2cea813e779a18e43e32ac59d6350b909f07a2777f83bc1bc3afd9a19fd19903

Analysis

max time kernel
118s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
10/07/2024, 05:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe
Size

251KB
MD5

3373eb5a077e73fb3bd7a8e3fec6899a
SHA1

9483c0a20e7ad8c6c6bdaa0c3526f537a6599d66
SHA256

2cea813e779a18e43e32ac59d6350b909f07a2777f83bc1bc3afd9a19fd19903
SHA512

b42e9e6afddd50ac2dbb5b799ca1668beb23574899b7879a1864bab1e0e3c4485aa0f151ea054bd9c71ff964e0147f9f6d494a6dfe169377c619ee29af85ef89
SSDEEP

6144:91OgDPdkBAFZWjadD4sE1ffkbbitk9b8Gy+ekkK:91OgLdaB1ffwiMQGKnK

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2624	setup.exe

Loads dropped DLL 6 IoCs

pid	Process
2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe
2624	setup.exe
2624	setup.exe
2624	setup.exe
2624	setup.exe
2624	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2ACB7572-7691-315F-4B0E-57B79A75274C}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2ACB7572-7691-315F-4B0E-57B79A75274C}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2ACB7572-7691-315F-4B0E-57B79A75274C}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2ACB7572-7691-315F-4B0E-57B79A75274C}\ = "DownloadnSave"	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0005000000018701-22.dat	nsis_installer_1
behavioral1/files/0x0005000000018701-22.dat	nsis_installer_2
behavioral1/files/0x0005000000019444-79.dat	nsis_installer_1
behavioral1/files/0x0005000000019444-79.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "DownloadnSave"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "DownloadnSave"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\InprocServer32\ = "C:\\ProgramData\\DownloadnSave\\bhoclass.dll"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{2ACB7572-7691-315F-4B0E-57B79A75274C}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{2ACB7572-7691-315F-4B0E-57B79A75274C}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\InprocServer32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\DownloadnSave\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C}\ = "DownloadnSave Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\DownloadnSave"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30
PID 2596 wrote to memory of 2624	2596	3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{2ACB7572-7691-315F-4B0E-57B79A75274C} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3373eb5a077e73fb3bd7a8e3fec6899a_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2596
- C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\DownloadnSave\uninstall.exe

Filesize
46KB

MD5
8be20144dbd200c6de0c9430ed9280cf

SHA1
b81e3aacaaedd66ef0896acabc6983c94758e2b4

SHA256
634557ab79a29fe800721bc5f146a9b86799b72eb6755e821492f85ca66818a6

SHA512
fd7db954002be6332c8c6f4500fc38c1d5286022bb56f21b97567e837ee3d5a3c6db08cabcd2ffe405e7180918d6bb0b57b330703a9d045851901d01115ff94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
e16c50c73ad0c26bbd7593f325288ea8

SHA1
283626b095dbfd2fa285cc8ddcc104ce994a5a62

SHA256
bba9d13c3738ea9a3541dc9cd59950f0ebac4e73380a7ef0e9a42228346c3d62

SHA512
ac53acc63bdd53ee79648029fde8f00ce982d591de6d98a92303da495af797e9ea8818e2d5e9aed695bc72cd7741366ae992550b1b12db809252acd1729a6b8a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
701f36c58229c47383c2dc622df22e32

SHA1
e0ef668555fef46cb82a9dee8f49de87b73f948d

SHA256
624c33fa2ceff662bd9e71862e40dc3609eee5417e6b1fdcbcc52eed417046be

SHA512
59e42ccbb449dd2bcefd62b80b2855d1ab7d890f04ee736a3e36d6a15a040dcae527150f9c1753ba7d97d542772dbf0c5f95ca5bcd057086234b97474562638d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
472acc04503272650bf50990970798f6

SHA1
bd18a7db6902fee471f13b8b9e4bc0283cf05c6c

SHA256
6f0690053073d33817d7dab2ecde9d814a065a0fb050b609a5dfa78e21671768

SHA512
6c4e4cd64692364b962666a0c9b0d8c065c3620de8d54a9deaf3433fbd34f91315e5bc05cfe9b94bb3db670fe20ecadc01cce0eb1e016b131b026996255846c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
02b81f86c474659c72447eb67dcb731d

SHA1
a48b54384fc6effa51ac04194f6fe86d4ec21b38

SHA256
dd39d6be5abce37bc5829db12688f408215abbe75c3014fc0877a4889ce717bb

SHA512
7848dc3b15337d99cc94ae6602b54eed1f7b0d009a9cf909e4d00c13e59f202e6f74ff96b7226bc61557ceaa9991aae14d62bb25c964b90d0073ec426b8c872a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\[email protected]\install.rdf

Filesize
720B

MD5
337617041380940392b84b72facaf468

SHA1
9fdf8ab18ed8ca56dcbb79d0986999864218c3ef

SHA256
0ba52ed73023e1d3985a8ee60f843cfcf7476346cdef24150f944c834ceab539

SHA512
d5d933888cd9116dce87ccb86c544efdf014b35e297294fc54c5dba829655bcc38072e7410e0f7f3e5db3bbc4ff69e10d0890a5ac70ba8780e30cf2d5da0c884

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\background.html

Filesize
4KB

MD5
3480785afa89d1488673363c11a8cc37

SHA1
38ea7021fc8c727641d1b0d9039b001188d3031c

SHA256
1796c0e441424d2b64f0dbc511b360442c065d61164f3618959f4ce2edd89078

SHA512
c8d951c1b7d18076c97c99f3c5b6e6ed8d9663b438cdf489734932b049a4878ba50dff57d59d3ab3f34ac33e6d48fa639cb39418ca92895962af0481eb52741e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\bhoclass.dll

Filesize
139KB

MD5
4b35f6c1f932f52fa9901fbc47b432df

SHA1
8e842bf068b04f36475a3bf86c5ea6a9839bbb5e

SHA256
2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196

SHA512
8716b9a8e46933bf29348254a68d1a21392bdbbe3b4d5010e55fe638d02cc04eb685e424d440f7c5b58ffbca82e5772dd95bef73fa831595c2ae9599f3b05a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\content.js

Filesize
388B

MD5
845a451109b51ea8a851c89884a41401

SHA1
94268e5f0f405bcd1856073664cb015c6148680a

SHA256
5ad199429b0530bc4f3ab8bbb326eaf2b6a2652a521e8690df919199ceddede7

SHA512
524c17441609cec8e3439468f9c4a857e14efe955af2f8a726420083dbe25609251235a5485a4517522fb8f58c17203a7d6e7cee9cd67e70b8badbb2498a7c0d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\lecmahflnanmehmebmaclgcmponffpmo.crx

Filesize
3KB

MD5
12041b53ee9b796316927c9db92e3ddc

SHA1
c8d83358f85a8ed8c9c6d2f563baca901b73ef3d

SHA256
d57e877b3f312eb8f4c3ccb9712686b7b050cbc883972ad49e005f4d76a220d0

SHA512
53076724195611ba7945f46beb8f2e8e6db83a1564dd01b8d66552e7fd5b10a71376c631ad366a70b108c71ceee56fdbb5dc0acfef9ab247d6bff2188dc85956

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7272.tmp\settings.ini

Filesize
675B

MD5
3c4e90a2c098dfb31195f7f3823a284a

SHA1
c77f5989a81d0552d185db9b1f81cb6787b2db18

SHA256
3a3c02b4111b7f5e744c5eadc6af1c6d30e61f18778dd980c344e30df675f6dc

SHA512
81325df53041dd37b57995b54c72873747ecc0df75512622691eef6e7fc5a009fdd6888b50a7184a355e787e4744c133b433faf7428587069ed9ca019106865d

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7272.tmp\setup.exe

Filesize
61KB

MD5
16ef6e914973925977cdc5ef6b8b2565

SHA1
4815da2815975b33f5dc94d482e6dbc02588afa6

SHA256
6b9a2b64b90799f1d50458dc38fb4e9e13a8abb37210c8f5d9eeedae84c6912f

SHA512
c74f0e17878c4598b626edb5e75e7ee098b71c0c26454ba709e2ea438517670ce11abf7d909470e6c935a21d0413c0d14b29960af9bd6a423e3261789a35b059

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads