883c519ad7a66208741ff463d9c1db45bb7ab2242794aa82e95ed369442ad5c2

Analysis

max time kernel
148s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
08/04/2024, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Size 260KB
Sample240408-xtwc7ahc25
SHA256 883c519ad7a66208741ff463d9c1db45bb7ab2242794aa82e95ed369442ad5c2
MD5 e83196ac3cf2030628c56c2da16c7854
SHA1 28f06fe7b789f8055aec877ed2bbbfbeffa96081
SHA512 bc496a561b9e27ca13939acdcee1bc7ac57ff65cd943b69cdd74f4d41aa4f104237bc2653d709ab937c14ec126ebe7530c562f081064688a0d4fe1b8d92d3115
SSDEEP 6144:FsBByq/GNObPFg6YCzzUTursV6i6cpwBCGXx8o5J3r08L:52GkTHzUCrS6i6c/GvZ1L
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware stealer

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4692	escan.exe
2368	escan.exe

Loads dropped DLL 4 IoCs

pid	Process
4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{098716A9-0310-4CBE-BD64-B790A9761158}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{098716A9-0310-4CBE-BD64-B790A9761158}\ = "CodecPlugin Class"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\RichVideoCodec.dll	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\RichVideoCodec.dll	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe

Drops file in Program Files directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\RichVideoCodec\InstallRegerLib.dll	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
File created	C:\Program Files (x86)\RichVideoCodec\escan.exe	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
File created	C:\Program Files (x86)\RichVideoCodec\InstallRegerLib.dll	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1100	2368	WerFault.exe	94

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\TypeLib	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink.1	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\TypeLib\ = "{84562FCA-EE8B-4585-A1D1-EAE97B23370E}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\TypeLib	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin.1\CLSID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\TypeLib\ = "{84562FCA-EE8B-4585-A1D1-EAE97B23370E}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\TypeLib\Version = "1.0"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink\ = "XMLDOMDocumentEventsSink Class"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\VersionIndependentProgID\ = "CodecBHO.XMLDOMDocumentEventsSink"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\ = "ICodecPlugin"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\TypeLib\ = "{84562FCA-EE8B-4585-A1D1-EAE97B23370E}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink\CLSID\ = "{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\InprocServer32	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\ProgID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\AppID = "{F4406238-983A-4845-9053-F1D0007FD135}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ProxyStubClsid32	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\VersionIndependentProgID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\Programmable	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\VersionIndependentProgID\ = "CodecBHO.CodecPlugin"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\InprocServer32\ThreadingModel = "Apartment"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}\1.0\0\win32	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ = "IXMLDOMDocumentEventsSink"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\TypeLib\Version = "1.0"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F4406238-983A-4845-9053-F1D0007FD135}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink.1\CLSID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin\CLSID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\VersionIndependentProgID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink\CurVer\ = "CodecBHO.XMLDOMDocumentEventsSink.1"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin.1	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin\ = "CodecPlugin Class"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\ = "CodecPlugin Class"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\Programmable	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{F4406238-983A-4845-9053-F1D0007FD135}\ = "CodecBHO"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink\CLSID	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\AppID = "{F4406238-983A-4845-9053-F1D0007FD135}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\TypeLib	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}\1.0\FLAGS\ = "0"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\RichVideoCodec.dll"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\CodecBHO.DLL	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\TypeLib\ = "{84562FCA-EE8B-4585-A1D1-EAE97B23370E}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.CodecPlugin\CurVer\ = "CodecBHO.CodecPlugin.1"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}\1.0	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A1C23BA2-8F20-4C01-B663-7FF2B3421194}\ProxyStubClsid32	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ = "IXMLDOMDocumentEventsSink"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ProxyStubClsid32	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\TypeLib	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CodecBHO.XMLDOMDocumentEventsSink\CurVer	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\ = "XMLDOMDocumentEventsSink Class"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{84562FCA-EE8B-4585-A1D1-EAE97B23370E}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{48E92754-2DAF-4DE4-8385-34F631580E9B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{D37D6C1A-7BA4-47F4-9BF2-75031E257DF6}\InprocServer32\ThreadingModel = "Apartment"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{098716A9-0310-4CBE-BD64-B790A9761158}\InprocServer32\ = "C:\\Windows\\SysWow64\\RichVideoCodec.dll"	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4020 wrote to memory of 4692	4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe	93
PID 4020 wrote to memory of 4692	4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe	93
PID 4020 wrote to memory of 4692	4020	e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe	93
PID 4692 wrote to memory of 2368	4692	escan.exe	94
PID 4692 wrote to memory of 2368	4692	escan.exe	94
PID 4692 wrote to memory of 2368	4692	escan.exe	94

C:\Users\Admin\AppData\Local\Temp\e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\e83196ac3cf2030628c56c2da16c7854_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4020
- C:\Program Files (x86)\RichVideoCodec\escan.exe
  escan.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:4692
- - C:\Program Files (x86)\RichVideoCodec\escan.exe
    escan.exe q
    3⤵
    - Executes dropped EXE
    PID:2368
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2368 -s 820
      4⤵
      Program crash
      PID:1100

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 424 -p 2368 -ip 2368
1⤵
PID:608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstallRegerLib.dll

Path C:\Program Files (x86)\RichVideoCodec\InstallRegerLib.dll
Size 88KB
SHA256 77b016ccf2b2e4df4c67df0e0dfd7011b79c2c1f394b2f2f2a235bc2fce0e30a
MD5 cd22e5d0b9af551254d67db18d5d3b8a
SHA1 00dce649e95ed3e28fdf638c2bb6e60c06794f7b
SHA512 96b228ee077f9ed6800d58f316eee96dbedaa7c534ded8f75d179b329cd1cd0fa6b7a819aa7aeea5aa40b4c61dc9bd3884c7f25a6fd0c35d305ab82593887532
SSDEEP 1536:jtqL8NDUhNxztAr0At/yTH/tflNGvywJklR2Jw3sl/l13:jtqYlU3xz0XGH/tflgBJw8l/ld
MD5 SHA1 SHA512 SSDEEP

Submit Download

escan.exe

Path C:\Program Files (x86)\RichVideoCodec\escan.exe
Size 107KB
SHA256 bb6d67d3e10694e9bd00d6b83ad6db212834a0175fa2474bc41d6ca4a3a52ac0
MD5 42ffaf0b38d45f030d7280c97043074f
SHA1 9aade58ac78eac82e3d9775f872c8ae5118c5230
SHA512 5e8bbecfa8836d5654db4b18c6aef3fc627f3dcd4ba6e35adffad5c2931ff6679505a93c92380b9ec98585ad619813a95c54fb5cdd9af34ded7efb1555f9fc3d
SSDEEP 3072:7C2j1YfU5h6eWtLmOrcpwPVC0FXLibJYsi6:RsUR6i6cpw9CGXMi
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsf2EA2.tmp\System.dll
Size 10KB
SHA256 d3f9c99e0c1c9acd81a1b33bc3dbd305140def90d10485c253cf1d455f0dc903
MD5 bf01b2d04e8fad306ba2f364cfc4edfa
SHA1 58f42b45ca9fc1818c4498ecd8bac088d20f2b18
SHA512 30ca1663d659c5efac7fed3d1aaba81c47d5d5fda77f30f021124c882b858732e17f917bfd0aa3ee7b269fad86e75b1b9388d8f916e7a4e2c9961669f2c772e7
SSDEEP 192:aO6dJA/ruAFEiUdWWE6hE5RYUdJfbub1angMO:vKAFERdlxhGRYUzqZan
MD5 SHA1 SHA512 SSDEEP

Submit Download

RichVideoCodec.dll

Path C:\Windows\SysWOW64\RichVideoCodec.dll
Size 132KB
SHA256 1e8ff0f36a61829f4bd458c0835e3d92c2beb32e57ea27ffae43eb5a88b0a629
MD5 79119dadfe31b00e9a69bb40249b7edf
SHA1 caecc494cd0631aee2a38b0deea498043982c6d0
SHA512 7057cebe8fd295e8d49faebaa0113077c7a23617b215cdbc5a0c4af4cbe3a7ad0b5d8f726aad3667ea55220f7e97b6f52bea58db641852d795812907a69393b9
SSDEEP 3072:fawZ5oUC+4pMqgloxKxgEIKRRtllIQ6K:yYhTfqeIKnRNZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2368-36-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-37-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/2368-35-0x00000000004C0000-0x00000000004F0000-memory.dmp

Download

memory/4020-15-0x00000000024A0000-0x00000000024B7000-memory.dmp

Download

memory/4692-27-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4692-30-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4692-28-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4692-29-0x0000000000590000-0x00000000005C0000-memory.dmp

Download

memory/4692-25-0x0000000000400000-0x0000000000436000-memory.dmp

Download

memory/4692-38-0x0000000000400000-0x0000000000436000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads