpBsnPi/oWXWNe:FSVSAuHGLNTTA+eHGi/7mw
MD5 SHA1 SHA512 SSDEEP

Submit Download

globe.png

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\globe.png
Size 33KB
SHA256 3eca21891a2b484a38098410c5d8410361e91ae4dd84cb565891281145501f42
MD5 cc53fb9e9456eb79479151090cb16cbd
SHA1 e61004bf729757f3f225f77f0236b82518f68662
SHA512 0aac27727044ef9cf05e7a8d35d4395c9812a9169fd1661f95f53a2d809a7a73a034058b8080529ab50471688877cfdb45a282308ef86eb4812a2d734e02d28b
SSDEEP 768:F35NZLZpn6oGsqxyU71U/Oa7+TqxuNKUX5ew/7qcVm:HFRURaOa7++4NDeomcVm
MD5 SHA1 SHA512 SSDEEP

Submit Download

options.js

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\options.js
Size 119B
SHA256 92db8b549583a5498689a42840a282f33d734c3cb081ac6f896377e56d043252
MD5 771f230f8bbc96a03b13976667918f1f
SHA1 0fba422c76b89cdb5d12e657064c49a9b1b7abae
SHA512 b8209b679f30fea49ea34b77b7f4126acef962a17b292cbab711660c7ec23646bab91e66ce49fde6570ee3c053bb6b8d521b6917cb16f3e925ce8f82d7b4c8f4
MD5 SHA1 SHA512

Submit Download

pBar.gif

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\pBar.gif
Size 3KB
SHA256 e512d5b772fef448f724767662e3a6374230157e35cab6f4226496acc7aa7ad3
MD5 26621cb27bbc94f6bab3561791ac013b
SHA1 4010a489350cf59fd8f36f8e59b53e724c49cc5b
SHA512 9a19e8f233113519b22d9f3b205f2a3c1b59669a0431a5c3ef6d7ed66882b93c8582f3baa13df4647bcc265d19f7c6543758623044315105479d2533b11f92c6
MD5 SHA1 SHA512

Submit Download

page0.html

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page0.html
Size 1KB
SHA256 783a0e39d4a751462e26e4acfcf6fb4953f818980ad3d7d7fb821ac35c00c29f
MD5 cf33120dd42cee842d96532843bb1961
SHA1 1db4f3e0aa1e4036a078a05f48fefdbb8744e3cf
SHA512 889d4043672b551a08979054add55bca4c5a4438fef5189b1ecf309c803ff1468664ed1123b0d22ceecb21a7bc5cfbf85a7428ed72ad7be04596185432aa68e3
MD5 SHA1 SHA512

Submit Download

page2.css

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page2.css
Size 2KB
SHA256 9ca3bd0f0c3ac1533fcda2e20e2fb3c18deb40986b37ae6edff594becb82405d
MD5 085cf46c4d1c8dea9edd79ee37d6d5bd
SHA1 30cb66994c45261a4aaa6d9ecdf1b1890ed09b45
SHA512 66ea917206a7e771e48e3734004e6b96619c5534cca35c2e59e7c2922bec7dca5fbb6536e8940013871becce7493b0e2b1844cc5f37668396639c6d7c7e321a9
MD5 SHA1 SHA512

Submit Download

page2.html

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page2.html
Size 3KB
SHA256 abb8953ffc3818e54e86019e1920595d65ba0997f3fd7fd47480a450cd7ee485
MD5 12152ded3604e8baaf82c078f8034d60
SHA1 0867dec241a257e3e9ad9e8d20b9e06e3bce7184
SHA512 a38ed7d7ef0be98ef362b4f5345961ac56f2db9e184b8a405dd3b09611796fda2189837a3bc0c27152276225a2fd4c8bfe8324c70df0d67b9cc826212448e79b
MD5 SHA1 SHA512

Submit Download

page2Lrg.css

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page2Lrg.css
Size 1KB
SHA256 5d7bd6b3acb31788f12475528d51d98778f1dbc940b2d6dc6317704d17d0964d
MD5 db15b568f9d195635b3fcab87ef6293f
SHA1 6ae0f374531cb3013857880e8469a103492b8393
SHA512 a8d2baf03d85e31847b21ee5c193d11e2f7ccd9ed7630feab3c8e4fe780bc62d1847ff4608654b3201fa6c39175c7d6e650163d9347db40454935856af3f7af7
MD5 SHA1 SHA512

Submit Download

page3.css

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page3.css
Size 1KB
SHA256 226a67f6e05fd889f91253158e583c443cbc7c27d29e8b441925849f820565cf
MD5 07784ad77f30fa018949e412b2257aab
SHA1 8595c222a3741bfa83c5a4d982c845c8038062a6
SHA512 2fe022c30d9280f224ca159edf485ca7ba870bd32b7fb82ee86b3657cdd2e9bdf52525408566ec3ecff80660390f8fac8f04b166623082c706213597f1178cf8
MD5 SHA1 SHA512

Submit Download

page3.html

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page3.html
Size 1KB
SHA256 7f2252432fff22505b6fbcce5077a9f455006f724dfa705fbc0540325a14c28c
MD5 b23c25988099403433efb7fb64715676
SHA1 e833527e1c021b311286e6e2d1c2f0530be0a565
SHA512 8f721e25e47fc5508a0ae1d887a556c22b64b9eb4d2a7ad019b0ddbe4c91649ca52c4582e3cf99338f4b779bd50832110054c46e9bf9f2ffc9a4469343f6838f
MD5 SHA1 SHA512

Submit Download

page3Lrg.css

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\page3Lrg.css
Size 977B
SHA256 74a9e635dc555a07820a288d0dfe05adea386292757f4cd6933ba3ce6697bef6
MD5 b3520c555c46a7020d8f27bfe81df0ca
SHA1 59398086abe3987c2a91edacb74eca94bbd63d7d
SHA512 0b3243cd84b44be79cc7d45a1e18d9840cb393aaf0b82229a0e5a4378d4588c1d65f1ba80530fa10659777fa6ca7b45785fe4fd4aff8dc6047956f93299c5ca5
MD5 SHA1 SHA512

Submit Download

progress.png

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\progress.png
Size 2KB
SHA256 eb7dbbb4b7f4020a91f5b64084fb3ce08aeac2f72be66959332041ed06b59bf5
MD5 dee08d8cbcdeb8013adf28ecf150aaf3
SHA1 c61cd9b1bd0127244b9d311f493fc514aa5c08d6
SHA512 c7ff9e00e5afd3b14947006127c912a3c0e7e7fbdde558f5575e6499deb27eb39199206497bfa4372ce469a0fac64df03ec165c0565a619774531c7311d3223f
MD5 SHA1 SHA512

Submit Download

setup.js

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\setup.js
Size 13KB
SHA256 01d6d025c169e9c36600d097749f76f8e877846cd8733b7dd958aaea7c54884c
MD5 a95607ce49fa0af8ed7a3f5667c3eb31
SHA1 5e4b5a30e56c42329afdf216625bf35be69a82aa
SHA512 1f1fe95c04964de2f3fd73a7ba1632fecaf1c9ec80f918859eb91702e10333f1ba0342a85d1129ddb48cbc3ab74a5dcf92f8c4c053f683ecdbf34dee0112015b
SSDEEP 192:3RROrafaiapTmZAKWgGDko9MabtX44fQVJ8PDcuphnMx7plvJweWva71iwi0:3HKKagGDAaJXmyQu3nMgJa71iwi0
MD5 SHA1 SHA512 SSDEEP

Submit Download

title.png

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\title.png
Size 25KB
SHA256 4be568ed2044e1b74bc1d61d13ce71080e5a9717ed481616a6efc1ec4c35dd0c
MD5 12ef76069cc40b8ad478d9091915ded6
SHA1 fabad560b6e6839f9e5ae1268695d11ca35f9d74
SHA512 5625082a87aa75266c9680a4f4b31eb7b1df084bba6c7e2e70512f232556f9029af06a0a63b342ffc220bf3797cc09f333437fe26547ea6494913f1c59b2e067
SSDEEP 768:K35B8qDoa0mq6RGWU/RLVVNuzIxdnsjPTM2OdF52jmuD:rsF0mq6R376dcsd7uD
MD5 SHA1 SHA512 SSDEEP

Submit Download

toolBar.jpg

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\HtmlScreens\toolBar.jpg
Size 19KB
SHA256 bc488502223b3369dd657e8bac70abc42ffde2223a0661fb507c8ec87778bca1
MD5 56dc3cb42b46309e642c15167003685d
SHA1 045749de2c1492e5dfc4c44f9eb6c0feefe06b3d
SHA512 5f3dc868d6e128407e071d6d7d7b9d0bbe7e45a32ff76985dfa53fe9dad0f5fb372ce64d35170c3719a06dd6762e4bb33089bfaedf93e6064c06c74a21b65a60
SSDEEP 384:aaKcRQnEF4TYNg7N0UVsUBjj/iOIWlZ8knwH:aapQEMYyR0UVF/vrlZ8ko
MD5 SHA1 SHA512 SSDEEP

Submit Download

kstp.txt

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Latest\kstp.txt
Size 1B
SHA256 6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b
MD5 c4ca4238a0b923820dcc509a6f75849b
SHA1 356a192b7913b04c54574d18c28d46e6395428ab
SHA512 4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a
MD5 SHA1 SHA512

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Latest\setup.exe
Size 8KB
SHA256 726b0e7e515f7bd62c912b094fa95c7c2285a44e03d264f5dd9e70729c0e9606
MD5 5790a04f78c61c3caea7ddd6f01829d2
SHA1 9d783d964338a5378280dd3c3b72519d11f73ffa
SHA512 9134fc02095e313fcb528fa32c8534929fddfb7b7b139a829f2b3eb32cd4c606f6d2ec6dff57a890ea250ce1430eb272461accfe05164bd4cfa496c0a1474ad0
SSDEEP 96:TvYfTLHRm6VMp8PS5JTMNF4m1AcFM8S6Y3+IsONTv2e6BL:TvY+8PS5JwHV1Te8S6YW6Tv2e6
MD5 SHA1 SHA512 SSDEEP

Submit Download

SetupStrings.dat

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\SetupStrings.dat
Size 63KB
SHA256 31fdb44bc58ee37f01712c2e9b5f0f7c29058a6cd7f869df2f0ee6d77a552dc2
MD5 07bb1523dc51ec1fd5913b0a70ab98ee
SHA1 216f853cb251f32f5c91345404efd48f041ad5bd
SHA512 8ae9b6ca8a6e6f9692161422b5815944a7ef6e74ff51dbfd9a0dee83828b1140ce399fc40765313e6d2657603731bdd1c791b56df07fe42fb2d152b584d922db
SSDEEP 1536:vNaQXL26BOn4RboOcUMPFha4Q/7diCrpeRmR8:FaQXK6BUuP4PnivfK
MD5 SHA1 SHA512 SSDEEP

Submit Download

bab033.tbinst.dat

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\bab033.tbinst.dat
Size 236B
SHA256 1368324e8df1654fb9c3bcae320e982ff9f40e76e0cc118d5f507649e1ec2f2e
MD5 1ee8c638e49ee7137607722768afc5a2
SHA1 8719d7a498a49b042cd6fc411cac6c44f3c0f43a
SHA512 2acb5547bb9b62505a5332e3b2752c5004fee9579bc45c46271e53d42fff5f412f3a18863ed382052d961d33d0e0449d9c111950060663660d7dbb21e9bff575
MD5 SHA1 SHA512

Submit Download

bab091.norecovericon.dat

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\bab091.norecovericon.dat
Size 174B
SHA256 e58ea352c050e6353fb5b4fa32a97800298c1603489d3b47794509af6c89ec4c
MD5 4f6e1fdbef102cdbd379fdac550b9f48
SHA1 5da6ee5b88a4040c80e5269e0cd2b0880b20659c
SHA512 54efc9bde44f332932a97396e59eca5b6ea1ac72f929ccffa1bdab96dc3ae8d61e126adbd26d12d0bc83141cee03b24ad2bada411230c4708b7a9ae9c60aecbe
MD5 SHA1 SHA512

Submit Download

sign

Path C:\Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\sign
Size 80KB
SHA256 9fb7ed24ed57aebd1314119ad70fee1d74c614bfd3c8fcc85716797803de8878
MD5 73dbc500e121b83ec57bb2563203259a
SHA1 658adac13fc362f5292cbbda19ade1d228ff7901
SHA512 c5fd20a4d90f16c147e02afc82b477054b3bfa8d321017f32f99606febc076bed86b249f372779c3582f8a3de859b8d3998b0bdbc873953d9e5e15b552fafc2f
SSDEEP 96:od4dV5d7LzdgddFT9ZHt+Tfy06PY+CQZebcKd4dV5d7HdgdAeuKqIdE5/NBHsJ20:z+9ZHwa06Q+5p9JHQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

IECOOK~1.DLL

Path C:\Users\Admin\AppData\Local\Temp\1E8B03~1\IECOOK~1.DLL
Size 5KB
SHA256 ccba25e2b6462f5f5646ab9c2e1f63a941b1ab7911d3e0a32a29ebb65cbda437
MD5 5a27c8702510d0b6c698163053fde6d1
SHA1 69fdc602a51e52c603f23a80e9b087c262dce940
SHA512 ecf38339ff38b601509a1f5aee16cd0ee7c70662940a81f45e18f91581a8b2964129603b47606f762b371245b039d4faa91b30cff125d46d32253a0e88401e51
SSDEEP 48:q6GliEa/CNqt5kZqfBRR5I1kXB1X6cLsSStJvuHlDUlIvRCSCdCw:IoKMDksZRU1kR1Kc4SSLvuhUlI5Ct
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar69D.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar69D.tmp
Size 175KB
SHA256 a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
MD5 dd73cead4b93366cf3465c8cd32e2796
SHA1 74546226dfe9ceb8184651e920d1dbfb432b314e
SHA512 ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
SSDEEP 1536:DAuJ+lCUsTRvsqgCyqWlUDNWdm1wpSru2A0XwjY/z02DTr3rmt6mr:D9J+qTR0XCy/dmASru2Aijbd0
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path \Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\Setup.exe
Size 1.7MB
SHA256 6e7425ace83127aa18a94927144f3d97870f7395606285606635c3ae591f1b52
MD5 14c2d4576d528ed76fada4f4fa1a5952
SHA1 3a9d7d4639b5eb8bec42df972c44493690eaadfc
SHA512 15c32a49946429e15ff8a8e4293d2ccccd160c43c24d3b6f9ccb0373f3dfb666e3c04c062feecc5dd6415f44c7230a09f0cc423aed601a121c2afec28d772558
SSDEEP 24576:O1BJJlQ7/R4mvj5eTSBAJLaKQE+Jpikhy8Hp2LYy5kA:oQ7WtjGblhhHELYAkA
MD5 SHA1 SHA512 SSDEEP

Submit Download

sqlite3.dll

Path \Users\Admin\AppData\Local\Temp\1E8B0311-BAB0-7891-85B6-E3A6CFE7FF14\sqlite3.dll
Size 508KB
SHA256 de818c832308b82c2fabd5d3d4339c489e6f4e9d32bb8152c0dcd8359392695f
MD5 0f66e8e2340569fb17e774dac2010e31
SHA1 406bb6854e7384ff77c0b847bf2f24f3315874a3
SHA512 39275df6e210836286e62a95ace7f66c7d2736a07b80f9b7e9bd2a716a6d074c79deae54e2d21505b74bac63df0328d6780a2129cdfda93aec1f75b523da9e05
SSDEEP 6144:RgEF6lmEVKtkDCQ/kUrc7dBLhuKgrQCjBXPTnrKcCxcfKvrLJLqgx5YMk4HJ0yPF:GEEdkUrc7RuKcQCdGVtT0MkCwwV/Hn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MainInstaller.exe

Path \Users\Admin\AppData\Local\Temp\MainInstaller.exe
Size 531KB
SHA256 3dbc5aff076ef9c86a90ad30e963581f7cb22f8e212aa38db29d82cf45b73f80
MD5 9ce448dcd7cf13dd950725957361bdff
SHA1 5831ff31825ea82d90a2989e0fc0a33b859d5f97
SHA512 b4a175da3677cd3380cb3789f281f2afb10aa00dc9592217062d66eb9b5e73805886b692975d7244cdd439d8d5bcd0eb5810533284ba4b13ff02a20b792bf74f
SSDEEP 12288:z/8Ze69hm2S17Y/bv9VXXLVS+n28L6OdBCZrrf3xSEowuj6ZQM7gMWZQkN:zihc17YpVE+PGsB03xSEowuj6ZQM71WD
MD5 SHA1 SHA512 SSDEEP

Submit Download

MyBabylonTB.exe

Path \Users\Admin\AppData\Local\Temp\MyBabylonTB.exe
Size 845KB
SHA256 588b7896a3712043efd9789e8bd2de35d2bcc082344f2d2cb7a90cfadc66b6d9
MD5 3d91ecdbb3404485702fb92b26b17d90
SHA1 5dfc514a7a1e037683fed57029f49fa6c6f04dbf
SHA512 1cc40cfa7328eb251f9cc5bc4c5ba695e213c8efda94e8ef23cfc7786a561c8298c05b39fbbbcfccc90eaf3a18090f1d6fd4ecc405795565fdb8790c9b2093d3
SSDEEP 24576:s5dJLagA9LRqvhD2LuD5zPI9xvnQwCb3D:F9cWu5w9OwS3D
MD5 SHA1 SHA512 SSDEEP

Submit Download

PingMe.exe

Path \Users\Admin\AppData\Local\Temp\PingMe.exe
Size 7KB
SHA256 f2ecda9fb1b201d9a120c5906c6b0983205e4858ecea0065499841cf4047eb71
MD5 991cd458830ae2008be0c2d8e26c8bd0
SHA1 d519a7ffd8360a47450e60b7d665e666d9df89bc
SHA512 e45ce313823e43726418378920c367a4957b2806ee8070d0f4acf63fd1fa893577fbe91fc859c81bd8d6984ca1c0fe9ef0b32200c79106a3f7dcff0b8efdb4aa
SSDEEP 96:GL1h5Q/B2JL1L5Ie79CCna2fLAyrLSc9Q0btWcmRXzNt:GRQ/EL1L5Ie9V5LAySc9Q0bw5RB
MD5 SHA1 SHA512 SSDEEP

Submit Download

Setup.exe

Path \Users\Admin\AppData\Local\Temp\Setup.exe
Size 505KB
SHA256 30522715240f4a05859099ac370dfb516097ab257402981c6a9ad31951f36cce
MD5 5d8d0c08384ad73216d52a2eabc064f5
SHA1 0fa5c77fd6b6323b926c9648679e063d1bbc8bcc
SHA512 42a3003019e39622082506c7ae50d8a27e2920fdfdf15eb9a8dbf7f1dbd49a02cd0390dabd74c136ed44e9d8ba270540ce9390f31aa84c2fc9fdfcc9e912dd57
SSDEEP 12288:6xPm2P17YJbq9VXMLVS+n78L6OdBRdrrf3xr5Uw1jcZQM7gMyZQU:6Jh17YYVV+YGsBH3xr5Uw1jcZQM71yZX
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path \Users\Admin\AppData\Local\Temp\nsyFF37.tmp\System.dll
Size 11KB
SHA256 dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f
MD5 c17103ae9072a06da581dec998343fc1
SHA1 b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d
SHA512 d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f
SSDEEP 192:7DKnJZCv6VmbJQC+tFiUdK7ckD4gRXKQx+LQ2CSF:7ViJrtFRdbmXK8+PCw
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1640-254-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/1640-255-0x0000000001FB0000-0x0000000002030000-memory.dmp

Download

memory/1640-258-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/1640-260-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/2076-256-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/2076-257-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/2076-259-0x000007FEF5A90000-0x000007FEF642D000-memory.dmp

Download

memory/2128-206-0x0000000000350000-0x0000000000352000-memory.dmp

Download

memory/2576-50-0x00000000029C0000-0x00000000029C2000-memory.dmp

Download

memory/2820-51-0x00000000001E0000-0x00000000001E2000-memory.dmp

Download

memory/2932-208-0x0000000060900000-0x0000000060970000-memory.dmp

Download

memory/2932-201-0x0000000003270000-0x0000000003272000-memory.dmp

Download