c78a5a019f76bc54c4a13777717a05451feec0846410ea4d97776a51e915aaaf

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
11/07/2024, 06:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe
Size

313KB
MD5

381d1dd06981e0189b3e0361fad060de
SHA1

935a0772e01f3b6f6138f28c2d7ae537f9389b53
SHA256

c78a5a019f76bc54c4a13777717a05451feec0846410ea4d97776a51e915aaaf
SHA512

5d9309d87efc3ac1914e507c9b593c28babe0791164f43fda776727ae1672dc512b1f0543294ef8995fb8f386546a96580a0f75bc6b3e6a6b492c543c6154c18
SSDEEP

6144:91OgDPdkBAFZWjadD4sIzBUuveR1+WmOFwKoTSnATt4S:91OgLdanU/+WmK8mAn

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2456	setup.exe

Loads dropped DLL 6 IoCs

pid	Process
1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe
2456	setup.exe
2456	setup.exe
2456	setup.exe
2456	setup.exe
2456	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\ = "wxDfast"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000018d6b-30.dat	nsis_installer_1
behavioral1/files/0x0006000000018d6b-30.dat	nsis_installer_2
behavioral1/files/0x00050000000193cf-99.dat	nsis_installer_1
behavioral1/files/0x00050000000193cf-99.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\InprocServer32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\VersionIndependentProgID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\ = "wxDfast Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\wxDfast"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "wxDfast"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "wxDfast"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30
PID 1460 wrote to memory of 2456	1460	381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{63C0AF56-9E4E-2643-92BD-ADF05AAA60ED} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\381d1dd06981e0189b3e0361fad060de_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - Modifies registry class
  - System policy modification
  PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wxDfast\uninstall.exe

Filesize
46KB

MD5
2628f4240552cc3b2ba04ee51078ae0c

SHA1
5b0cca662149240d1fd4354beac1338e97e334ea

SHA256
03c965d0bd9827a978ef4080139533573aa800c9803599c0ce91da48506ad8f6

SHA512
6ecfcc97126373e82f1edab47020979d7706fc2be39ca792e8f30595133cd762cd4a65a246bee9180713e40e61efa373ecfb5eb72501ee18b38f13e32e61793b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\chrome.manifest

Filesize
114B

MD5
5eafe4d6ad0208069bbc2c6d8afb7187

SHA1
093c8f26d7869199d2cefeaa0f0eb9325b021b1a

SHA256
747c55ec234144bd5b8aa33ce4fde22ad12aa9685e678ac1541901f85244dc44

SHA512
ee24973679eb8b00c7e8ac4a374ceb906635b8ff7fabe2a854df083469ae5b73a14b6109cec982f6e3347a98c7166af0420746a77b4ba96300a2249109f924ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\indexeddb.js

Filesize
1KB

MD5
2f2c6a248e39b7695177c74b7d1c5777

SHA1
a809b780b921a22b814c8a6a962903c78e36e014

SHA256
cd9dcb898d98dd86dc600a94e33b15305bee3eeafeccabcb4e1cf6e55377e66e

SHA512
ca64b32afba0403f7325ebe33a4203dae480faef7c39433d56162ad2e6df1277f41e33408c5b41cf859a7dc27043e123d6d52c792bf69f27ef6509bbf4e26a08

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\jquery.js

Filesize
91KB

MD5
4bab8348a52d17428f684ad1ec3a427e

SHA1
56c912a8c8561070aee7b9808c5f3b2abec40063

SHA256
3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23

SHA512
a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\jsext.js

Filesize
6KB

MD5
2c8c8394aa5e5b810f701a4d8c9e94a7

SHA1
80048d7caa87432c0a52c1c8fa35f8a257e56b99

SHA256
2decf242e50c4acd0ebd1def085143eed35c9ba6736291535aef97c47676c3d7

SHA512
399856ff3fb9760fc07e36e828745295f98fee99a7bf9719866d33c1ebbbe08799a62daaf0c3576b7e935ace07be5d25440569d73e03bb8f01aa98a578a15931

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\lsdb.js

Filesize
1KB

MD5
2adbc47a069b0faf00f62e483b315d35

SHA1
21092fcfabafa9fde4af8d7af0396c8deeba41ec

SHA256
223a51ebb4d3ed97bf5977d15d109493ce598b0c14d0fd2a8b420febfdc674bb

SHA512
381c378620fe5e29f5a9b413ea11f38ce710dfc8d539859782f3e4c391fef9908ca59d0a3640dc26d7f9f552af60dfc5366a4664092948e13e99534900bd4426

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\prfdb.js

Filesize
1KB

MD5
e33dc05fdfec4ddceb6bc874395625e8

SHA1
89e136ab09e113a152db09e181b5004860d42d34

SHA256
42fcb12be49046dc771a8b491597f69d322a1b73d4e34011128015a4ddc6b2e2

SHA512
7218517a3b397dedb634c9c022c80862a451d3ad08255cf9daf9594e172922ec796d29100c452e42965dc9c93d343b604ef738c85b22841f0342477a3581229a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\sqlite.js

Filesize
1KB

MD5
c43f2f6b0c85c93037ae65c98d8782a0

SHA1
8c46b7c7627e56f993cc1c9adc6b090cdef911d7

SHA256
a99bcfc9ea1b9822eba062dd02e2158ffadd84e49c6bbed6631a04dc1be2ee47

SHA512
34655667e0370a0c2b866e86c5657c9eca24f302d9609c71d728051f81afb1e44dfb2e4254ae2f6c3a8aaab47d07779cfe22786e5314251c2e41ff976f4923d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\content\wx.xul

Filesize
228B

MD5
fc83a651781cad72b992bbf343e09642

SHA1
8bbba38401159c97c2362b86d666f1d9add21306

SHA256
d5b910acae34f6fc4c02854a9043266e121f9e71c32564654376cdd4fd60c0cb

SHA512
70483763296892dd9b911f037ddcd8aeae03009799a75946d9cdb4491ac8fdfddc8e178728f18e924cb70c26c8134e55c620a6ea174eb052142e0f9c2f9566b1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\[email protected]\install.rdf

Filesize
677B

MD5
2b99ece596fe8f6eb5eea5f9a49d8941

SHA1
b65448fd580b66ba5bd068baa14cefaf9d9d7c4e

SHA256
515e4a89d19546665425bbd1018fef6cb13ca01029e808eb6e70da26379cb101

SHA512
45e5bd214ab7f1034f4b91940f74dd485db1f906d7e81f2e3d502c3241d09ca9db56b5b85049a2ccc4a1d806cfcb80a790df8096bf8f6b64f93a814e4b66f87a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\background.html

Filesize
4KB

MD5
e25feb53a789efd767aa4a46c45d2952

SHA1
434b681e33af33d09a81d51973f07cd7b0ed420a

SHA256
3e7701e1cb0e7d3b63c0649ddd634f1341e2159c76b2d357924e0cb627dad5b8

SHA512
8fbeede49672ce4c1be328a3aedda152d022122581f8f7ba596e94600d8b9023e209c8d3c9d7fe0341738393d709187291c8cf2bf231909bc77c8371e794c9e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\bhoclass.dll

Filesize
137KB

MD5
ac13c733379328f86568f6e514c2f7f8

SHA1
338901240fedcef4e3892fd4c723c89154f4de05

SHA256
7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562

SHA512
35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\content.js

Filesize
386B

MD5
cc32021aaa062d213bc59535d680f471

SHA1
f8db6cbdba19574a78dcfc3c4bbfbd49e14c4e9c

SHA256
ff40d53aea835edce2900b888c21c76f0d97e5051be4dc7772be6d4ebd3ec9d2

SHA512
6e1ce3110f23d50dbc80ccb15004262b33082ecb1b13fc4a13690dcd4cddcf3b7c9201f5958bc64c35580dfd6290d319042e3fa65d5c712928b1f2bdebbd726e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\ihkmnbngldjicgkopooehpjghchopmjc.crx

Filesize
37KB

MD5
a8689718a33f5707a52574a9f0dd0579

SHA1
76396b2a7126b3f8051c04bed3b8dd618a4f5371

SHA256
0489008d11e310b9943aceb7c05ed5f89308e87208e0f8b924b915bffb9fd751

SHA512
43bb5ea83c2e16deb2bc5733b5e5889939dcf2baba21d8e5d671bb80e9da633a6bffd85f65cb20ea5c42a48278ae2d41afe05fe1a8c5904fbd2b4da5f9c77ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\settings.ini

Filesize
599B

MD5
e981ba1fae03d07e4a59b05ff2537655

SHA1
a10d4c84a20c807a21575236b1c6fc0c929a1e6a

SHA256
e1753ddaeffc2ca95a9f7ffd8ed5916a7eea56853f474d536cdab4857c25f51f

SHA512
7ad2b1b191b8bc756ca5cd2a4b1d05cfa8c3e4291fba5e979cc11a0d9d97f2f727cb0e5915d635c4ba687d54d0bd320025ccb075d7c389a2885f99619b0ef680

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAD4F.tmp\setup.exe

Filesize
61KB

MD5
201d2311011ffdf6c762fd46cdeb52ab

SHA1
65c474ca42a337745e288be0e21f43ceaafd5efe

SHA256
15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa

SHA512
235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads