c9968b08887dd93fe8b4e5ffcd9337d8dfd3bb2fec2e02a56fc4349c6bedfe92

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
21/06/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Size 493KB
Sample240621-2qlrssxekr
SHA256 c9968b08887dd93fe8b4e5ffcd9337d8dfd3bb2fec2e02a56fc4349c6bedfe92
MD5 0009297260d5f43d2086c20dc376f396
SHA1 4751ace447df66eab367bf689ac12f382e5c2ed3
SHA512 b75ca3bf3745efcb90e97a235811d509bb40ae32fd98d561f6a5e6ca2f7b803ced0d91aa546fd85b34b25cb64ccbd2c37f2f3fda77cba55e2b05aa816be3e227
SSDEEP 12288:WaYWPh1az3BxVSQUmK7ruwAk3Ns+bIMrtl:7ZI3lSpmgrzAAs+bIMrt
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\Control Panel\International\Geo\Nation	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1424	AdvTCApp.exe

Loads dropped DLL 1 IoCs

pid	Process
4860	regsvr32.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\NoExplorer = "1"	regsvr32.exe

Drops file in Program Files directory 5 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AdvTopC\AdvTCApp.exe	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
File created	C:\Program Files (x86)\AdvTopC\AdvTCApp.tlb	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
File created	C:\Program Files (x86)\AdvTopC\TCHelper.dll	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
File created	C:\Program Files (x86)\AdvTopC\TCUnins.exe	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
File created	C:\Program Files (x86)\AdvTopC\tcse.dat	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies Internet Explorer settings 1 TTPs 9 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0748ADA-0334-4bcd-B2A9-F12E4C754AEC}	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0748ADA-0334-4bcd-B2A9-F12E4C754AEC}\Policy = "3"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9FFF5A03-2C66-462e-A2AE-19CA87E20DBE}	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9FFF5A03-2C66-462e-A2AE-19CA87E20DBE}\AppName = "AdvTCApp.exe"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9FFF5A03-2C66-462e-A2AE-19CA87E20DBE}\AppPath = "C:\\Program Files (x86)\\AdvTopC"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9FFF5A03-2C66-462e-A2AE-19CA87E20DBE}\CLSID = "{86D56D8B-9667-4C58-8BE5-37616F07A2AE}"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9FFF5A03-2C66-462e-A2AE-19CA87E20DBE}\Policy = "3"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0748ADA-0334-4bcd-B2A9-F12E4C754AEC}\AppName = "AdvTCUp.exe"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{C0748ADA-0334-4bcd-B2A9-F12E4C754AEC}\AppPath = "C:\\Program Files (x86)\\AdvTopC"	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\ = "AdvTCCtrl 1.0 Type Library"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\ = "IAdvTCCtrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\ = "TopClickReceiver Class"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\TypeLib\ = "{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl\CurVer\ = "TCHelper.AdvTCCtrl.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdvTCApp.TopClickReceiver\CurVer\ = "AdvTCApp.TopClickReceiver.1"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\TypeLib	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\FLAGS	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl.1\ = "AdvTCCtrl Class"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdvTCApp.TopClickReceiver.1\CLSID\ = "{86D56D8B-9667-4C58-8BE5-37616F07A2AE}"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\ = "TCHelper 1.0 Çü½Ä ¶óÀÌºê·¯¸®"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl.1\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\InprocServer32\ = "C:\\Program Files (x86)\\AdvTopC\\TCHelper.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AdvTCApp.TopClickReceiver\CurVer	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\TCHelper.DLL	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl\ = "AdvTCCtrl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdvTCApp.TopClickReceiver.1\ = "TopClickReceiver Class"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\ = "ITopClickReceiver"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\LocalServer32\ = "\"C:\\Program Files (x86)\\AdvTopC\\AdvTCApp.exe\""	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\Implemented Categories	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\ProgID\ = "AdvTCApp.TopClickReceiver.1"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\LocalServer32	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\0	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\TypeLib\ = "{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\ = "ITopClickReceiver"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\0\win32\ = "C:\\Program Files (x86)\\AdvTopC\\TCHelper.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl.1\CLSID\ = "{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\ = "AdvTCCtrl Class"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AdvTCApp.TopClickReceiver\ = "TopClickReceiver Class"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\TypeLib	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{1CBECE76-7A9C-4118-9B1D-255EF4A28B0A}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{229EDC5F-3F55-4873-AA68-DF2EE6B37B1D}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\AdvTopC"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\ = "IAdvTCCtrl"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\Programmable	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\HELPDIR	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D8BE945B-214C-4FF4-90D4-D27453803121}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\TypeLib\ = "{393A6F9A-B9AF-4cc4-9205-7D9AD84E3599}"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{7C3D497D-F1D3-4E2C-A3C1-613D598C7B65}\ = "TCHelper"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\0\win32\ = "C:\\Program Files (x86)\\AdvTopC\\AdvTCApp.tlb"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{393A6F9A-B9AF-4CC4-9205-7D9AD84E3599}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\AdvTopC"	AdvTCApp.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{86D56D8B-9667-4C58-8BE5-37616F07A2AE}\VersionIndependentProgID\ = "AdvTCApp.TopClickReceiver"	AdvTCApp.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TCHelper.AdvTCCtrl\CLSID\ = "{3E5EF872-03E2-4CE0-94DF-CA8A5004ECFD}"	regsvr32.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1424	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	82
PID 732 wrote to memory of 1424	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	82
PID 732 wrote to memory of 1424	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	82
PID 732 wrote to memory of 4860	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	83
PID 732 wrote to memory of 4860	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	83
PID 732 wrote to memory of 4860	732	0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe	83

C:\Users\Admin\AppData\Local\Temp\0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0009297260d5f43d2086c20dc376f396_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\AdvTopC\AdvTCApp.exe
  "C:\Program Files (x86)\AdvTopC\AdvTCApp.exe" /r
  2⤵
  - Executes dropped EXE
  - Modifies registry class
  PID:1424
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /s "C:\Program Files (x86)\AdvTopC\TCHelper.dll"
  2⤵
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdvTCApp.exe

Path C:\Program Files (x86)\AdvTopC\AdvTCApp.exe
Size 305KB
SHA256 867b016b5bd895a8149d76b0c5d4a55a20e2aa38b0bd24a134e769ca96d9d918
MD5 6c4fb5bdff7ea9f5807571c6ee872170
SHA1 9fb2226edb06b4c99743a2f7070d28d7b01e7a8f
SHA512 54aaae9cb34615fd16f64572dd8c4ff44222ca8d8a07b8e089ccd8f5bee7a57eeca0a5e95908bfd5dd5a42e401c7e9e88f98ead2c3d8653571fe165fb25612ed
SSDEEP 6144:y2Ig0vfgufk2w526cUa6POZTrSatw7opriWUAiixuELN9DPBh+g8Hul:3ufk2w5261YTrSatwEFXUFi1bPBh+g8H
MD5 SHA1 SHA512 SSDEEP

Submit Download

AdvTCApp.tlb

Path C:\Program Files (x86)\AdvTopC\AdvTCApp.tlb
Size 2KB
SHA256 7285e819ccaacecc882f91138e5402d80ac32927216c8e40030f6b60232613ba
MD5 c1c8e38be148a3148ef3d993c3f454d8
SHA1 77bbe86132c511c50a9b3b88ea7bc471e7d7e69f
SHA512 68e5e2e08330bcb44a45a6e76fd98ed0678deaf19b897cb35f47431ace4ea454745af9a6e8fea91dec4f1289f02cda2589a2aba70df809868158a391e2ca0dfe
MD5 SHA1 SHA512

Submit Download

TCHelper.dll

Path C:\Program Files (x86)\AdvTopC\TCHelper.dll
Size 230KB
SHA256 03614623326db9c1575c9484128182a925a718e9a5ffca8d1678c5100e638a52
MD5 1ff579e3d5ed93a9a90ee3548f575356
SHA1 9bcb2e209a962bd2e93069ad49289c0d33cd05bd
SHA512 1da3de2054b6555fc928aab07eacdc0686058484b813716e32a8b7c1d89a00709e3942be00d0c640587e49bbc21eddb50b2e7835af9fdd38b50d8690e173716c
SSDEEP 3072:Y3Ceb6okMhaxQMAL/oN8CDM5rRNWJAbuJ70GH9GPw+Y0aUNs:0Rueq/LN8CD0RNWJAbuJwo9ZZT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads