48b49c1291744691c21c8a65595c220fea3a9aa1d45b17cad01eabc2be7aad97

Analysis

max time kernel
134s
max time network
122s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe
Size

551KB
MD5

083533795b8f09b0a11f69612f2b0873
SHA1

9a07861158782be1b909017bc16e0e10106c019f
SHA256

48b49c1291744691c21c8a65595c220fea3a9aa1d45b17cad01eabc2be7aad97
SHA512

fa8877b52e2e2ff8737ba3b63ca75c0edaef27ee9399fbde741148a0e2b3ae9a8de704a17bd960202fe8ef9e62dfc7637ff446c34e7cfcc0aa6d8d9aa6670667
SSDEEP

12288:h1OgLdaOBgbJuMmFcouJqkXWctn+MEfOV:h1OYdaOBgJHJJqkXtMOV

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\Control Panel\International\Geo\Nation	083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
4048	regsvr32.exe
4048	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nleeggejokdnjlkingbilbjlgcibldja\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\ = "sAvenshare."	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2629364133-3182087385-364449604-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire.5.10\ = "sAvenshare."	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\sAvenshare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire\CurVer\ = "savenisHaire.5.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\InprocServer32\ = "C:\\ProgramData\\sAvenshare\\cAWUO4Ad.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire.5.10	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire\CLSID\ = "{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire.5.10\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\VersionIndependentProgID\ = "savenisHaire"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\ProgID\ = "savenisHaire.5.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire\ = "sAvenshare."	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\sAvenshare\\cAWUO4Ad.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire.5.10\CLSID\ = "{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenisHaire.savenisHaire\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{52FA00CD-69AD-903E-FA0D-0FB34ECB4BB2}\ = "sAvenshare."	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 4048	2188	083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe	85
PID 2188 wrote to memory of 4048	2188	083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe	85
PID 2188 wrote to memory of 4048	2188	083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083533795b8f09b0a11f69612f2b0873_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" BbltGjR2.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\BbltGjR2.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
14adeeda4ac61489ed6e2946eeb71b05

SHA1
d2a5c47cda2506c8c188b28d313951cfe6ee0341

SHA256
8004158f1f1e213027baff8646c97bb897dedf5d5f06a251fed5652ddff7607a

SHA512
caa93df4652797958f2310733a833fce67eb89fde9989d58eac6348dbaced815f239a760ec3adc7b68f96e50ce25bdf3f1ceebfd33de84fe9a5df2ba0eba1aba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\cAWUO4Ad.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\cAWUO4Ad.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
2d3a9fe5f4207e1ac468d7a19ab8dd43

SHA1
4fdfb3c3f2136408b67c82889dbda4e0d0008abd

SHA256
a5ce93c754c1c29db38a13cc53f62b50a4f0e56f310ca25be07cefd33212445a

SHA512
ed0b32afd3cdfc20a370159cbe07b584215693498f84dce496fe71565dcbf8734e45a776cbb8440ce75a6dc892c5327cc010c1dab6e2bee2c0c42d2dddb72181

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\[email protected]\chrome.manifest

Filesize
110B

MD5
bc84e888bc3656014fef2a01469db975

SHA1
8cf7d4239b931901b24538d1aebb7741b9ec06c4

SHA256
cacde7d07a533772dc120d4fd5ed6ced9037f54cd68a4aa8aeebef31c7a3645b

SHA512
b87b9f18bb43476a88b1282417c01bb7ec0dcc115af1d7f551b7ce77dd901b43a29077650b6f0a5ccc718555d761c2f149dcf7d9a3d11ba018699eaebf89d6af

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
54d209663d53c098bc342ad9777d2396

SHA1
4c1737277fd6afaa8fabe8b3c341eecdcdc4cdd9

SHA256
44e4dc84939653dba0652404751c7d183941574b9a119220706825071ced11f4

SHA512
7fbc7283f9fd2eb654d85250753f706504042dea350e711f5978aeea9df9949055563dce03708ee6cd747a0299c6696d17cb5c3dc62ce17c6e4e399c435e14e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\[email protected]\install.rdf

Filesize
608B

MD5
d1ba1338d2034fc39e687f9a5811dd6f

SHA1
6763d4b1e1d929a47917cacc09d37d19dfb076dd

SHA256
b57938f441593ef803dc4b8067e932dd2b2c3633b5f4c0f1c10cd5af0542f935

SHA512
f0d0a50892176acbf021878fc1ba0a7b24acc183d0f1536e480587e6b281e3e74dbaf38fb56e2d9f7db22b4518dac9b3be19364063e38e41da7d95367aed3faf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\background.html

Filesize
146B

MD5
4452b9154c121ff65b16c45a653accdf

SHA1
14f74d60e0baf95fdd7dfa67b910a979796f0c95

SHA256
2c9a8368eeb1cad2dc16c356a8b46eefc34b0243a82686bb6acd05e7beac1d9d

SHA512
fcafdf104183800a4b541a5e48031e9837a877da0b28fbfffc8401e9593cab6ea43ef3151f31a80eb8a9eafc011676b7b316e5af2147f6a31de871a422622695

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\manifest.json

Filesize
505B

MD5
06d648a1bce805c5a713e938c134ac51

SHA1
89663912022eaac68f13b597793c51be71c543e2

SHA256
3e196267ce0fb16a12fef4f1cafadd48fa4c3c414a15d5d35f6c8052c552c6c0

SHA512
08780c71c9c1d3b968b69c14a6ea92c41476704d3d61f9169b4436f4f84b01bed1d9af9d468dd0719b1247b414fd92cca8f0b6a022acefb0ec950ef5208da463

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\o6Bfl2gda.js

Filesize
5KB

MD5
eb18a95dd9e78a4999a838cba04f5efb

SHA1
737fe086f326769b4fa3098b5d7503fbe30faaa6

SHA256
f25445f973e44c802bec90ebf14b0f6482ac85ff44d5320c5e86bff6f4cf817f

SHA512
b27c87baa10ac482ea47f12fa904f5ace115829d6e13cfeae59491d1624146763d9645f3f1cda1eed2c0bdb176dba5b171da76a2599dbe8f4a238ad2aed6b594

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\nleeggejokdnjlkingbilbjlgcibldja\sqlite.js

Filesize
1KB

MD5
1cc8f4dd1763bab3913593d24b57013d

SHA1
b76189978b7df4781896e4ea0e644c30abff44ca

SHA256
97b7b24514e995fd3e7b5b6bd1e56c123edf7479c43bb0ce0bfc663ef0a8f033

SHA512
3c4d5fdd3ac07ca97797ecb2c2941eb05d81fd340d7bb56c09f445cb190ea498d072325a1d0ef0c9d26e4617f312686d2579f8a22ff31ba4a2aa5ce7df716693

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS176B.tmp\settings.ini

Filesize
7KB

MD5
54bcdaea34a4828221a0b53801d0560b

SHA1
280410dab560b637c5f7060beb5b97761e025f64

SHA256
0bcfb351efef9cac8dbf0475a755b376b3aa40e0ef0cad0acec3db3ba9183b21

SHA512
35db179834186c02e7049e15351f28e0f6b67083fc491df79ec884353c800c05f3df003f78681b88ecfd46fc9f56a4b3101b31942e3c898288352e3d183a5287

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads