93849548439e771dfe211a662956966436b11f2b06b8d7b32e6184393ad1baf4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
07/04/2024, 23:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe
Size 255KB
Sample240407-3xfd2aae59
SHA256 93849548439e771dfe211a662956966436b11f2b06b8d7b32e6184393ad1baf4
MD5 e627a67268cb7518a9c5d4327ad45baa
SHA1 e18a7a991596d5e92b3b55ec5746fe755c09e287
SHA512 49ff6bce028893454400f8787a3ebe0a309483a8ea0117e88c45e3e91113faceb199aefc700635f9b6b98f26b5e7d07bfbf458de307eda0872604f0f6a806ace
SSDEEP 3072:hn1/uEAgDPdkBlyFZ+ScjaiKWbETBquAEXlqsUUTBnpUhRAFZRo0vWwg+u+Z7LoB:h1OgDPdkBAFZWjadD4s5TB33g7+Z3e
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0006000000023230-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4020	513f8d35959f7.exe

Loads dropped DLL 3 IoCs

pid	Process
4020	513f8d35959f7.exe
4020	513f8d35959f7.exe
4020	513f8d35959f7.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/4020-78-0x00000000747C0000-0x00000000747CA000-memory.dmp	upx
behavioral2/files/0x0006000000023230-74.dat	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpaehhlehljdkjghmeemdmllgljndanh\1\manifest.json	513f8d35959f7.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\ = "SSaveSalee"	513f8d35959f7.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\NoExplorer = "1"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DC293725-88D0-F585-DC47-8762CEDBDE5F}	513f8d35959f7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0006000000023216-31.dat	nsis_installer_1
behavioral2/files/0x0006000000023216-31.dat	nsis_installer_2
behavioral2/files/0x0006000000023234-103.dat	nsis_installer_1
behavioral2/files/0x0006000000023234-103.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\ = "SSaveSalee"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\ProgID\ = "SSaveSalee.1"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\InProcServer32	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\InProcServer32\ThreadingModel = "Apartment"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\InProcServer32\ = "C:\\ProgramData\\SSaveSalee\\513f8d3595a2f.dll"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}\ProgID	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SSaveSalee"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SSaveSalee\\513f8d3595a2f.tlb"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F}	513f8d35959f7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	513f8d35959f7.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 4020	4120	e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe	85
PID 4120 wrote to memory of 4020	4120	e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe	85
PID 4120 wrote to memory of 4020	4120	e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe	85

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	513f8d35959f7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{DC293725-88D0-F585-DC47-8762CEDBDE5F} = "1"	513f8d35959f7.exe

C:\Users\Admin\AppData\Local\Temp\e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e627a67268cb7518a9c5d4327ad45baa_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\513f8d35959f7.exe
  .\513f8d35959f7.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:4020

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\SSaveSalee\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

513f8d35959f7.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\513f8d35959f7.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

513f8d3595a2f.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\513f8d3595a2f.dll
Size 115KB
SHA256 d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c
MD5 00ce3831a16a62c6d7ea4b21049e4b22
SHA1 3e48c8d25b196d67722ed20cd36bf3448a4c9136
SHA512 7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619
SSDEEP 3072:7vEsdyJJEWrdpNOx47pJi3p1D+U5caxIC:xU+ytOx47ODC0x
MD5 SHA1 SHA512 SSDEEP

Submit Download

513f8d3595a2f.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\513f8d3595a2f.tlb
Size 18KB
SHA256 ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f
MD5 d5980ff8eb0ef4276fad96fba8fc5018
SHA1 2cb05f8b43aa3ae2f5492f590997eec6ff808fe2
SHA512 30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c
SSDEEP 384:ix+FoLzbS7H88fU+rdHaI0qA9T1dLtFn19hXKwYw:iXbSD5s6HaI0qG1dLjvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

513f8d35958014.18381309.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\513f8d35958014.18381309.js
Size 4KB
SHA256 7cf7943043cb1d4c9a3d8268c5f316f08421ecc59712839dc858fc45fd4bd77c
MD5 c8086cfe3e8f4db5385fff6d84ec457e
SHA1 542358c08868e5942b8fe30979f4aabd9f5e550f
SHA512 8cf1052ff838fe713ddc8a6e62f7494eebebecb715c705c42a01846864dccc8449fecb03256d2514f6cf4af334b100ea45e48c03b4a974cb66200e57cd92938f
SSDEEP 96:Zh5LJxjTWgUYAOvg3uB+9/WN0wvpjeXY7/aU7HJJ0vOac:/NKgU29S7qpIY7/aU7n
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\background.html
Size 161B
SHA256 922f82b09df791e3e2a60fe9461c13e7341438fe37c1850ef992333d8188c817
MD5 be2d8705727593758612ae757975fcaa
SHA1 a93da092430d0ea55cf723a824c267f695bb340d
SHA512 e7121e549089aaac60bbe75510ada0c0b1daa9458779db5ba8952eb6630c3bd25bdd253dc8b334ffa863ae2f30adbbb8e45aefdb306103d53aec5f42ea64a1c1
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\manifest.json
Size 500B
SHA256 81cf113c734d6ff5edd293044d50d58f618ddf7128964cdcffd00c1aede89e1c
MD5 6c33b5e219b689ef6bf20624a0aaba8b
SHA1 c8c30963fd480d7f2f2b73badf597649bb7c996f
SHA512 79b483f52d07d0fdc31955b1e80bc26570e23a215ec1ed7c7bdb959c58357094b8f18ac79cc7c50aecde511c2b9f9ab41db1d47f2e72b624f7e53bec9e6790c4
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\fpaehhlehljdkjghmeemdmllgljndanh\sqlite.js
Size 1KB
SHA256 bb499aff3818a5057cee1ac0a18d0362a85dbfbdd0fda05b8d61b70bc966b54a
MD5 027f54a3b0a6fdd61681f5ebd581562c
SHA1 9b8f348aa320490dd5f5b38299b104178cf78e6b
SHA512 04868201b45a9d1532f4ac4079b6130762de4dab83676ac64c5bb7990567eabbf7497425230102657cfb7a8bf4d92c1e636690585ea4187a0ddc65d343a239ef
MD5 SHA1 SHA512

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 372ff096c648a54ab85c5b81d79a9661a1feb5c49212845b8f46ad92c0eb40b3
MD5 3851cd3c2f0d496ac4dd914456c4f770
SHA1 32591f743063964135cd9909e9bae07fd204c55c
SHA512 2b6cc42f876a96951077100c1d6236053590e8740c2ed1f873e8fad2d5de4a15a36e7e3d10b71ed053b8d6c79443f8779abb5e3d77eb9df7e7ea848ea3650b91
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 cef60d903c7b1f1a690fa5474e9854f2d42da7dfc5bb41032a43e96ce5798696
MD5 6b0bea4e788276e74029d46bf8941d4b
SHA1 f8c0ca7a134de12584e6692ce21272ec953eb528
SHA512 ae14a3583e96924754a0ce90c58321602e16b0083c2268b698ab258a6681f1242cf84c80f7ffeaf67848547e7dc93ce324b82b1471fe205d152a017e01274e8f
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 5242e9cb6a2642d3952cd7e3b4b71d7ffb443fd3170c16fe92619682059363de
MD5 7cd2088fbd0849a00882f0b9224173ed
SHA1 dec85c1210b6cc61e70018afb7371480b2be34d3
SHA512 cfc86296d7389f7963f3c2e68fa66e1d0cb95a90f230258de4a4976a420d6ee16543b8dd2f7bfa6db98212a8f2ccb9685e427bd405281c9083bb826210db50a6
SSDEEP 192:lo3v4jCcQN235UsZkJn7ERhzO9kVqkYTyac76:uvIt4u1ZkJ4PzOeTyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 25be0db0946829ed8a9c12fc4929cd261b3852f92cc8666e292d827eb3d4470f
MD5 4902737f503265105bae18fb3845b4d1
SHA1 43a31abc0778bff7e26d41a9ad8b15f974b12150
SHA512 429d3b2dcfacfadd40c7de7d5be90a9cf0dc22f39c59ddd273d5160195440ec341ba68448c0b5e6c8038bf1670c4db16e1dd6940d67677dabc4b79d676e2c892
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\[email protected]\install.rdf
Size 605B
SHA256 80f57a3f9b18e09163a755448d7a2c7df1c05936788da3b1911ce83482cc8276
MD5 86174bc9bfb31c03cd61a51a99a8173d
SHA1 8d327faf767da4690607e7e3d509ca3bb375d0e6
SHA512 312ec54a571a48c2366128d8e192a8d32d6ff4e924e2ac14b5cacc9706525667a9adb9656e3496a7602b31cb1f956f6e6aa6232b345423041563ae3767537edc
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS418D.tmp\settings.ini
Size 6KB
SHA256 13a6d575fe7fe05d1b9e0de2349f4ba91c23b412621fd90aa58b02f48e582eca
MD5 c8ca503527817c570c1e1ad252404f0e
SHA1 02f2a6e6421512b7634b8faf20a7f0afa401985f
SHA512 f6b6a4de64b8460a47e51121ee6829de6d8eaf06b212b5ce0324aff6428892c0af97dc27b078dd0ee1d506a56ffc356d76f52747254268d4cf10b298f25065e6
SSDEEP 96:3CTJLQ5iPHQ3lpobx1EA9X9l79l39lFe+rdly/9U9bK7j9s4k6rB4AWkTos/sEio:V33Y9X3Tpe+xu9U9GVMMBssoWzd
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4269.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy4269.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4020-78-0x00000000747C0000-0x00000000747CA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads