ff8c84302b9e49c8e06e3b1a2bb3c18dc084a350fd047f3da3c4ba7ba1d3c6e8

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe
Size

551KB
MD5

04c05bd408ec42992f2677de4ef810b8
SHA1

ebc1e01e8b494a456148b2a2e27a918715a08141
SHA256

ff8c84302b9e49c8e06e3b1a2bb3c18dc084a350fd047f3da3c4ba7ba1d3c6e8
SHA512

c1306d984673b9ddd953ee6717676e5ed041aa34194281e87d46597abd2af9523aa8be9224173646d775ab6c794f72491806dbe19026992b8f3b0311f1920735
SSDEEP

12288:h1OgLdaOngbJuMmFcouJqkXWctn+MEfOL:h1OYdaOngJHJJqkXtMOL

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2760	regsvr32.exe
2760	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onglgjdaagfnlmeifeehemfgbmgmajkk\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F771C344-4BEB-350D-05CF-F8C892555F84}\ = "safe sAvve"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F771C344-4BEB-350D-05CF-F8C892555F84}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\safe sAvve\\TxaN8puNb.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE.1.5\ = "safe sAvve"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\VersionIndependentProgID\ = "Safe SavEE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE\CLSID\ = "{F771C344-4BEB-350D-05CF-F8C892555F84}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\ = "safe sAvve"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\ProgID\ = "Safe SavEE.1.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\InprocServer32\ = "C:\\ProgramData\\safe sAvve\\TxaN8puNb.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE.1.5\CLSID\ = "{F771C344-4BEB-350D-05CF-F8C892555F84}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\safe sAvve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Safe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE\CurVer\ = "Safe SavEE.1.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE.Safe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE.1.5\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{F771C344-4BEB-350D-05CF-F8C892555F84}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE.1.5	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavEE\ = "safe sAvve"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28
PID 2284 wrote to memory of 2760	2284	04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\04c05bd408ec42992f2677de4ef810b8_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2284
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" RpnP9Eeqn.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
a385958976dc7bf440403f9cc7225255

SHA1
f892d17d63da0ad6f1e1c070a6412f55bce98f28

SHA256
ce2e75ea82bdd066c367e846226846e5d4c5ba12e9d9169a1ffcfe712854ea15

SHA512
a9a092ec66afe7de52793dad3a9a0409e2d629a39b68944306741356b00cd3d2a0f382ab973172965b61d46eaded37bc3af497db515a26f807de6575b78a9dfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\RpnP9Eeqn.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\TxaN8puNb.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\TxaN8puNb.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\LUBWZ4m1Kb.js

Filesize
5KB

MD5
d5261a3c5d182de201c18f03fd659583

SHA1
157b96324f2a276e3cea7dd7a299933b7ce8dc35

SHA256
df9f4ab1f90f49f8582861fdbc4cd5efa26d61652855a9a13872b6b8fc782ccb

SHA512
9ffd2cc258b602e948aefb69fa57758ff32c35366871cb4a3941f19b56b3784133f3c13424fe965964de1806dc1e80572ca3a000ee6f51f15966e1bf91c33033

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\background.html

Filesize
147B

MD5
1a001be8d1d2427cebe367a2363f69e4

SHA1
96370343479f4396a9783e5a36dc635495a0cc6c

SHA256
9cbd2741bf74d7ceee894cc7b30f90bfc2157ad11942e9a91662817ab22df3e3

SHA512
da51351910ad48aab39bbb1490375f6363abad6bc526cea1517af3e4bb6b683e7cc4d7c13686d50cae76d31de8acc7d84a5b65784f3ce7cb928079aa4191fe5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\manifest.json

Filesize
502B

MD5
dee954958375551f8a880b09c7fafb0d

SHA1
b1abec6daf31fd98f08cd8ff6e505432cf66309c

SHA256
28501c219d42b842b82d68ffd8b3ce909460d7c79d09dfad7e7e56f7660ee02f

SHA512
21459759829953ace4c7b8176fc498dda399a94caea6a70fbf21076c908bba1266c9c0867d3d1016ffecedd0ad23be3f61c8e57dc12f0e665f1a1c2754c2d4b2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\onglgjdaagfnlmeifeehemfgbmgmajkk\sqlite.js

Filesize
1KB

MD5
b9d80353785b261d0f55b69bc5e0e144

SHA1
359c638d3998ed1f132626daa2268e211fc4663d

SHA256
394bc26247276971f82470d0575d94aa2c9a8c873b9e4be12b7fee676d3d09e6

SHA512
edc69ecb43745584efbc3d1821568adcf1dd8ab51f39da30b0df05382777603ec760d8c10c2acbe8be4e5d996c083986d26e68c2cb83ce3b8685234d325317b0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
d590f40330cdf13c54e5e9ccd469445a

SHA1
68a1c16252b8cc2416f5d7e728cf4d23458ad80f

SHA256
00847d03c308505e108c79869c6b509480261164cae3cc7ddae9b412aeec628d

SHA512
f65f1d5487fa912983b9667d7fe14991b3a575248aed0fc31aa1951879d8fdea91c91713fe195058517d844c5bb4c49f7c6b9bc47786e59ec0872be58306f8e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\[email protected]\chrome.manifest

Filesize
112B

MD5
a01d7cf3ee54ff1afea13c2c3995ac6b

SHA1
271080dc17f1f265a0f5da57f16cac9c1933c8a9

SHA256
16974e695e086234993136864fe5aea8961c2cdd2f71281c4e16c1522c2b8a12

SHA512
5ced8227222b8da54825829ec1675778e443462da6cfabd015e1e99c7afedf9636708ed4da50335efd11d2a45dbce9c3ae0f123a2f5239f8ca4d74ea4b98fcb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
96d26b942d8a554231a0e3c50a288f94

SHA1
b46aa8793871533b56e972236304110e7ccab8b7

SHA256
c7c830974c309f5d381c0631e5f58fb6d212c9c9178c7ad14cab7e317b33fabd

SHA512
59e9eb02098e19a25fbaff180c81eeede00cd19cdcc67255dd8c59dc2d03b337a065bf71e949397623e49d25d5cf7f24c0d4a7a3961404eb1c6cd3c0a8dc6776

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\[email protected]\install.rdf

Filesize
610B

MD5
e0610c3349c042108e4a84d6773b47e6

SHA1
6287885624df0219782cb183f8eaca47f777d7c3

SHA256
0d83b40ead604c4ae3e51d2a006ad81f35403bc20e210f76013edc8403ea2ef5

SHA512
fc30f4735d6f4fa65069952254b97851bb9a44bfb3da3c202e9060db6d11d1525ffbb783e06a6e3da65c4ada3b2ac1dd283eb2477294807923ae6406f358918a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5A31.tmp\settings.ini

Filesize
7KB

MD5
472cfcc4e680df2f13b053a5170f8f25

SHA1
ae46a5e8cc19d6c7b9eded2e1fd3e198196bcce3

SHA256
23f761b38d2c20873c38db0f89d6fa96ba41bfdca6dc228d59e20206b793fd3e

SHA512
bdbe814bb7e256e8e2dbc3b03341ac2bef889331b44e5b63e7dcfc75ddb2176fdde8cffdab273c6b82ca48e7defc84b40b637691f47f541bf8d4e7360c56c051

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads