38af8479b38de144ffb9181edb21a4dc5bc4a5a6a233c023cb31f18dacff22a4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe
Size 249KB
Sample240408-2sc8faeb43
SHA256 38af8479b38de144ffb9181edb21a4dc5bc4a5a6a233c023cb31f18dacff22a4
MD5 e89bdf43181695d7b306028c5f6396fd
SHA1 4255340101a22aba1e5f1812b3b47f9ea7c84178
SHA512 f585ec0595b10bd390f47f51ab882ea609a4832ba6126021c0d3235ccaae94fb5fdedb9a03c9addbb51de4a437df2dfe0a5f02ac03fc4d3079756177d3eaca85
SSDEEP 6144:h1OgDPdkBAFZWjadD4s5U6CSKKVRJ1gDK0bQWcA75h:h1OgLdaOU6CFKV31gbJZh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0007000000023237-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1336	50efcbb48fd6c.exe

Loads dropped DLL 3 IoCs

pid	Process
1336	50efcbb48fd6c.exe
1336	50efcbb48fd6c.exe
1336	50efcbb48fd6c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0007000000023237-74.dat	upx
behavioral2/memory/1336-78-0x00000000747A0000-0x00000000747AA000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\eloimlehahfoffiimhihieimppfbdjpp\1\manifest.json	50efcbb48fd6c.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\ = "Zoomex"	50efcbb48fd6c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\NoExplorer = "1"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}	50efcbb48fd6c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002321d-31.dat	nsis_installer_1
behavioral2/files/0x000700000002321d-31.dat	nsis_installer_2
behavioral2/files/0x000700000002323b-104.dat	nsis_installer_1
behavioral2/files/0x000700000002323b-104.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\InProcServer32\ThreadingModel = "Apartment"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\ProgID\ = "Zoomex.1"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Zoomex\\50efcbb48fd99.tlb"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\ = "Zoomex"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Zoomex"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\ProgID	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\InProcServer32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13}\InProcServer32\ = "C:\\ProgramData\\Zoomex\\50efcbb48fd99.dll"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50efcbb48fd6c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50efcbb48fd6c.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 100 wrote to memory of 1336	100	e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe	84
PID 100 wrote to memory of 1336	100	e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe	84
PID 100 wrote to memory of 1336	100	e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50efcbb48fd6c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{E8FD0B7F-C2D0-2432-DC4F-F7A46BF39F13} = "1"	50efcbb48fd6c.exe

C:\Users\Admin\AppData\Local\Temp\e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e89bdf43181695d7b306028c5f6396fd_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:100
- C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\50efcbb48fd6c.exe
  .\50efcbb48fd6c.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:1336

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\Zoomex\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 9958d25f62f250f4bce82173a7cbc3227c7e0f8779f22b2ce4d8ad48ce5ab964
MD5 41fecb07b5a3d7dc27730fa0682b6a54
SHA1 24d444a464e479d47d259ce956a22826ef7591b7
SHA512 70f67879f96b4d4e1a4f8726d53e9d432f953bf85be6d1d7aefb265addd349071c98d2658770f9308b61acb0e34b0c1388bab7d36689fa31a99d91e35ef90cea
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 2d14e3e7f00106440e5ed73cb76b52cc6a157e175854db21dda046585d08304b
MD5 9c5605cca6d7d904d3220ff79a2974f8
SHA1 4567e69b4863d853e7991d1cfb0f8fd52d16f406
SHA512 b9c801f61fd835bf2ffe06f3ba45603c0ee13354b7a7315e238b6e377f58a56edc5dab326432646c6bb7bbfaf7a2ec578bc199bd28cf4bedc2fe471f10d7f342
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 926efd69d4cb4c6a84919b0ab073bd9b7110b32562981669f2dc7522da2b936a
MD5 c48be8f4e0d0c9349769107d8eea5f94
SHA1 ed73feee53d678f681b612252df2d3773bd6a768
SHA512 2e1348bc1d5d19fc6e3ec744afd99aa95a932a196ceed543ff314b42c96d84403601a8ed68bc88d72cdd14b15779aa54e64728381cb9694b9a2271cafe1fbdba
SSDEEP 192:lo3v4uClDl235UsZkJn7ERhzUxEVqkYTvac7L:uvRQxu1ZkJ4PzUxETyvBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 e75e03427ddea073e3e07032bccc9249e688e72de83509212086fb5b868a3cc4
MD5 f0a2b08f52ae696c67c4ea5c10d55ded
SHA1 787140ea8246db21f3a5f35c4cfeb68b65733291
SHA512 0232da17ddd25a7c2dcaf6114af9aa9ee2f307598827c2f87831c7dc4f7b34b09b549dfb428aaab8c1f534872ce8fa1c819a52180c12503d721db491d977eb0b
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\[email protected]\install.rdf
Size 700B
SHA256 92589d276af9b871f965535077a6ae4887af5e893ab5678ea70c5feea773faf5
MD5 7877d35a07e073c3122a1ee1df38d259
SHA1 57cd76b58d998a821208ff38315236adc50e147c
SHA512 79cc02e93f8ead3f4f3056d2a3de382d74d0ab8cedaf20db7e7582af36c9ab38df1e9ad4f2039b8635f62d15aea3ed7d0f11c8bdcaeb09302a333cae76003d5f
MD5 SHA1 SHA512

Submit Download

50efcbb48fd6c.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\50efcbb48fd6c.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

50efcbb48fd99.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\50efcbb48fd99.dll
Size 116KB
SHA256 0648d564b30e13a0819f28e00a9af39a6686a4d29ccd265c7d81548e4fe0f67e
MD5 da161da8bcb9b8032908cc303602f2ee
SHA1 8a2d5e5b32376a40f33d6c9881001425ec025205
SHA512 39e882a371dbce2484324811bffdd7ae7655b57401d07bf264aced6b5dac0ae326bd1945c536f05d8ab3b92ca03ff056c5a7baf54f7eb477b45fc405ec54052c
SSDEEP 1536:l33msrtECsLsHVXspbadLLbXSJZYSWa88aeRRRW62sWkCJIVfgV0ih7SLKYbxF5L:VmAbhLLbgZGYZXZCQXeCj9F59Cx0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

50efcbb48fd99.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\50efcbb48fd99.tlb
Size 2KB
SHA256 bd3d85c0136a66b2af79d4d91c1c5700c8931937b7e554d5ece946760ef4a99c
MD5 1f14de44d0d63a79f91d3fe90badb5fc
SHA1 7fcc921608d2cf40e81cdd9a98e1a15a6ba1f57e
SHA512 86eb6ebf9eccf1dcb601db827797ac603c0ebe01b6d73318986275c29bd034c8df5f7c79ddf0b19536faf24bdb11e09ac95ea43e8fe75b0ed3dde76dd139883c
MD5 SHA1 SHA512

Submit Download

50efcbb48fb7c8.63986160.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\50efcbb48fb7c8.63986160.js
Size 4KB
SHA256 622e11aa0a78197ab55cba0a6482a412e4caa9238d1c5efd31c69c4ab357a9b0
MD5 aecff58ada6ed3e66e803867fb65d246
SHA1 a9899b58bdf4c7be6e355df58007886c2296012e
SHA512 9e56ff9f4a83e3c404d92a829cda8eaa21115ef7d9c02be74746b6c7f616f0e0da8040884115c793ede916512715e2124f6a231649286044671e6639ae1a52bc
SSDEEP 96:Zh5LJxjTWgUMxyWN0wvpjeXY7/aU7HJJ0vOad:/NKgUMxy7qpIY7/aU7a
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\background.html
Size 161B
SHA256 b0d9eb0473bbab5ca00bb4cfa313ac16a951953a159f26c736146f3d3f70f362
MD5 31662a5c694788404aad29deb3233879
SHA1 b313d7d376a12d0a88b787a310c52f341cf6e339
SHA512 52d614d29489e1ee3edd5e28f47fe58a35f258242a9eed5606e8f1796e2412849bc87d280b21a78a350692a6379fbd82711e4749075c45c50bef1f3d7ca6d6b0
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\manifest.json
Size 475B
SHA256 5ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e
MD5 95b6b9aa3a3730d6d373a68eb5b411c9
SHA1 05cc71bfa2d2a2a18e169def790cca29f757dd3e
SHA512 5a178056071d0c94d2cfdf72a60403fbf9703cc28abe560f1f04fc2e073188f595c6bb3b687c7e2654899e103a229fe123c41af8aebbe189c9854ed71d8c672e
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\eloimlehahfoffiimhihieimppfbdjpp\sqlite.js
Size 1KB
SHA256 bde1a03ce146ee815e27c43c5ec8950cac68134a50bbad1903d64376a41929a0
MD5 86e01ac2efbc0305e5912e2ef97d8fb5
SHA1 4913f24349da9e9eee8855cc86dc24657ded6629
SHA512 20cdbb56421124adc11cb3cb4f6ad3c9a6a6d5b8b2a2a040c49802f984292887e10aebf6b7eb28f11418db3b4975ad58482657cd37a6a4c0c234f17747b7288a
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS5786.tmp\settings.ini
Size 6KB
SHA256 8cbbe45378ebc0122505ea63f51cd0924b8c46bbf4381cb19d3bdd9bbd202f65
MD5 1aef6df0294a566765ff6eb8a7ba7e60
SHA1 77a23622ee80b39709beb50192e650a50c82defd
SHA512 8f584bb57b3ae40d4159cd871ea79c82abed1cf9cc9a6bb81e6b7041b7ee5f7e5ab15e75be4f624a8a0871d64279af45c1c5234f565033d62ba9ecb980d0b0a7
SSDEEP 192:X33GybVhIvbV3k4/Fbfk3iHtW8338voEREheDN:3phIp3k49k8oGMQEREwB
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx58C0.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsx58C0.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1336-78-0x00000000747A0000-0x00000000747AA000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads