711996a64e0aa2a4382e73046e3da05ee69a07111fa6fa7c075da4a56949dd59

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 19:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe
Size

551KB
MD5

0c36eb21adcae8b6f737b4fd29a5ed5a
SHA1

0ec6bc81e5a4fe9b9e2208128b577530aad2237d
SHA256

711996a64e0aa2a4382e73046e3da05ee69a07111fa6fa7c075da4a56949dd59
SHA512

a5820eed1e1e204ea8c557adf52dfc741f94dc88a4a5cbc4c9574962b20ecb7185b1b685d2d3fbf0afe4b046c246245171007b599656b9b83bddb68d2f7189ae
SSDEEP

12288:h1OgLdaOv1Wctn+MEfOUgbJuMmFcouJqkP:h1OYdaOdtMOUgJHJJqkP

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
4424	regsvr32.exe
4424	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jbhmakhogokbldipiaahjhjlpejgpkif\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F12CA10B-C9BE-4885-A336-5A057293C06E}\ = "ssaavensshare"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F12CA10B-C9BE-4885-A336-5A057293C06E}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare.5.10\CLSID\ = "{F12CA10B-C9BE-4885-A336-5A057293C06E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\VersionIndependentProgID\ = "savenShhare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare.5.10\ = "ssaavensshare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\InprocServer32\ = "C:\\ProgramData\\ssaavensshare\\3.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssaavensshare\\3.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\ProgID\ = "savenShhare.5.10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare\CLSID\ = "{F12CA10B-C9BE-4885-A336-5A057293C06E}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare\CurVer\ = "savenShhare.5.10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssaavensshare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare.5.10\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare\ = "ssaavensshare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F12CA10B-C9BE-4885-A336-5A057293C06E}\ = "ssaavensshare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savenShhare.savenShhare.5.10	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3204 wrote to memory of 4424	3204	0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe	82
PID 3204 wrote to memory of 4424	3204	0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe	82
PID 3204 wrote to memory of 4424	3204	0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0c36eb21adcae8b6f737b4fd29a5ed5a_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3204
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" 9.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:4424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\3.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\3.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\9.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
0320c1365342e3563aaa7e0d5c97c16c

SHA1
9d296b38170e0412e513ebda2374e9b03553a1c0

SHA256
e501f61f8eb083afb5408b16558e22c24b075cc52d2f139079ce2232850dc5b4

SHA512
632208aefa5921d6c197c03f2409117c3b2d433595e8f84713b08a9ae57b93a89773475db142833f06ce5e08016ebdb90c2893e665b1578ba8c8f57e2d09d627

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\On.js

Filesize
5KB

MD5
0380047fbebc05b88f567d112d34185d

SHA1
0a32411ee65306a31e21e4a99dba716aefcf125b

SHA256
606b470f29968d5b2066deccb856acd5081e16c59796fd6cd4430d558604b613

SHA512
7db962fbeac7c4d7e00d0f59ce90276eed560e2bae63131c774e625f004b0e3cdca2fb4175ff6db1db3b9cb414944e106c868f42fb243507ebc858fc11624305

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\background.html

Filesize
139B

MD5
1a9bb82cc0a6f3d8086a12bf9161867f

SHA1
7934f416806cbd9100f9e764ed90a796f442f0a4

SHA256
26601ce25f9cf1323b53b41573e55b5deb54b02e262f9f475b6a03799fd2efaa

SHA512
c6dd233e5f9054d33fb4a15415ff5bbbc141b29d301cc4493703a8316f37ae79680acb213678ed30e012f2b0e917be8ee9f057d751bf24d87559169a9fb16406

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\manifest.json

Filesize
507B

MD5
5bc3e1772bca05f48f7493d9aa444cf1

SHA1
c8a7a896c4d66016d2f9492177431bdf44c97c10

SHA256
ab5f3f1254157dbc4b19478da0bbc891b4c2649ced7c77c4f088d727fba119c3

SHA512
facd74cb40ccc9fbfae0a869ae387f49d69bceafd04cdaaafeb50855d8bab94963ae3585a13b6ec4e90e1bc6451c3ba67e523b45ee481928eeacda5fa7993fd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\jbhmakhogokbldipiaahjhjlpejgpkif\sqlite.js

Filesize
1KB

MD5
5b7b4d8279fd9eb45eebd7a803cb8ab7

SHA1
1bc17a2609158a27af917071f37c3cade6736720

SHA256
273c9a16bb6da482702b11b960fbced2ed1ab9d65922d1b214034d825bcec7f7

SHA512
1bd7ab9570243d63a4de9adca96ca2951482a5db2a663ed8e28c8e7ad4d6736898c6de6db1e05056e8a25f441f7185cb6dd66ab67a2d7bd676b0e9db61b7b95a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\settings.ini

Filesize
7KB

MD5
57610c311768e8199b0e6b7ca4fa9f08

SHA1
b587da037b68835d4674848faea803b96efd7455

SHA256
133135f17dd1a101be6907c2b7e25b9dbaffeacc1015b3b49f833694a8d22a7d

SHA512
10997dc2e91cf2c4eb4877ace521a9c87811320fe511247597b847df7fb74d4a6c0063968dcdc5e95d26632f85772bd7e58a68338ba662d5f6882bf487b5b059

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b79ca47dbc3f5df8d3450f2e1e1ab056

SHA1
ac195cd13e563416b8de716cc15d5052dfe50151

SHA256
18173c8fb6a192b8d423b169b3deb9beb13ff531cf3da27d5d6bf60b96287f71

SHA512
2f89c238e112a80f4437082b52040537d9f668daaad979a9aa4434bae909a682adea85195f91a5bd4c87d6d136a42e2ad92bdcac6b13ffa0ffd7abda2c887fcd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\[email protected]\chrome.manifest

Filesize
96B

MD5
5e389c6ead211abee7425111d5d3a8f3

SHA1
4c0f5b0c4ea6fa985644440b43e6d7c760f121be

SHA256
638306f9d69efc2ab0ddcc1d04561a8aac9b5c99f8fe4156d906454a0e32209b

SHA512
993518ae9bdc4e3440050375072122ce850cb481310d60fdd9387e182b114df0b7a46f8e03194cd70df432453ea6ee447374f1ac79e538fd6a4baee3462e2c2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
7b844721f1c2e0d586ac6151eeff80cf

SHA1
775e52d0a684851fab6dc0ffc825d4ebd542897d

SHA256
27c33f003e75dc23f065f28b246562904b276e512f0bc9af1d7260f93ff8f925

SHA512
304cc6a8d0b56dc9b1a2c63332d36279e1c301aa553c5c92774413ea2aa7bbb45624c8e1873bbdce16b082269bc779396f95f296db99b621a0e4fb7916310938

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBF49.tmp\[email protected]\install.rdf

Filesize
609B

MD5
77d10696f7d8da54d5732c0e451dc6dc

SHA1
41aa7d92374050b064ef5dfbdae0010ef442cb27

SHA256
43b996f14d19356e5d7e535f77b85178ad8a1b456f770954236e3106b68471be

SHA512
0869d1f69960f1dc917a0b25106a80ad95f2cfeea00a41730ceee5f5abe24bf6342acc8f073e3abbc49463fbecd37ca286ca3d0234cd26fa36e69597c7966c5d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads