6ce1acc6df703a96f545dbe9ce158aaed7b469004a4241260ef6445e97ecc06c

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02-10-2024 16:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe
Size

552KB
MD5

0b9b9a4e23249b0afae3ad6885d82a1d
SHA1

fd3c4576c5831747b50c2e1b39f403d7b5d3127d
SHA256

6ce1acc6df703a96f545dbe9ce158aaed7b469004a4241260ef6445e97ecc06c
SHA512

83d98ddc2289722c61eace51788baf285491f6078cc80ae508603ce2d582f3c0fc184688b6385ea2773fc4fad1119cca5d5467d51d931b69faedf3ce4e35ba4b
SSDEEP

12288:h1OgLdaOSWctn+MEfOUgbJuMmFcouJqk5:h1OYdaOStMOUgJHJJqk5

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
3292	regsvr32.exe
3292	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cdkpojnkgeoegnojhhllnjdjmjgjhalp\1.0\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\ = "SearCCh-NNewTTab"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SearCCh-NNewTTab\\1vPaSx.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob\CurVer\ = "Search-NeWTaob.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob.1.0\ = "SearCCh-NNewTTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SearCCh-NNewTTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\ = "SearCCh-NNewTTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\InprocServer32\ = "C:\\ProgramData\\SearCCh-NNewTTab\\1vPaSx.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\ProgID\ = "Search-NeWTaob.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob.1.0\CLSID\ = "{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob.1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob\ = "SearCCh-NNewTTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob.1.0\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Search-NeWTaob.Search-NeWTaob\CLSID\ = "{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}\VersionIndependentProgID\ = "Search-NeWTaob"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CD51E51-7ED5-DE7F-2630-E288EA079FEA}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2444 wrote to memory of 3292	2444	0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe	89
PID 2444 wrote to memory of 3292	2444	0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe	89
PID 2444 wrote to memory of 3292	2444	0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe	89

C:\Users\Admin\AppData\Local\Temp\0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b9b9a4e23249b0afae3ad6885d82a1d_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2444
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" uI1FZK.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3292

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1316,i,1330210614411927383,9239043499051775691,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
1⤵
PID:1808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\1vPaSx.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\1vPaSx.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
010ba9f8692b32921d5cff7a0423b4c8

SHA1
e18e77e338a07d462bdd12779459824933647533

SHA256
00249df9eabe32300402dcd5f3d68d433798575072be5971d52af5ff54c92fee

SHA512
d4cd76c687a901d82e61a799e51f6816fe7c454b4b115c10e2b5bfe689d8d2a6dd5bb9e8eacde47f17d39504d365d133d8db3e77b1fec424ab2885988194f5d9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\VfyjrOt.js

Filesize
5KB

MD5
c41623358224ded66841ff12edddeb8d

SHA1
a4f863ea0f3f74bac7889baf6d7763491c34caf3

SHA256
5a61b77ef539a0373fcae54d4e8593964e6a9aecb329a97d413a048d7692b0db

SHA512
65cfb758825c997a816407053a7ea30d56b492adfee2f575dee1b46c8e64aa025eb01fd96c7b1059af157d1a057b27377ef07ea91457abffe9ff1667f563d475

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\background.html

Filesize
144B

MD5
83cadb8d8a2a693b2c312f984fa7b7d4

SHA1
9cb5d7e4f6e3960d8db6a1f0befec2a89eb8c6b5

SHA256
f841ea6075417ae6f333347a21fbdbe79d5874ed06008ca874b56bb0c16177f2

SHA512
b82e7cb429a3e5b03e88a5951b08e45b6fb3a5a9bc0cdec9a5ba94cf171dcbad86e0ea5184a97fb516d9d4ea67c8fd38240c75cc09c8542c3e43eec16682626c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\manifest.json

Filesize
556B

MD5
5b3ebb2f7bd441811899864c8c607fab

SHA1
15b012bdfa7b42e024f0ca1c7600d6a8d87800d3

SHA256
a9c53c0aeba5b5708bd9f10d0e82a88ff17abfb5adae57286df77eefd762b78b

SHA512
5402878e5dfbd0cda4652ba5f51b03668e58229672f961d524e27cbfdf2ca2266a6be1a7ad4236e5b0583b62b17b96aa8b7d8f5924a12c69bb8767c5c1ec84ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\newtab.html

Filesize
352B

MD5
b3bbe06e6da477ab9d2ec8fa1f10bf90

SHA1
c6f6f6be0520206b6916ac63a6876e2e7051922c

SHA256
d6e9953ee0cf52b4a0273c0eff2890de24da93caa47fda09d524a14ffd1b3886

SHA512
07020c46ea21bebd1ca638c3e483406d6668aa76799ef40b0069eaf35ab76474653327fa4b1066833faecc0bd055ab7399312359518424f9fdcfe98c2cf0f2db

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\cdkpojnkgeoegnojhhllnjdjmjgjhalp\sqlite.js

Filesize
1KB

MD5
ffefe59db0e7ff4abc22fdbd25fa7f2f

SHA1
cd7c02a48a46b2a8cd4665b5978ffc7534da15ab

SHA256
5344f7c4580b6b0159badd0bf2e4970da7423f0c04261b9d56b12107c3a7069c

SHA512
7f6abeb07d8c2d231a29dd9792ea2a09eff657453b67a02a4e60dd98c04c9f757e514597eb65d852bc3f3623c286b2aba336f39d02a59c744db0f4234c905420

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\settings.ini

Filesize
7KB

MD5
fcaff5df656ddb748daa84d26cc8ae74

SHA1
ba84ce5fa7e4f7aad7e191df2aac2c73a12a8594

SHA256
6bf738a5e2d56374ec3523c92cd4f569df38669e3369236fd2e5f31ca5dde6b6

SHA512
dfb98d3374ef4944a17e7aab564a0d64c27fd05a15e1ae1da5652f8c76fee3119e6a7e6e36d8953327ca63795daaa667f4692a70b0dc439a487e6e874f6a9d93

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\uI1FZK.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b151aae8f76b1b690a561c81c184b819

SHA1
622c8008669a30702ac0a2584a8a211e7cafa473

SHA256
51b2cf555b89a2f5d84239ebf92083775cbe389f1cf26c0ce86770f7031690bd

SHA512
beab6e67a911d2645c3d840318bd1189fa38698467183134dd8bdf39fb8a74059d1dd589a3f22a753e15867d693961bb6604eac6e94cac4c9f86d7170694e60b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\[email protected]\chrome.manifest

Filesize
106B

MD5
d2c168eff3d9b884ef5d47c631e3235a

SHA1
9faf971e281cdab5e913b67b57000aa2d7f695ce

SHA256
86fe321da0d28d38e660d8344a8ee85ed3753fceba5b5a2cecaccfa3990852e0

SHA512
1a84c03ebb9b3a5b6af8e511fac050b67b11384e2514010f09cdad5684b8a5749b200419d394fe275553e834d18877a5ccc330f5c5bbacff5583557d5494780a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
2ca7f64f39641cbadd6c7553ef40355b

SHA1
767cef40108655962456cb55b208a8840f252218

SHA256
840efe3e5938cc4886c7041515277ffe63772edb956c5dfa584a9153ad8be232

SHA512
5352bc2d4eb67edb0ace910c0935cdcbc128f32d2ebd4a092d8d698836a1b87aab4fbeb1ad414ad2c6e3f42c4e545a5e83fe80fd8c8b6bc3af06c1ffed824a2b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSF2E.tmp\[email protected]\install.rdf

Filesize
610B

MD5
520ef4b2a4fa6f69dc193b38b63c1334

SHA1
245f703f79bddfa78be3227e9068f0cb425f4212

SHA256
242bbd28364cc57fc0b47b42b1550e33f8e76686e24a54873fb3f8f37a299a65

SHA512
3790fe73f8a140a8f5d71795da8b75af6d443553cdaba4157801ef76fd25ab1ca990f490bf2559d877703922f3f689d9027989d1b81432e84830f29fec587820

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads