e325ec0017ada8944dab98b5960f0611c8daa9a73a9382530ed946e39516c42e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
18/08/2024, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe
Size

252KB
MD5

a4e72afcbba0a33b9c835a5c9cd3dd61
SHA1

514efb73c73ae22c03e7f5cb6c8fc93f9ef1734d
SHA256

e325ec0017ada8944dab98b5960f0611c8daa9a73a9382530ed946e39516c42e
SHA512

518421208f9f3a939b4b164a1aaae546b7eeebe3d3b9007af9858f2e2f2d105e2dd5afdcdd49a41dd6c704aa7888322b7f41c9cdd659ce1691021a1533b02781
SSDEEP

6144:91OgDPdkBAFZWjadD4sUAsUGvsLMeYxMk+Mcm71pq2hdm:91OgLdaC8xiK1pVdm

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3016	setup.exe

Loads dropped DLL 6 IoCs

pid	Process
600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe
3016	setup.exe
3016	setup.exe
3016	setup.exe
3016	setup.exe
3016	setup.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\ = "wxDfast"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000018f45-22.dat	nsis_installer_1
behavioral1/files/0x0006000000018f45-22.dat	nsis_installer_2
behavioral1/files/0x0005000000019418-79.dat	nsis_installer_1
behavioral1/files/0x0005000000019418-79.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "wxDfast"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\wxDfast"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "wxDfast"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\InprocServer32\ = "C:\\ProgramData\\wxDfast\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\ = "wxDfast Class"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\Programmable	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B}\ProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30
PID 600 wrote to memory of 3016	600	a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A8A1AB99-8DE1-DE66-52C5-5026CEFCA20B} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a4e72afcbba0a33b9c835a5c9cd3dd61_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:600
- C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\wxDfast\uninstall.exe

Filesize
46KB

MD5
8be20144dbd200c6de0c9430ed9280cf

SHA1
b81e3aacaaedd66ef0896acabc6983c94758e2b4

SHA256
634557ab79a29fe800721bc5f146a9b86799b72eb6755e821492f85ca66818a6

SHA512
fd7db954002be6332c8c6f4500fc38c1d5286022bb56f21b97567e837ee3d5a3c6db08cabcd2ffe405e7180918d6bb0b57b330703a9d045851901d01115ff94e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b9165e81934c746e3a33afc6bde86143

SHA1
ce38f37d26d5fa6309f4d42cbf470bc4a884b100

SHA256
3edbe3448cc74e7862db06fb08a8250c044a6aadbbea35a365560080eaaa3624

SHA512
fab8731e561554bf3ac4a32950a4111d3bca7d9223727ed6eccca598777bd697606a11f658eae3d28f6dae16faf40fda7387d0e25cd8f3cb750c871f77178bc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
2a4716be09fd70eea38dca92f81578c0

SHA1
41000f978afede7715d28a9396ce6ddb40d83aef

SHA256
7ca4468d8c949729b59abfc9106587df7158e1f8c07fbbdbc8d31cef4434510b

SHA512
24349f5875b621a1148aa33b04333cd30a92f98768b7f91fe3b4516fe7d6f0c63003b48c747437a24998debdbd53b97e74445af909fe08e2da5271b5b0e78285

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
b93a5742ff2f7d3725ce388a2ee66466

SHA1
fb56b1d563f4885e6af8849e30d8e3f4ffe5d0c5

SHA256
43343af7a318d429ba4c236ceb6f773d0c5b2414697178d0fcfd8242793c6b19

SHA512
9f62f0c9e79a423905087a8471ce16d43bb5ed93fe3780967896c49302dce29b1b85417a67afc0d72cb3f3a6338ea39670b9af2f96fcff8b4ca1b84671fdbe47

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
47b58cafae456d4a1719dca040e12c1f

SHA1
8e29a74ae06be70ffa63d32291a16879a023c90e

SHA256
34ffbfcee7e2495a23cd7cd24ff7675b728d31e1a1024ec9cefb9cfac0a6b333

SHA512
08d598eeed5e09f12044695a9ab900e8d27263a5c973b2307d6fab8126402cbb534557d8f14ce29c64bbefbfd55ceb290ad18559f52337323e2e22d2a1475636

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\[email protected]\install.rdf

Filesize
714B

MD5
c5e93e58b92ace85dbb42bd81073b5a9

SHA1
11793f2dd606c988da6bc23ca1040f698e8316c0

SHA256
6417c25408208ce362a8e5302d56f2c2ee44359b20b6f2c4a66a7a27879a1590

SHA512
0919f142fe85822ecd1a5c2ef89fddcd5c9d9fcd5e09cc9101768b3ef721700987cacfc46d1c584649f09ba22399f551369820c55a3107e502f37c9558dc45d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\background.html

Filesize
4KB

MD5
9e6abef3f4aa4695e296087a6c4ee38f

SHA1
609b45b728bc5bbc33979c93abe3ce3e32371b3c

SHA256
274f12a599da3dbbdf1b9953282b456c048b10da68f2211c56d747ad1a6b6878

SHA512
d4fa1f703dc0ad33d43b89d80d00342148e264a0fffb909b71a7363421ee4ed4a83ac9dd51550e1bf27483a40d6b96d5dc42e0edcec8f1206cc3d0a57049e8cf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\bhoclass.dll

Filesize
139KB

MD5
4b35f6c1f932f52fa9901fbc47b432df

SHA1
8e842bf068b04f36475a3bf86c5ea6a9839bbb5e

SHA256
2b4d643a8a14f060bf3885f872b36e5e1fe1e777ad94783ba9593487c8e1f196

SHA512
8716b9a8e46933bf29348254a68d1a21392bdbbe3b4d5010e55fe638d02cc04eb685e424d440f7c5b58ffbca82e5772dd95bef73fa831595c2ae9599f3b05a99

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\content.js

Filesize
385B

MD5
024402c9b5ac2c9813e7d8293baf8c7e

SHA1
1f0b838048be3a8636139cdf1fb426f3922e5df9

SHA256
7ff5672cd7782997d4fbd4cecefe866b36ecfdbd0b07e5fb317a7d4353fd026d

SHA512
f15ab5215bb953a4585646e56b09275657491755b7c51ba370b1ec099b0b907cfb5149fc8dcae7d83f7bc6d30af9a0df97ca0f071ffd77a23d0ce930f4aa31a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\pekphkjihkedkobdibbdiphlpjkfachb.crx

Filesize
3KB

MD5
df04de5fe175142d0ac02d97e1b3c263

SHA1
7f622fa8ae8401c80ff71305f244fd1ddfa894b9

SHA256
80896fb0ebe0f189f976900723f47886250c5edbdd0583c4e25ee1ca21f34cb1

SHA512
5a5d3e2645d583789365ceb011c0e56631fe6d596f19d04352edca37442a303d3bb06689f730cb009849d7d6bde981aaae0dca30df7c69210f8b182f0ed3c2ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\settings.ini

Filesize
656B

MD5
6b076e729aacc42deae8a8cfa173b0df

SHA1
a83c9f23acbde8977b358c7dca166fe685714215

SHA256
ed9a77d8cab763b7b7e879c94e3cbc95f84263311cfec9098b4e1dd8004f2221

SHA512
618dfe3f20121eea4aa4e1423a5c7c49f0e094925966a508f943cd90df8d62d9a8359ec2d557b15bd8e0c39b2e7189401fe672b277461c90d7bca45d50b0a20d

Download Submit
\Users\Admin\AppData\Local\Temp\7zSAD40.tmp\setup.exe

Filesize
61KB

MD5
16ef6e914973925977cdc5ef6b8b2565

SHA1
4815da2815975b33f5dc94d482e6dbc02588afa6

SHA256
6b9a2b64b90799f1d50458dc38fb4e9e13a8abb37210c8f5d9eeedae84c6912f

SHA512
c74f0e17878c4598b626edb5e75e7ee098b71c0c26454ba709e2ea438517670ce11abf7d909470e6c935a21d0413c0d14b29960af9bd6a423e3261789a35b059

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads