b502e2fbcd5fd0ed0f3969dc7ca8f72d42a000eb42e58d6c6dc3c3f40de0252b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

083492a11344cfed714541184b77c1b7_JaffaCakes118.exe
Size

1.1MB
MD5

083492a11344cfed714541184b77c1b7
SHA1

95754b08c2f1ebc5f7147bbc6582e3425ff685ed
SHA256

b502e2fbcd5fd0ed0f3969dc7ca8f72d42a000eb42e58d6c6dc3c3f40de0252b
SHA512

e6395f3bcf5b94cde8c9728191bda34e6d3b177a247d6c947e1a9f598e9871a72ced6ae8e6d209268245faef4722f6191d529ab5ba458d1e303ed1044597912b
SSDEEP

24576:6xllVmuE1SaAza3EQcGxCS2HcF2CqnRDFt8fsoLkqqzn+1tya:6xJ+1UOJcGxC3b3oL/3zP

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2072	VLkYIZqqS.exe

Loads dropped DLL 2 IoCs

pid	Process
2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe
2072	VLkYIZqqS.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fdcofjgbndgdklglpmonnhlfpaodbkfj\1.6\manifest.json	VLkYIZqqS.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\ = "Download kkeepeer"	VLkYIZqqS.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\NoExplorer = "1"	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	VLkYIZqqS.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	VLkYIZqqS.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	VLkYIZqqS.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore.1.6\CLSID\ = "{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}"	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\VersionIndependentProgID	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Download kkeepeer\\6cHujT3V.dll"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\InprocServer32	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\InprocServer32\ = "C:\\ProgramData\\Download kkeepeer\\6cHujT3V.dll"	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\InprocServer32	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\Programmable	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore.1.6\CLSID	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore.DownlOiad	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\ProgID	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\ProgID\ = "DownlOiad keepeore.1.6"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\ = "Download kkeepeer"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\Download kkeepeer\\6cHujT3V.tlb"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\Implemented Categories	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore.1.6	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore\CLSID\ = "{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore\CurVer\ = "DownlOiad keepeore.1.6"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\ProgID	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Download kkeepeer"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownlOiad	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore\ = "Download kkeepeer"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keepeore\CLSID	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\VersionIndependentProgID	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\VersionIndependentProgID\ = "DownlOiad keepeore"	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}\InprocServer32\ThreadingModel = "Apartment"	VLkYIZqqS.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3}	VLkYIZqqS.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	VLkYIZqqS.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31
PID 2448 wrote to memory of 2072	2448	083492a11344cfed714541184b77c1b7_JaffaCakes118.exe	31

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	VLkYIZqqS.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{BC1BAB52-BBEA-93E6-2F54-9FC8EF6266B3} = "1"	VLkYIZqqS.exe

C:\Users\Admin\AppData\Local\Temp\083492a11344cfed714541184b77c1b7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\083492a11344cfed714541184b77c1b7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Users\Admin\AppData\Local\Temp\00294823\VLkYIZqqS.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/VLkYIZqqS.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00294823\6cHujT3V.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\6cHujT3V.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\6cHujT3V.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\VLkYIZqqS.dat

Filesize
3KB

MD5
694a9efb482a63af9766a2399169b668

SHA1
913983551b924c2ffdeb84472bcf860fd07e61b7

SHA256
87ea3ae3449f14319fad4915454d36aa88aae5729d923423348c9fddf3bf1267

SHA512
d3fc9d35eea48e67e10c45af654af47fee14d5e1778ce31f1d2a415f583c4e75cea980933a3b83dc72626bc076bd250c47315dbc93f732af5afe7b14729bf707

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\CS6ws14LW.js

Filesize
5KB

MD5
ed56aadeb6a3230c6c1ae73f7ff68cac

SHA1
8191ba02013f7f2ca7e9009fc92119bca848f1d6

SHA256
a0c1fb788668f9f90073298ebfe4f1749cd1782003697c10864291432a741fde

SHA512
56aac21dac702f11eb3e16d6e98558658ad194019bd07146538b9cef209d5d9927965a7c77758fb5273433ab3587380a33a01801cd7f31003d3747a46c49c160

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\background.html

Filesize
146B

MD5
125400edfc0e66a1e6681bc219389fa2

SHA1
43cc132c1265f2182f7d682683d78f1f910c87da

SHA256
2a31d46a0dfcbc642fb9019400bbb52eb1d93de7c30d423a1703b8b5e102327a

SHA512
b3b952a68517025c6f8b320b9d52a4d62780a953f1cb812a104c2cf6ae6d72b6cc52b75f290f95948125e79a299a7f87131c2ee5cd114cc99a8faf9b9bf8ec6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\manifest.json

Filesize
509B

MD5
91ea3ea1af13cc982a3a4ef9d92a709c

SHA1
625e16653416232314f5a0d70a301eec6bf3e89e

SHA256
617a897183dbd4a1fa9a53c4125dbe4554281ccc619927025317c0d95a20468b

SHA512
4fb48514658bbdfa1901d11570cd165f13be4749bc5d4c8e717dcad6df4427fb45a12ea40312781d1a4d6b254de5c0e6a6e6c3d2c16cec668c9d5d9f94a91fda

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\fdcofjgbndgdklglpmonnhlfpaodbkfj\sqlite.js

Filesize
1KB

MD5
14a36beefa2a23cb4c9fe6d97868b6ea

SHA1
5dd6529cb1e134b080d78900b81f035949489c44

SHA256
26ce81cb5e6666063c8e86e224ba14c22f5f10bff9e65b0560e23cb4cf318df5

SHA512
acd122bfc20b263bfe1050ef573f18e9a946241626bac2f23476960406db48f8d920aa3fc75f66cce06e37f3c42dd3228e6429f9149590983f78922e98ef2b19

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

Filesize
110B

MD5
c728f81fb65923f4dfb22ed3bd9ed96d

SHA1
ff507821c7970450b6ef6c76eb93ea4ed8575938

SHA256
a0e00276d351d7731389d8237d1eaf489cc92c216c9d9bd1b9d9c10781bce75b

SHA512
7e0a40fe117ac3af73ab7683956b7851903193b7cc27458c4027e3614392c4218ab0d520c0c59cc2260e8b3cac18b1eb9afe9ac8d26ad36f5d20a5bd4f2b663d

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

Filesize
9KB

MD5
2e2f6a5806643adb9412cd34f2b986b8

SHA1
704d4246b836ffc2b839d5d747ac195f3e4f5a1e

SHA256
c2c3b35211b1b4445c3b7a236349902d7d48967ef559485d506d1537d5dfde48

SHA512
2b36f0b519e4a53a0c37adc4cb1457e5b9d338792845595783a7c257318fbf0aed3cae2d6c4c01b600546fa224357fd4f2af386bea969922788d212f63241ffe

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

Filesize
606B

MD5
7f3694f27a306a10e43c1d76db1e51a7

SHA1
131a250c4a0195ad7b71018ff743b29c4df38752

SHA256
1bb10e4f50e511fe976188815691d47c464c853aa7c96da3133d402b948f4c57

SHA512
a53c9adb31226b39924e079c674cecc92d427595cdfc9e4bb8a26d150dd70e67cce9e89a0a8b82dd12ef6b3430710d169de1cabfa57a21fbfd91f870d4d9d1d1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bhg31lui.default-release\extensions\staged\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
\Users\Admin\AppData\Local\Temp\00294823\VLkYIZqqS.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads