eda7f931ad8b80abc2850e4f3b3cac4ce6e86678c073664aa14399fd829be14d

Analysis

max time kernel
92s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 16:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe
Size 250KB
Sample240410-t3srwaea47
SHA256 eda7f931ad8b80abc2850e4f3b3cac4ce6e86678c073664aa14399fd829be14d
MD5 eb8170e45f92804fb5758dbc14327963
SHA1 e7be3174ce60886e5931f7cf2467d3e374545812
SHA512 e5a90eb378cb04bcbb20c245136949aced07dc63afb8ea9962b63e30f16e223d44da95e49faf90aba13c2fc051cc210ca5ad52f49ec00bcfc92c630d6c06b1c8
SSDEEP 6144:h1OgDPdkBAFZWjadD4s5OlX5oxoq9YebrJcW:h1OgLdaOepxebNt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002326b-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
4264	50fa4e953936b.exe

Loads dropped DLL 3 IoCs

pid	Process
4264	50fa4e953936b.exe
4264	50fa4e953936b.exe
4264	50fa4e953936b.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000700000002326b-74.dat	upx
behavioral2/memory/4264-78-0x0000000074340000-0x000000007434A000-memory.dmp	upx

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ilhbfokicdgpooolfnigneofignllgkh\1\manifest.json	50fa4e953936b.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9DC768E1-91FC-9618-E545-B7EF9F658B26}	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\ = "Zoomex"	50fa4e953936b.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\NoExplorer = "1"	50fa4e953936b.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023252-31.dat	nsis_installer_1
behavioral2/files/0x0007000000023252-31.dat	nsis_installer_2
behavioral2/files/0x000700000002326f-104.dat	nsis_installer_1
behavioral2/files/0x000700000002326f-104.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\ProgID\ = "Zoomex.1"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\InProcServer32	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\ProgID	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\InProcServer32\ = "C:\\ProgramData\\Zoomex\\50fa4e95393a3.dll"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Zoomex"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Zoomex\\50fa4e95393a3.tlb"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	50fa4e953936b.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\ = "Zoomex"	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26}\InProcServer32\ThreadingModel = "Apartment"	50fa4e953936b.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 4264	3996	eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe	83
PID 3996 wrote to memory of 4264	3996	eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe	83
PID 3996 wrote to memory of 4264	3996	eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe	83

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	50fa4e953936b.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9DC768E1-91FC-9618-E545-B7EF9F658B26} = "1"	50fa4e953936b.exe

C:\Users\Admin\AppData\Local\Temp\eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\eb8170e45f92804fb5758dbc14327963_JaffaCakes118.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\50fa4e953936b.exe
  .\50fa4e953936b.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:4264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\Zoomex\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 94c98b6dc731c24f8eb482f61fae9d7dc3bc36bd714f0af765e85c31c2bfc166
MD5 f262e8fc9ae7d4dd2abe1e1dfaeb952d
SHA1 0323067021b38fef3218dcfbbd9b64d1bd79ad4c
SHA512 28721ed6d02754e0a0fe19824a6af0dbdb1c518e55d101d01039511bc5ccf7665e9f717e3460d40511fb936be3be3c217d7669eb9174a4db0f54d7a28ffd3979
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 3ff4649ad7df0f086b21dd7e6f74d3a58a4d0a1c064e6106ea974e7622344c05
MD5 38976fcc903f499d09e5c92631f19b9a
SHA1 e18010f73b48704c29e319c4b1df7caef42319f4
SHA512 99b1dd8bb9a1c44caa61de705817194589bd34a61b369e1d356567e8b17b112aa28a1fa889a345fdd7c7d32d75763d1c10fb2e0901c031f33fa9416cd925ea5b
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 f861f16c07e1243635b8f446850b7a784912c1e6b6af41405a1bdf8f84554b40
MD5 6a0f68ee138801809c6bff5e6a984db8
SHA1 fe57c97372e280969cd5029c34f5f7d4bda8f4fd
SHA512 70b86342e7c2a51341136d035d8d29d5a23cffc01445bd0c3c0df35aae7af3a3ce8827db96a1b626845b362621e74f15a0efed1951899fe4e1ec4c00cccc086f
SSDEEP 192:lo3v4fCM8D235UsZkJn7ERhzmw2VqkYTvac7L:uvQdCu1ZkJ4Pzm5TyvBH
MD5 SHA1 SHA512 SSDEEP

Submit Download

zy.xul

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\[email protected]\content\zy.xul
Size 225B
SHA256 5c8f5148fbc2ee6f8963ad9706cecd035b19b74d5dae1c590c607220346b9811
MD5 1210f220341c63cfcf7130f95899eb41
SHA1 426f21c7036f7b7ea7a1925dc770e0b800cf3b7f
SHA512 f5bda6454b3a0d48dffe3980d1509c58cbd285a82a605deb1f97a3df6479dcd4e274bccddd70fb46819a2f96eb5f437afec8826087b13c392c4e9933f378cdb3
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\[email protected]\install.rdf
Size 700B
SHA256 c13fd351a8624ba7417071bf8d956280af129cc065f62d3f4d362b48830fd7a6
MD5 75dbb1d71cecf6ea70119aa31cf01410
SHA1 9feb6fc63168dec6117ea70758248ee94739e60a
SHA512 a31198d30ab0288a1cd93eb16cc98f5a486b3d8b0097216d6488f03d8f52914febd129a5e89907c0ecbda17401612ca52668eead57423023a83b57603bf90a3c
MD5 SHA1 SHA512

Submit Download

50fa4e953936b.exe

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\50fa4e953936b.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

50fa4e95393a3.dll

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\50fa4e95393a3.dll
Size 116KB
SHA256 0648d564b30e13a0819f28e00a9af39a6686a4d29ccd265c7d81548e4fe0f67e
MD5 da161da8bcb9b8032908cc303602f2ee
SHA1 8a2d5e5b32376a40f33d6c9881001425ec025205
SHA512 39e882a371dbce2484324811bffdd7ae7655b57401d07bf264aced6b5dac0ae326bd1945c536f05d8ab3b92ca03ff056c5a7baf54f7eb477b45fc405ec54052c
SSDEEP 1536:l33msrtECsLsHVXspbadLLbXSJZYSWa88aeRRRW62sWkCJIVfgV0ih7SLKYbxF5L:VmAbhLLbgZGYZXZCQXeCj9F59Cx0y
MD5 SHA1 SHA512 SSDEEP

Submit Download

50fa4e95393a3.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\50fa4e95393a3.tlb
Size 2KB
SHA256 bd3d85c0136a66b2af79d4d91c1c5700c8931937b7e554d5ece946760ef4a99c
MD5 1f14de44d0d63a79f91d3fe90badb5fc
SHA1 7fcc921608d2cf40e81cdd9a98e1a15a6ba1f57e
SHA512 86eb6ebf9eccf1dcb601db827797ac603c0ebe01b6d73318986275c29bd034c8df5f7c79ddf0b19536faf24bdb11e09ac95ea43e8fe75b0ed3dde76dd139883c
MD5 SHA1 SHA512

Submit Download

50fa4e95391930.81112679.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\50fa4e95391930.81112679.js
Size 4KB
SHA256 7db0c0b1b5f775c3a0e0e9a59509fd3a81e941cc5ec75b3a1a94c814b9903dd9
MD5 e74e9f5837fb37fd15c4e1473621a0c1
SHA1 1c1451aaf60d56c5cf882c43fb12e886abb552d2
SHA512 b875af8015509fd15e7751b0bd1ebffa3dc826c3eb4d55f816fb3b3a76efe28dc6be2d94923f91ae1d204d29091b2c404c407f9d93b47e5401a06b88b9467c3f
SSDEEP 96:Zh5LJxjTWgUOwMWN0wvpjeXY7/aU7HJJ0vOaA:/NKgUOwM7qpIY7/aU7v
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\background.html
Size 161B
SHA256 a9a20eba1d4572dc7725a177d550e7c154f075dc1c2fdd00da0704ba689d26a8
MD5 9c7a2bc613cf6e41db970e8c01034f53
SHA1 71c0738e20b886739c7e9a6c49a9ff6eaf000d86
SHA512 1510725afe49215c49d05f79e4cb3a0ec231eb3cbbca77a396e95716e55ee9681e15ebaebcafc788b925304658358689ed0a5b8fe5ab2671007fe86fe48a7c24
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\manifest.json
Size 475B
SHA256 5ac43caaa60d48d2c5bc8059dc845eb344b31c088207c8da714f7a36d500c69e
MD5 95b6b9aa3a3730d6d373a68eb5b411c9
SHA1 05cc71bfa2d2a2a18e169def790cca29f757dd3e
SHA512 5a178056071d0c94d2cfdf72a60403fbf9703cc28abe560f1f04fc2e073188f595c6bb3b687c7e2654899e103a229fe123c41af8aebbe189c9854ed71d8c672e
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\ilhbfokicdgpooolfnigneofignllgkh\sqlite.js
Size 1KB
SHA256 2241a7454f7c58ff53be57761585d3c4e1896949ca36a42d56bf6df07fe7ac27
MD5 23582241a7d24461821ed22cb42c183c
SHA1 1fa1a4a2848c1d69298b51fb78dfe7f2d3911155
SHA512 8b22701cc56e328b7040d27cf286d9d512894c4465375946119af0810b68c5fc871b4b9afffedfd4a864b64e69f230dc6cde93c5506a9d73e65ff532ee690920
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zS7F32.tmp\settings.ini
Size 6KB
SHA256 829afe2d3592d03cf50141e49038b8a90166eb14b7909eee8bc5065bc11059a7
MD5 cc5fa4d8816c9fc9cf5cc05bac339cc9
SHA1 05ca3debc9f5028a78f9346207bb6cb124c885f0
SHA512 e048ebdbc6597f18d8a415773a2ec99beb7048810f88152648adbfd4346adfe1549e9ddcf573dedeb3ad100d785dc5ff6ad75fad3ffe08f961fc334f425132ce
SSDEEP 96:xXJLQ5iPHQ3lpobx1EvKQela1mmKQelynrnQSKQl8HG48IgD1IHrA6LsAsyE8375:Y33HKVimmKVsKfk3iHtW8338voERE8E5
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy8195.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsy8195.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4264-78-0x0000000074340000-0x000000007434A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads