e389d3285f6297935ee0f885c84ccd6f801b210e51ae13e8fe9ea8005ab653da

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02/10/2024, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe
Size

1.1MB
MD5

0add416a4c5f1e059cd477052b5246b9
SHA1

4e998d6936f92eae94974ae6c60ba624c6abf062
SHA256

e389d3285f6297935ee0f885c84ccd6f801b210e51ae13e8fe9ea8005ab653da
SHA512

b8878841ec4b4ed7bc693d66c35aa1a2f4c2fba3b47205fe274a82a9651807b40395d9ae432552c54573d5aca2d82a58209443fe1a2a75488a226ba0a088da02
SSDEEP

24576:h1OYdaOrOBsFEt5hDG0SAMs9jR/jaJnTJdwY68+UhnWb3aQU:h1OsEOEt5hDG0SAMs9j8nTJ2Y68hWGQU

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2408	st9IeT.exe

Loads dropped DLL 2 IoCs

pid	Process
1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe
2408	st9IeT.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\igkfdgjpakhcfkmidoaombdippiaeiak\1.5\manifest.json	st9IeT.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\ = "safe save"	st9IeT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\NoExplorer = "1"	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	st9IeT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	st9IeT.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	st9IeT.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\VersionIndependentProgID	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\safe save\\NSL2T.dll"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\safe save"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea\ = "safe save"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea.ssAfe	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\Implemented Categories	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\ProgID	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\VersionIndependentProgID	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea.1.5	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\Programmable	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\ProgID	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\Programmable	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\InprocServer32\ThreadingModel = "Apartment"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea\CurVer\ = "ssAfe sAvea.1.5"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ssAfe	st9IeT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\InprocServer32	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea.1.5\ = "safe save"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\safe save\\NSL2T.tlb"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea\CLSID	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea\CurVer	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\ = "safe save"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\ProgID\ = "ssAfe sAvea.1.5"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\VersionIndependentProgID\ = "ssAfe sAvea"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea.1.5\CLSID\ = "{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\InprocServer32	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\sAvea\CLSID\ = "{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}"	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3}\InprocServer32\ = "C:\\ProgramData\\safe save\\NSL2T.dll"	st9IeT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	st9IeT.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31
PID 1516 wrote to memory of 2408	1516	0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe	31

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	st9IeT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{E3A933C0-9E53-BAC1-D8C3-F8846C522DC3} = "1"	st9IeT.exe

C:\Users\Admin\AppData\Local\Temp\0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0add416a4c5f1e059cd477052b5246b9_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1516
- C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\st9IeT.exe
  .\st9IeT.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:2408

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\1828505700.log

Filesize
3KB

MD5
d7bcaa8218203e30833d6c8e4b712567

SHA1
4c1ed68b9d980ada7b9d723317936c4f9ae29f3f

SHA256
357b6573622164a616ad5c2920572a9252a568a8ffa7eac018bffe5eb86b162a

SHA512
6df81b2db4b7a398abf5fdffd1dda47eaf76a513c0f5111a2395071ea249ac46fbd38e3edd3e97376cdbb3172be06b7380b6c8ca973cfc5be8963e7d45aea15c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\NSL2T.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\NSL2T.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\NSL2T.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\background.html

Filesize
143B

MD5
768399281f96ab2dc2229394193e6f1b

SHA1
28f80640ee859e0726c9ae591e59a29f70c2a575

SHA256
9f783f6c447d61d108c593a1e6bd98326adbcc9022e1f2198f0b6ce7549f69a4

SHA512
0b61a574380b03b1cdba3adea12ccc3145575f23012e408e26208bc717567983968a3822348b0b3e5e0221d1f1c3293e47e62ff52a41e23eeecdbb453bb69b58

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\manifest.json

Filesize
501B

MD5
977e11ca13c3e242d4a436e3f7a31661

SHA1
3e40072591e887a3558eada10ca5ceaef90f3118

SHA256
fcd05ee0e7ae52ad61014b65bfe87e8185feb6f6352f3103cef2d003a6b766cf

SHA512
7a23081aafd38cba0bd1f1046be3b15922448280c6a338684f7f1ff5cd938d78935f380c0860deca6a89f8eba77b0d46a1362cfc17ebcf28c0459705f7e1ccc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\mcX7jG.js

Filesize
5KB

MD5
9ae43e2e48e1b22eade4eb14d7d5c157

SHA1
12ef9110b1f33376918af3158f39ad9210c48fb5

SHA256
e3b150e74b72d312f5355bfc5126702bc958b89443bf6ca89c3638a4f7285627

SHA512
9c8bf9d27bce3cfa8824795a15164f58da6697aab04def6cd70003d91899e7450bf383f7720e2741c83d85ea0bbc64edef5414ce95326dd287ab42bd78c1b3c2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\igkfdgjpakhcfkmidoaombdippiaeiak\sqlite.js

Filesize
1KB

MD5
d10d25b488e3c35bdd270e39cf00f5e0

SHA1
d3eb189b1fbbc12bc963056018e5eee27a7e3a8d

SHA256
47bacf707bdf01513c4e80503d0995870f0da4316fa4d6988c6110b74bbc3831

SHA512
ef54f9accdc75ab352ffc53aa86e0f4b11cbfeb304fb9a6c8c4b88302500c625df61284c696b49686366a1cb15971d8bf2b8a5f6aa9a6ac2c86735a7d884259d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\[email protected]\chrome.manifest

Filesize
104B

MD5
d2a61daf32a1c84ccd01256bd6b16e8b

SHA1
e529ba3388972713e6919446944d7024813d2166

SHA256
f3a567977b4c3808e5ee4d2eb5eae176f4a5fe52a46984a600aceabd9d06a0cb

SHA512
e984d7cb6c4edf8c7d95450c529f3e7e8dfd8ea081550e1db362269f824b935d4746fa92639c62aa4dbb4712471112331d22044e837b4923ef9204289ebfe9e7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
4f92b08b06b475363574ba96e91c89f5

SHA1
dc506ec14cb6c55cfabfa9b7ac8a12dbd00212ef

SHA256
c9d57f0aea1310c115138d20e6ffde887e5452b5628b379d5995bb9e2a914d48

SHA512
053ac10f8db2c201ca39707ac2f1e927241ba7e3e7ef0c6a6614ef1d6f7b02a75fcbb14e375fdc8a2a254b4d281e701e0d79debd85a3bd357e0bb4fdc642af2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\[email protected]\install.rdf

Filesize
603B

MD5
7a65bde7ca3416933c6aff527ca70af1

SHA1
1bee4bc49afe964d241ccbc48a26815b3d475082

SHA256
759742ea82c7f2a535af068a0983f6034cbc640a47fde889188e3a4d0e0ecc9c

SHA512
93f4dcb6208405f55ef8347f4fc4087c17a723a68b04d84a7c9d8a03a10c2a10c3b96128993dde20041a82f4c46a3e9c044246d1d5bb9384a926cea3622f1e9d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\st9IeT.dat

Filesize
5KB

MD5
0d8d6628148455449fe0061ee4d9336b

SHA1
0cf90917b00118687383e58e104f56ef1919801f

SHA256
77caffcacdaee7908417a8263a5ce538919d6f0923ccf95cd063d07350af270b

SHA512
4e13fb4a5e4a9b1215e34ec9a70e8445ce45437baec2972e76917cc6ba0f765e6d3b15d783926ad4aba49f7bd878db8b86075362c49f776bfd2e199c414c1da0

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE6A7.tmp\st9IeT.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads