64b5aa64283438737541746951a72e0a6743234718621be5466fdac8d9894c0e

Analysis

max time kernel
133s
max time network
123s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 05:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe
Size

551KB
MD5

047f72cdc026620cb8db9dc192042425
SHA1

76600993fab9c5a830cf2871f3391f17dfa7b880
SHA256

64b5aa64283438737541746951a72e0a6743234718621be5466fdac8d9894c0e
SHA512

f19240cadee83f58ea0477e4680414ad66bd69d4e7613ac6d7965fabcbd80fa71fb20e4987cc39a7b5f524fcdb3e5201a8e500c4173f0bbbd13e18e273b9896e
SSDEEP

12288:h1OgLdaOlgbJuMmFcouJqkXWctn+MEfO8:h1OYdaOlgJHJJqkXtMO8

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
624	regsvr32.exe
624	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ffehpnjheclikiiopgaailahepdboebf\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\ = "ssafe sAvue"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssafe sAvue"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CurVer\ = "safoe saVe.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\ = "ssafe sAvue"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\VersionIndependentProgID\ = "safoe saVe"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\safoe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.safoe	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\CLSID\ = "{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\InprocServer32\ = "C:\\ProgramData\\ssafe sAvue\\hxP.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CLSID\ = "{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssafe sAvue\\hxP.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\ = "ssafe sAvue"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CurVer	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\ = "ssafe sAvue"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\ProgID\ = "safoe saVe.1.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4B0E251F-41C2-A68F-5DB1-73A856A0EF30}\VersionIndependentProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3512 wrote to memory of 624	3512	047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe	84
PID 3512 wrote to memory of 624	3512	047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe	84
PID 3512 wrote to memory of 624	3512	047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\047f72cdc026620cb8db9dc192042425_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3512
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" 6OE.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\6OE.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
eddb5f572a8d8bde44789ebea9ebdbd9

SHA1
3e9b62129fc33a22acc07c6bb576c876897f83b3

SHA256
8cdb71fecf52b4dfc999f9249fd7f370cf8797604d32af99c11ab8a4ce5a4c31

SHA512
6b21b1243d861f14a7d0c868e18d98739846990ed8e7a0ca45d4a8545c1826bc3839e0838a0caddfad22ebcf9120ba14470a8bbe7156624698b8557cd2457bff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\background.html

Filesize
141B

MD5
6b1080c1c30f36b78c3863431f828800

SHA1
dd02fe0665e72264c2ec9a814f6c32bb3fb5a1bc

SHA256
7ebd1123e396b1f6d8124496553625e337150fe59eb4f3c2724fb69af055d313

SHA512
7605657440ec7847d2fff46772a2bb1bab86e41a736644b6b46e675b9dca1b49adce68a3d8097907174e6590616039912268e01f9002ee7cf21450dc71d89a40

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\manifest.json

Filesize
503B

MD5
9050256f6fe24eaeb34a603147075a63

SHA1
49ce1300a41e0413715875fa89ddd397eef69eb7

SHA256
dca0a15010ee8a94168b4b2bdd3dd6127471e525b818b7c1b73a6669d51d4b5a

SHA512
533a0c94edc355aa8ca90aed0633dc3d1948e8f9c69ef115e172b29697b29e2bdb6cf0352303a339c0b7241fba11387cff3e19a33348be6828f4cb044b18a219

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\rayb.js

Filesize
5KB

MD5
f2b462e65600ad3cce4fd9b7d60e8237

SHA1
f6464b192e0b8418248d5e8d2188a93926d81621

SHA256
d3a2cded1d5cce0e2f5d775086e9c47644b16f51a18065492b81d143bb39c495

SHA512
6a91075f39a8d81cf68f78b6ca1705441fac99e327366b11f5f9cad147865dd3593fe31cf70f44baf5b032388df74701f2ceee2d6968288dd545bf0079c99bd6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\ffehpnjheclikiiopgaailahepdboebf\sqlite.js

Filesize
1KB

MD5
c2bf369278f238b82528ce9293f9334f

SHA1
2039509e34fd74cc82d1997455d842d731e38554

SHA256
b3cf57cc3e127afe03a0758b381cdc962cc2d23000276c74c379ce559ed666d3

SHA512
c15431bd67cb25febee598c067bf4f0f6ddc2bf14cc2d30c611549b3d782ae794d7c2c30a076458dc3deb2b4e925e6f065d1bd588032e51596f1505086ef06c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\hxP.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\hxP.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
639d7ee5f785b9923dc453a2d86e0319

SHA1
2d40d8677e0b8636354c4af251703b974ee5ab2f

SHA256
8afdc6bf9cb9526ab79d1c96f4bbf38f0117d6cd426c100c772ecc9d6452d8c6

SHA512
cc119fdde8e611775ebb3b2670f92a573ddb21ea666c21ed629f48f5f46905c56db36e998e32c7a0b37554dddfbdda7c9d728e2b5bc0e1ca028a42779f09f64e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\[email protected]\chrome.manifest

Filesize
100B

MD5
fe7a1f8f2f39832290d61bff8dc017e9

SHA1
4cd4f0eef10d4fca38aebdcfa0280dea747506b1

SHA256
f009525cab5379088339c75d6d40b9a2288814a097de01f5316b275160860b5d

SHA512
5e3801527f5d1224a662b466a89e3ad352264f039a8d87ee921df3997de99c0d4c710f720c920e52221c7835abd0619dd3a60dafd1f21ce481273d72e2f751d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
9037db327ca66739692e427badcd991d

SHA1
6131de151dcc4d9fbf327e75c1cc0fe630e40d6b

SHA256
7c1542287aff04d8a44ab8e7631fe16ef86f48490e21c87536791072fbeaca15

SHA512
46cf90980cf55033d6d023e5425ba79c4b41d85781fb4a46533add9d1cb812ce22ee88e65623de0c1475640bb286d8d546a8a110cf61af501076e0f334553a12

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\[email protected]\install.rdf

Filesize
605B

MD5
f99c0de1453a4c28baca556902d098e6

SHA1
00d97ba678b27b53fbf0b0d70e9a5fd0bb354a94

SHA256
8808db16ad737b77a9cf828b2f9eb2667ea855474463117c607836a7ce2970ca

SHA512
61a2c0956efc7c35d3cdb66239d78c28da72d428d05ae74f83c6b1817a9f56c274e2493e1849e2b549f549d7a5e42733629e2c3e31a30d61f53a40d94c77f60f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC3EC.tmp\settings.ini

Filesize
7KB

MD5
5a530d5227ac2e465f75ad745ec8ac69

SHA1
f67bb313783546896594aec64f0011f200f09f14

SHA256
2da5ebe2b6fd9e8b3d5013d31fea670289c9b99817d5a914d9ffa0b4ac223832

SHA512
f673d0726d1a419ad28bbe0c2a589d1af5fe3ccf7ee812bb32f089bd3ca483c7ed9e78a08c74a7ce3345c57585e3d547437eb1245e6d6011181ebacb56f14fec

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads