58a0d0b4797616c67df94a634cd207202af01f43bf825fe6d64fe8a07fc57d36

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 06:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe
Size 249KB
Sample240408-hn9lasbb64
SHA256 58a0d0b4797616c67df94a634cd207202af01f43bf825fe6d64fe8a07fc57d36
MD5 e6e159aeb4391a116e93dcf549752ab7
SHA1 fcb4f2b595a9b37a161a02160043a7b30ad7f8f4
SHA512 435c2519400bbcce4283b5e3ad0f4be494e64a853f4c56e4c5ec7212bb227e08315caec82a54423d35d9fb2eb7ed4260e98bf97c33629de356817b5269e658d0
SSDEEP 6144:h1OgDPdkBAFZWjadD4s56SqYRzr4YMi01Hc:h1OgLdaO6SqYRzrei0e
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002324d-49.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2740	50e53c6552a62.exe

Loads dropped DLL 3 IoCs

pid	Process
2740	50e53c6552a62.exe
2740	50e53c6552a62.exe
2740	50e53c6552a62.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002324d-49.dat	upx
behavioral2/memory/2740-52-0x0000000074090000-0x000000007409A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\ = "Zoomex"	50e53c6552a62.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\NoExplorer = "1"	50e53c6552a62.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000700000002323b-22.dat	nsis_installer_1
behavioral2/files/0x000700000002323b-22.dat	nsis_installer_2
behavioral2/files/0x0007000000023251-78.dat	nsis_installer_1
behavioral2/files/0x0007000000023251-78.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\ProgID	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Zoomex"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\InProcServer32\ThreadingModel = "Apartment"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\ProgID\ = "Zoomex.1"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Zoomex\\50e53c6552a9a.tlb"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\InProcServer32	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\InProcServer32\ = "C:\\ProgramData\\Zoomex\\50e53c6552a9a.dll"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}\ = "Zoomex"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50e53c6552a62.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9}	50e53c6552a62.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 2740	4584	e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe	84
PID 4584 wrote to memory of 2740	4584	e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe	84
PID 4584 wrote to memory of 2740	4584	e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50e53c6552a62.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A94D8DB0-EFFF-4621-BE91-4806A5925FF9} = "1"	50e53c6552a62.exe

C:\Users\Admin\AppData\Local\Temp\e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e6e159aeb4391a116e93dcf549752ab7_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\50e53c6552a62.exe
  .\50e53c6552a62.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:2740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\Zoomex\uninstall.exe
Size 48KB
SHA256 43c3e8d7aa00a299f084db17e384aa96de508565f82264ee88bd9c7647fa9fc9
MD5 e9c9582996a23b2a49a058dcaa3b5525
SHA1 f527cc64e759f06c011e5eeffbd217d5249c04df
SHA512 665613fc7f20e2c4ea40b7a8f39b4c2ea2a24c5119ee86ef072bbe29f606cd78a43081aa0a89b678a46d34e470e1ed10e31d590d3cb5447e1231707fea8e490f
SSDEEP 768:l4wO7XBz+5Qm3W0tYdrQZHV4EWuWEUOg4jjfS3XJGfg4RoeMZeUZB/WvnQ9qI2:WLXB65939tY6HBg4sXJL4RoKu/WvQYz
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 81d6cbc13a0c87a3bac6f96b2aaa4c31b6a685d4e43836a62356135a511c59c2
MD5 568952abf3d57f00bd92cc1b0d2548ec
SHA1 8a1a1ffdf51ff444797bbc1d914ca58b9dcd52ea
SHA512 ed326542b21f861537d154f959c918a098304b7b918700c7fa191ad058eb6ddd8e4b0934d1e45e6857a7215e61eff74acd35cd7b05aadd565f3c8f109f13417d
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 4c9cd18366e099757e879170ce2874706c73293c0c6efbf4a3862520550fe998
MD5 4ad6ec47444b5fccebc11c551fd7c98f
SHA1 6d3707db1be73bd345c556dd09649f62bc064cef
SHA512 2e4b04847d45dbfda01e5f4599a31fce1aab6cfdd012abba1a370d88c075482264e9312508f4681ea1ca0a1bce03e2c3b0af498a120f59e8f1a528ec083e2f5e
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 60eb2e24009ce4e85af89fef037ac5d7d2f3eefec63c44d985a56a5f4cc59c81
MD5 03315c8cae0d6764ea2039dec245ffe5
SHA1 1d7010124a7d2fd03451450eecf8e7eea0e5f291
SHA512 50dac248f61aef2e99d02e44e9b962c3027c64ca074e9364ddb3bcd5c2cc3687f7cc0b4b6f09d734e6f6c3df5435c4ba0bd05b643e6a87b751b1214ff3b141c5
SSDEEP 192:lo3v4WCCKM235UsZkJn7ERhzUthY7c4wWtPWVqkYTvac7E:uvND3u1ZkJ4PzUthYo4wWtPWTyvB4
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 176615127538bdc2722f18bf9846a84370c72aa3a121fe9443d692b442e68b6e
MD5 bb5d90bd9752b3f3db89616233994c6c
SHA1 baa10155430a3ef4afc664383c20e535168a387c
SHA512 b0c254b22a5aa361d5eb3b2deba44cc8222e69d6b74277bf5a15dbd32d6c535c38b3908bb82df39ef88390e89fe97769b64ae9a6063a462c254663108414f494
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\[email protected]\install.rdf
Size 700B
SHA256 59d83aefb5ba8fc1292ed6f6b431533441ba4214b36110ea01a16aedada60cc1
MD5 f2af2811286bc8b53eefbd7073b8f0c4
SHA1 82ff3c000d79e4d54c32a662b602760a4fa58380
SHA512 d731874ea5e2e9eb21ab1166e359abbf73582c7e2b69774a5cda48e225fcae4c4a4c29e1c545a88dca7dc731c810d3582c2a4813ae637025aa73990d52604e08
MD5 SHA1 SHA512

Submit Download

50e53c6552a62.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\50e53c6552a62.exe
Size 70KB
SHA256 5e74f0e710c067ad82301c7c14ed6afb138f974f351042cfe0ecd275cea2612c
MD5 ebcc3eb1a7021aaead55fb677465a717
SHA1 3c8347f0fd520ee423a4aafea1112a0b06f4b6c8
SHA512 0f18c22e6eff8ec90ccc616e62f32701d046185311e01e5f506778fae0c31f35123c3ce756ff2c0eef6f23e06e280f870b80080d11dc6da3aa25901f5a92d995
SSDEEP 1536:WLXB65939tY6HBg4sXJd4Romu/FverCj/LnVL93MnlYU:WLk395hYXJd45QvTndaOU
MD5 SHA1 SHA512 SSDEEP

Submit Download

50e53c6552a9a.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\50e53c6552a9a.dll
Size 115KB
SHA256 73c44d8943947e3cf9ecabdeea4d9a37652614f5490a1f972816be4123795125
MD5 6696822add17061dc0bb8ee5b42cc2d4
SHA1 d4622558ba366f2f94560da301a81c6c16f95a3c
SHA512 0f1946ce002441d010f67156f67b9d18e01ba35edfeb66ce8096467d3126b547e5040032253275b173f2dba9bce983775f360d83ec026986b55cb85e4b63f099
SSDEEP 1536:qqOF5F2jFD9a+ExxZcfV4LnUP/Cwiu4qu6RFap2sUXTYXchpiSdIMO15kC6/18k:3W5Fs5qj/DUP/CDxIWAg/z15kC6r
MD5 SHA1 SHA512 SSDEEP

Submit Download

50e53c6552a9a.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\50e53c6552a9a.tlb
Size 2KB
SHA256 a602c790bcf424c154a082a88a495b256dd5456f627943568c358c74f606c568
MD5 096a65b8a695249d5d554776f1eeace3
SHA1 2f2506b886a59b4408b23653d8734004ec2dda6d
SHA512 6e832caff1951b4fdb489997af5736fdbafa1de5573f629fc6798666bffd0ca0715311ce6590202cc970cce4492d94994a588547bb579bf70bc264683bc45cdc
MD5 SHA1 SHA512

Submit Download

nlkkbndppihfjcjcijmnooahegmkaekc.crx

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\nlkkbndppihfjcjcijmnooahegmkaekc.crx
Size 8KB
SHA256 750eeb5dd454e89693c71bc8ca67821027138d432c836be93ef016a08992e5c4
MD5 133456a12c1d74e1e0e6bc9320d2851d
SHA1 3e72749a79f430abeb39387f88d6565d6d3ee518
SHA512 5aaaaddedd5a001a59c522da300bb35a7b5bbe32f5c94b37ed4f48e7d3240b1b93b1700c55581663a3a8ecbc6895544885d3c9533ccd2889a48d02ee488da7c0
SSDEEP 192:mWNKgUMthY7c4wWtPs7qpIY7/aU769HcbgWt1l9:mWLUMthYo4wWtPshQ/Du9I/L
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS737A.tmp\settings.ini
Size 6KB
SHA256 20a51f89a205f1ee5fa0f2fd11f87ad34c1aac9b987361f19ceb65de23b1f7e7
MD5 70ed3b5476712719511639748a3b0e60
SHA1 f15f74f20861b24032ceb751923f0c38e1670b74
SHA512 1ff06226efb470d33fffbd2a62b78e2fadf5f743051b50336c8cee526c9442b6d28a53d2075401154ab2d1fd6fd42fdba6fb0b29b5b96a244b652688ffcfc85f
SSDEEP 192:Z33GyDMD+UDDD1a9k3iHtW8338voEREBl:pAD+Oa9k8oGMQEREBl
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7560.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nst7560.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2740-52-0x0000000074090000-0x000000007409A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads