a854829f53d1cb13a566176c95df22ab16e9ac22f1b8f6b5bae98b8a3ec296a3

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 15:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe
Size

551KB
MD5

0b70d1b0f6bbf80853b9691886936db5
SHA1

a988daa7c70ec2e1780bfa224bbab719c8cb8348
SHA256

a854829f53d1cb13a566176c95df22ab16e9ac22f1b8f6b5bae98b8a3ec296a3
SHA512

5d3eb1ae867bb3fa66a221d5883fde4e7c122c4688a742462bffd81516c2f162bfc5a2e5d44b63f98ea35e2abd7b5b8bc53af81a5fced94de43fe654111dab26
SSDEEP

12288:h1OgLdaOV5CwJdBgbJuMmFcouJqkXWctn+MEfO7:h1OYdaOV5CwJdBgJHJJqkXtMO7

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
1404	regsvr32.exe
1404	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lpnafdiaplfncgpgifnbccmjpblpemnl\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\ = "sAFe usave"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\VersionIndependentProgID\ = "safe. saVe"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\ = "sAFe usave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\safe.	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.safe.	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\CLSID\ = "{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CLSID\ = "{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\ = "sAFe usave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\InprocServer32\ = "C:\\ProgramData\\sAFe usave\\nyv8OWrsd.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CurVer\ = "safe. saVe.1.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe.1.5\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVe\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\ = "sAFe usave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\sAFe usave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\ProgID\ = "safe. saVe.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{EF63C0E7-4034-7FF6-F95D-E6A0DD17E2BB}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\sAFe usave\\nyv8OWrsd.tlb"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 1404	5088	0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe	82
PID 5088 wrote to memory of 1404	5088	0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe	82
PID 5088 wrote to memory of 1404	5088	0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0b70d1b0f6bbf80853b9691886936db5_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" H1DPnm1kI.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\sAFe usave\nyv8OWrsd.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b204ccb36a4377842197876beac48ec5

SHA1
2820da5b694c0d7078e21f1ba5e13f00cdf4c9b4

SHA256
151bcbd5b15aa7d864fffcf173f061947b0c05ae96fdf4764ec05f6bb865f12e

SHA512
3dd4d8405f258f1f3b2664418e82602b7060727ab50e72ff7d9cf4cb2da15ac77dd6029d9ab55783ddf5e2695fb7e63edbf4742194f5b4802fb9146b34d1d134

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\[email protected]\chrome.manifest

Filesize
112B

MD5
51f89b5841f3a46a9202f81619343e70

SHA1
b7d6ff71196d9671ce5401762d24c0b7ed4604fe

SHA256
f60bb5f7a8dddbdc8cafc8cc611ad7a5f10ede6488a258ad95b9e42587fb7c80

SHA512
d46c48687881ad982e8b0673195ce2038a99ea95f114a6cb23f1bf0bc3649c0fe0e96c61188805bc16f63cd2c848d72a9c38ed0dd7875b107fec74b82f31d3bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
6571d5149e15f285cff7212847074fd4

SHA1
af37886b8f0f8956b93e40a8d695feef025ab75c

SHA256
44a5956407e2eaef67ccdf9782dbfe3fad622a259420506229035402794fc6c7

SHA512
e9e60fd1e28a14b9f56af6cbd068d89658367105b26732633073362560db83333555581f2b229cbdf2d0e5d94cc428e19826adee105d72535ebbfd2723f85fcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\[email protected]\install.rdf

Filesize
604B

MD5
ce8641eb059bfeacd65d107820dbbe2e

SHA1
980de65dddc6dbb131226393e780f6cafad7ce49

SHA256
0335bbfbec8a4b7a23de5c7915261f93bcff6509cabb278bda4800e224f1ab93

SHA512
88f636bd1940eaf67b772468d4e090842d75caf3fb664f9997629e2d9ce2245316c9cc780e2ff7e6556bdcde0ce8d400bbb12ca6bc762ca83c3cd981986c6fde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\H1DPnm1kI.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
39ffef27adb368f6718bb32c2517dabe

SHA1
5c1b11837bea0822353ea49c77a5e232709f18a3

SHA256
62785d4446c00abb823e53da013d542ec3736094bef7d7d48ae3c905fd0bcfaa

SHA512
33b538bd8593772a2f99d0ddc27d3284991d908b7007d7758f2f1c65a04deb1ebf52f703375f1cd888af0c6b489da167b88b25c7d63a269c8aa6e69c9d6fb8e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\background.html

Filesize
147B

MD5
80bb2bcd76537555116ac420a688f7b4

SHA1
004ca604f4f83da72431b8e2d139fe93e703eaf2

SHA256
f5dd66e7cdae3a74fbdd45dd9bbfcafea7d48da1feb57fb3ca095e4f702b2dca

SHA512
b38ee37415038c39875482f923c1a613b2cfec8cfd1d5b1df1768a5b96ac3b548f706e44133cd3a18209bb9188b9cf6fa9d3b5b6e8e80adc6b3f773f80aa6e7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\manifest.json

Filesize
502B

MD5
179e64aa5a25c98058e13d9344acf70c

SHA1
40afed300a25612f450bf5c51f650f23061c836f

SHA256
cf48502f657e36c4aae46d1ddc3220a3b3b2a9563c483eacdc8b004262246a22

SHA512
8c22cf0ee1a1fc78e99e381c46ed39bc6b515103c76f9a30a709e45949fbb91b78fc7122107a5eaff00818bb05a8b5cb42104577fa8031c474a5a534de6a451a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\qW7m65SYQ_.js

Filesize
5KB

MD5
4257d403173438accfde481faaa84100

SHA1
8185ff874e8715ec2709f199391bf19a3f191d59

SHA256
22fbd7dd1bb852dde47542ef6aee2958908aa8580b40aa321befe087ea3c9466

SHA512
b544d65212ea50cbae16e3c0b61a28975f311cca6138683864c9ccce65c8069223763f3b3d1591b0c2426fcae71a90ed604471e1a6d9fa73edd31779ffe9428a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\lpnafdiaplfncgpgifnbccmjpblpemnl\sqlite.js

Filesize
1KB

MD5
1ceecb1d443c03cc673abc4ff241bfdb

SHA1
9b8c9e4d38d38827e6ed37e5d1b901b923b3a030

SHA256
3bf4d3f90ee5e87825620d3f054be4806c9ed64bed58658bb6c4622cca82a9f4

SHA512
288301b440d2ad3979ee08f90b57bc0c8275cc4077bfcfda72c95231354eb5465cacf023fe34bbba4135d798e8a1b3d1a7da7971d8c8ca99c5adc4faf38759b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\nyv8OWrsd.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8C71.tmp\settings.ini

Filesize
7KB

MD5
981a46b04a0bca37edacf3a67891e453

SHA1
ef507e12ca3e7e656dbbdd10b0b266dd6fb51404

SHA256
35e2418609416bc291ce9f2d795aba4ee20baf0679fcf2c8a5792b2544aae505

SHA512
d36e37d91491be9bddcd962bc9ca67d9d724bb1ceca369fd9fca2a4af64021da43728c01d661e8c33ae22cf20d592dfa36ad7c93091b982da03371831312f089

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads