84deb93b6b9f15407c820158f5a0e88dc2178d6e4faed638159f82770a7a16f1

Analysis

max time kernel
14s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
09/07/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

312ccef372e42737dae5db9318df3186_JaffaCakes118.exe
Size

252KB
MD5

312ccef372e42737dae5db9318df3186
SHA1

4529995e7aa1d337bea7667f22801b544285b45c
SHA256

84deb93b6b9f15407c820158f5a0e88dc2178d6e4faed638159f82770a7a16f1
SHA512

e1d3bf7b52f6dc3d0cefb3cc2c4c0e65ab118eb9286e5966f2e84dbefc6a88614961755ff52b45651cff12bc37b1c308998b422e83cbd99f6e25a906c1506412
SSDEEP

6144:91OgDPdkBAFZWjadD4s20KQoRcGuGleyKTvOa36Ff4VQEBYImU/t:91OgLdaTrQ+c7GltWWa6ahh/t

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3000	setup.exe

Loads dropped DLL 6 IoCs

pid	Process
2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe
3000	setup.exe
3000	setup.exe
3000	setup.exe
3000	setup.exe
3000	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\ = "ADDICT-THING"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\NoExplorer = "1"	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x00040000000192a8-22.dat	nsis_installer_1
behavioral1/files/0x00040000000192a8-22.dat	nsis_installer_2
behavioral1/files/0x000500000001a25a-79.dat	nsis_installer_1
behavioral1/files/0x000500000001a25a-79.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\InprocServer32\ = "C:\\ProgramData\\ADDICT-THING\\bhoclass.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "ADDICT-THING"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "ADDICT-THING"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\ = "ADDICT-THING Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\ADDICT-THING\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\ADDICT-THING"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30
PID 2268 wrote to memory of 3000	2268	312ccef372e42737dae5db9318df3186_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A4A408A4-8AFA-8CFD-D841-66DB2F68A64C} = "1"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe

C:\Users\Admin\AppData\Local\Temp\312ccef372e42737dae5db9318df3186_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\312ccef372e42737dae5db9318df3186_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ADDICT-THING\uninstall.exe

Filesize
46KB

MD5
8be20144dbd200c6de0c9430ed9280cf

SHA1
b81e3aacaaedd66ef0896acabc6983c94758e2b4

SHA256
634557ab79a29fe800721bc5f146a9b86799b72eb6755e821492f85ca66818a6

SHA512
fd7db954002be6332c8c6f4500fc38c1d5286022bb56f21b97567e837ee3d5a3c6db08cabcd2ffe405e7180918d6bb0b57b330703a9d045851901d01115ff94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
f0ded83c97e0190109bc35e59c3a86a3

SHA1
8ba0d099b3ae07ed479f45000f422f78a579254f

SHA256
9301e5cd5c9018835f5656cdbc01e62968d2cdc305f4230fdd2b12e256463484

SHA512
6a437fc06c2db07568606e8a9561f51e6d038d8afb2c05608167e42c5c134290d96a8be80851b01175e579f07685dc49ac1921f497f2f384670ccb24a1cbbb52

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
65cf2e157da6536203c35bdb192ed84a

SHA1
d9416a441216cbdd5d261cad622a5464f69b0632

SHA256
5f3784bab104e55c30a8e8fb1acc8be7bd0abb29526e89d4bf24f313bc37f387

SHA512
0b35906f8314946406f79ea1ff36ce161f09bf93c667df5bd205564d54cac28d4065cdcd5cb897951421269dd094971f68e72686f260970f767c4683707e981a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
587f77f33913080a2004c971a4d8da2e

SHA1
ede5d6e62436870651fc7dac4d61f55acbeea8dc

SHA256
a75a2e9055866dc9131d0a90f78d69906f12dfd2e9e7fda0a1e30ab431d3e10a

SHA512
80703c3e541fea4b12637fa9676717873ea613a3374061541235bbe75a5f032e0e5ef00e968c8d11e60d7b7a5eaffebec731e6307957d5a21e6342c85fee4ec0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
7d5f062f3d4a93f6269d390714d58c7d

SHA1
095a2725adcdfa8849d2d2f301902d445d3f9fca

SHA256
ba8f01c3fd63bcf456431e05d1bee44fcd4391b1098dcf549c7c6c0c262e8385

SHA512
8822a716031abe4d659455ab59aa4f58ce4252d392c86895037c60c8d357dcc5dd0c8abc9e3136f15081802c6b37b1d4f40bbaca59a9cf2109c3a7a381769b08

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\[email protected]\install.rdf

Filesize
714B

MD5
1898b56a84822366c57ba347a05452a1

SHA1
698ae2464c5e895508fb7ba124942db6c53a6d21

SHA256
dc31b187210c9d6a438afd906943db4baff86b100ea32580f77194bf7fa8de6f

SHA512
0089b0ae53ed310f74f4cd68a36448045c282bc7582835d42b502d576d4c3a0833e8afaf239ed7d7e64754e63918eb7b774592ee048332650caaf2f0ecd30bbc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\background.html

Filesize
4KB

MD5
1055d851add09906dab8efc7b941c27e

SHA1
d229f868d78d4933bad12b9d5d6cafa096772c85

SHA256
5fed682b7bf499a509632778a1eac390f5a09f1930012cdbb9b6bca0e93b983a

SHA512
a905bcc9c0f12c4b8e487241e2198629cec5533b91029a7c89d2ba984504a54f2720f5d8e2d5ee016e211df72e16b752a67206a38a850922faaa10a82f391403

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\bhoclass.dll

Filesize
139KB

MD5
4b35f6c1f932f52fa9901fbc47b432df

SHA1
8e842bf068b04f36475a3bf86c5ea6a9839bbb5e

SHA256
2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196

SHA512
8716b9a8e46933bf29348254a68d1a21392bdbbe3b4d5010e55fe638d02cc04eb685e424d440f7c5b58ffbca82e5772dd95bef73fa831595c2ae9599f3b05a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\content.js

Filesize
388B

MD5
c9933a5d0a26079d548a15d7ed2adbfe

SHA1
88da90285e2aefc77af1c6860ae868522b1406d2

SHA256
f0e124c35a5deb5364ed5d69a564ae437f4cece638c2cfbedde2cd5add1ee917

SHA512
a93fec1bab59cd51e898d25f8d966ae27dd066bca9c514e831e7ffadc2ba6b3f65197f8157c06945028d1a6d599589490c647a63283a27dbc31d91550251d5cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\dokbkhlgkaiemnpanjpnjmpjhofcpdie.crx

Filesize
3KB

MD5
7a35bb0647ef3c45e6f21ffee1d6dfb8

SHA1
491864a85aa98dae06258ef7ee164e2677c858a6

SHA256
f0d1ab12bf51443230c217a318081d6ae936743fcaf3da7facd8c8547e36ef4f

SHA512
2ff1e98bd7d7bf1f862b5b2f4a651c370518ddc45c68d248fd92a2539376e4024a7d8efbe652b035772033d2b6aca7fe3974192e08b3721e0fcbacd442fe5f28

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\settings.ini

Filesize
667B

MD5
1d207dc0b790dd715a75b826a5043b63

SHA1
8330832dda2ff5790f8848302203747a27d2b2ad

SHA256
55482c6814957c7686f7559fad1cd7828b88654d832ebca83cbae5bf6a0e9b4d

SHA512
1d92275081fafb3717ad8785b1b6c16655cbbd33bd1e1ffc91a54a4d7cc259c842c5733f6fba8539662773aec28e2eaac88bb7ce8b7d868d1dc6fa2504673aeb

Download Submit
\Users\Admin\AppData\Local\Temp\7zS9E04.tmp\setup.exe

Filesize
61KB

MD5
16ef6e914973925977cdc5ef6b8b2565

SHA1
4815da2815975b33f5dc94d482e6dbc02588afa6

SHA256
6b9a2b64b90799f1d50458dc38fb4e9e13a8abb37210c8f5d9eeedae84c6912f

SHA512
c74f0e17878c4598b626edb5e75e7ee098b71c0c26454ba709e2ea438517670ce11abf7d909470e6c935a21d0413c0d14b29960af9bd6a423e3261789a35b059

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads