1daec0cd386281b08c57a188ca59936950c542495fbd137a8b60b1b5f8cd8404

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe
Size

255KB
MD5

0830bf730a1c952822b41635af7ee196
SHA1

fc89f4c7e421769151e3f036eae093d5f6960d5d
SHA256

1daec0cd386281b08c57a188ca59936950c542495fbd137a8b60b1b5f8cd8404
SHA512

7466a745b3305b4eae3a22c292b468e93a81bf9f2dfc10cfe3f17ae12ac6a4d571813fb96e45b4ae275d0d529bdacc3a14f6fc93b790e50a5dff6cef0a1ee8cb
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5eIHar/OAH0HLefQDZ/AJjs:h1OgLdaOeIWFCLa6Z/8js

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0005000000019fb7-72.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2128	51f4f2f28258d.exe

Loads dropped DLL 5 IoCs

pid	Process
1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe
2128	51f4f2f28258d.exe
2128	51f4f2f28258d.exe
2128	51f4f2f28258d.exe
2128	51f4f2f28258d.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oojjpdjdnjbfjdjifldknbbpdfhaggec\1\manifest.json	51f4f2f28258d.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\ = "GenniuusCaoUpuOnn! "	51f4f2f28258d.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\NoExplorer = "1"	51f4f2f28258d.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019fb7-72.dat	upx
behavioral1/memory/2128-74-0x0000000074DA0000-0x0000000074DAA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51f4f2f28258d.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x00050000000195a6-28.dat	nsis_installer_1
behavioral1/files/0x00050000000195a6-28.dat	nsis_installer_2
behavioral1/files/0x000500000001a0b7-94.dat	nsis_installer_1
behavioral1/files/0x000500000001a0b7-94.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\GenniuusCaoUpuOnn!"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\ProgID	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\GenniuusCaoUpuOnn!\\51f4f2f2825c4.tlb"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\InProcServer32\ThreadingModel = "Apartment"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\ProgID\ = "GenniuusCaoUpuOnn! .1"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\InProcServer32	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\InProcServer32\ = "C:\\ProgramData\\GenniuusCaoUpuOnn!\\51f4f2f2825c4.dll"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f4f2f28258d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0}\ = "GenniuusCaoUpuOnn! "	51f4f2f28258d.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30
PID 1644 wrote to memory of 2128	1644	0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C6CDEF96-E805-7997-F22B-A80DAB9E53E0} = "1"	51f4f2f28258d.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51f4f2f28258d.exe

C:\Users\Admin\AppData\Local\Temp\0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0830bf730a1c952822b41635af7ee196_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\51f4f2f28258d.exe
  .\51f4f2f28258d.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GenniuusCaoUpuOnn!\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\51f4f2f2825c4.dll

Filesize
116KB

MD5
05234975b085632d70d89c2f420c5107

SHA1
078fb2a3e5de54c3737a4541242a4725c02c6b9c

SHA256
a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a

SHA512
f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\51f4f2f2825c4.tlb

Filesize
18KB

MD5
c1e296ff01d3cf37f91c7473bdd9de52

SHA1
832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6

SHA256
a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492

SHA512
aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\51f4f2f2823d56.44549355.js

Filesize
4KB

MD5
d67cce594a208f03535cacc6532faf2d

SHA1
d09764f7867c30a663dc58687594f25ed80b1203

SHA256
c7f2e2a12947466e49ae3332dff29d0e08ef7667311b898efe82d7254f0dd7d2

SHA512
a40253a3b42b53bec72264fa399ae8c1b3152a20dc18ab9289e4fbf8547b0c91dbf45acbfcbb107cebea4e1b41938d0c41476b83bf7110ec29c7b9caa89c5336

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\background.html

Filesize
161B

MD5
ecfdc05662533fcab4b2667c47ee0b2e

SHA1
9687fca0eacf546d590444120acae1f64fcf524a

SHA256
76755785f54049f7a323848c2d6a0734c5f46e937f84ca8d1026e60bdb9a32b5

SHA512
bd6785e6ad9cab9ca576316a6e18a476a175bb77ca05b548b42ebea10b256fde957e519a259c0d26a0058d99a59998da0e43dcbb4dcf1412af2e82c139e33e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\manifest.json

Filesize
512B

MD5
8a072acd815404895d6fba60d2874e34

SHA1
01760e9659b7d0f59659b7f6c43d584b4c508eb9

SHA256
cd7175340c811d721c390ad4a6bf51105db70f4610314a794bca140006277685

SHA512
96afef3dfdae2e933c0a340eb94ab5ac661f071f4326c97ceac637adeca1987a51212a7253c9747a041cf375a46b5d66b0cb540d5911a08f8c0b08030e0f3aca

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\oojjpdjdnjbfjdjifldknbbpdfhaggec\sqlite.js

Filesize
1KB

MD5
5512e4a4009a862325bcc5129c113180

SHA1
378f3a843edb9c4dc7b2cac3c214b07f07400a04

SHA256
ec0f9bff9ca90fc7e8f8914a6355f171a2d13a562a154ac5551520fb409ad6d3

SHA512
728d5c73d8a90759764efaf7cf9f419ad54321786b528ff185f07bd06a13000ed96f10c456c5ce7229f145a12e46b8cbc9972576454ce39fb8186a66e7c450fe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\settings.ini

Filesize
6KB

MD5
f14b08ac0c0fb8941049423a3cc4d53f

SHA1
bbfa1666aeb679046781e3f205ac93313e1dbcf0

SHA256
c9b582d8954c275dd340b3521e0fba918a1022b0da45ee78d48718e078e8288c

SHA512
d65c8a6100beb6256e2aff5e0632ab5085e807759faa8a68c5e69c572559c05c0b6126c86b50679072cb96b0eb909bf252014ebc9b2cc214e9357ab8e25bf28a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b650beafea010f9932ea2e0fef83f849

SHA1
92a73242118930d1ab508f1191f070a9f88f6fee

SHA256
7f907d4ce64cc1f351d842907559b0f09782d72f6f0a40c4c39a06f7dccf685e

SHA512
7105172482a58bd5c90aa08cc27490293d29789365d1967d86db37b68cd1bb7bf7d5480befae23059828149299cdc5d59ad339db98eb8950ee456e58d1890b3c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
21c1c7292310270cdbe2e30bfeb1180a

SHA1
1869ba0ef548ccf3df857a8668ea3e8602a10fb5

SHA256
e8a36eea6ed7930f89881b628f0dba1acfbd82d24ef6c8f627b71dcdd5233391

SHA512
419e05f4cd4293233584399e7efea184935ddb658dad8b8513eb383f1ba27e9dffe72161d7fe65e373ed8a989cc5681631f4d00697ebd550605b5eba488ef707

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
3f11edbc14fb2af43a722a75af3de140

SHA1
9168f036cbbf525a14072da5fbb4a7890cd4f48c

SHA256
013abff323f22a4a0f247b98c610de78c20b283a9731eddd7db0cd1003cc1943

SHA512
9127e31b50fe509114c5ee54200ba60a547ad19e95054543509418f2d00b7c139ecc7a690f1896addc81d811e0380bd96d72fdfe82592bad9b32727920fcc908

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC207.tmp\[email protected]\install.rdf

Filesize
612B

MD5
7faa8a9ec547a1630547f1834e4dc76d

SHA1
217d36e93dbf66e2b254c6d2a988ad0e58d8317a

SHA256
1eb803fb26ccecc815166231d2e78b58094a736ba034f500612b0144072b6df0

SHA512
fa56fe778b10a13b792f29f8b5dee13e51ed8cf9397b6e7841e109647014458cb64c82310476188f894e8b82c6c68dbc05fa328b9511f83e70f9cde68444fab6

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC207.tmp\51f4f2f28258d.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC285.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC285.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2128-74-0x0000000074DA0000-0x0000000074DAA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads