bf58b73e13b6e2c4bd90500ed6c92a4e2da9778a5b8c1c550d256c28c9089079

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 00:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe
Size

255KB
MD5

0d235b5d77cf68dc7b4afeda51c6c26f
SHA1

31ee39941f104ca4fcd79c37868a5a53538e02c3
SHA256

bf58b73e13b6e2c4bd90500ed6c92a4e2da9778a5b8c1c550d256c28c9089079
SHA512

b7c1a6c8859f14bfd9945c2888850673734907a471d5d0c51273464ec5181ab3aa92597c81771c0301c21d222c0d69b2c66cf774a76300624549229cf8253c14
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5GNhijrtOWXS9PKmuB+:h1OgLdaO6wZWimuo

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001964b-72.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2900	51e4a26e0744f.exe

Loads dropped DLL 5 IoCs

pid	Process
2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe
2900	51e4a26e0744f.exe
2900	51e4a26e0744f.exe
2900	51e4a26e0744f.exe
2900	51e4a26e0744f.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpnfchcmpckcmimcaemknfapipniepfj\1\manifest.json	51e4a26e0744f.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1E72411F-E34F-0D3E-0611-F3319B4E0888}	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\ = "saffee. save"	51e4a26e0744f.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\NoExplorer = "1"	51e4a26e0744f.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2900-75-0x0000000075130000-0x000000007513A000-memory.dmp	upx
behavioral1/files/0x000500000001964b-72.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51e4a26e0744f.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000019054-28.dat	nsis_installer_1
behavioral1/files/0x0006000000019054-28.dat	nsis_installer_2
behavioral1/files/0x0005000000019650-94.dat	nsis_installer_1
behavioral1/files/0x0005000000019650-94.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\InProcServer32\ThreadingModel = "Apartment"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\InProcServer32\ = "C:\\ProgramData\\saffee. save\\51e4a26e07488.dll"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saffee. save"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\ProgID\ = "saffee. save.1"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\ = "saffee. save"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\ProgID	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888}\InProcServer32	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saffee. save\\51e4a26e07488.tlb"	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51e4a26e0744f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51e4a26e0744f.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30
PID 2644 wrote to memory of 2900	2644	0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe	30

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51e4a26e0744f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1E72411F-E34F-0D3E-0611-F3319B4E0888} = "1"	51e4a26e0744f.exe

C:\Users\Admin\AppData\Local\Temp\0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0d235b5d77cf68dc7b4afeda51c6c26f_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2644
- C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\51e4a26e0744f.exe
  .\51e4a26e0744f.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\saffee. save\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\51e4a26e07488.dll

Filesize
116KB

MD5
05234975b085632d70d89c2f420c5107

SHA1
078fb2a3e5de54c3737a4541242a4725c02c6b9c

SHA256
a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a

SHA512
f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\51e4a26e07488.tlb

Filesize
18KB

MD5
c1e296ff01d3cf37f91c7473bdd9de52

SHA1
832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6

SHA256
a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492

SHA512
aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
21a3f1407921cc063c34c6d526408e03

SHA1
0abe84361cc90e4dd083834fcc7cb5a2f5b4d3e9

SHA256
89ae4e54a89c7de7b3279e16130c938c5e5576a74ef090a66c2dfb8d6a42e22c

SHA512
097887070dbc0780f5346b73bcbe45dc3342bbabf2d67e26392cc3e702b1a309363d4efd8d5ac1027b9361f4381722454e12e876c068338b85b33988db5116fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
eec1f060becb03a1a9ae1aa45f0ac436

SHA1
2d9286541c1709f7519831b791a198ac9ad921bc

SHA256
b45a09d2df5df7190017d777a626bfab4ec5727712912b9abc9208f47479f59e

SHA512
05171507598f318f65b7328e4c2a1f8ca57db7110a30b1fc511a4f3c0f180d4ac35057b42577fe4c9a80fb756a2f64c490d9d63a9ce2ba5b441f0358da61deda

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
81ef4cf33099dc199317165f42418bc9

SHA1
ed000e8cda515d2dd6e042f7130c5abc305c4d99

SHA256
07f75567b774827d6886b97806e5b26f0bae7ed9c5915de6cbaf1388de879c4a

SHA512
38879b101ff264fe34c9f729b0b14278df72a55047f8ae0feec653c1fb6f12228b6ab13b47e879f54fab083a44fd3923cff885866bbcf155662ad5ea0c41e6a5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\[email protected]\install.rdf

Filesize
609B

MD5
39fe97b597fc3b1cc24ccf39f11b46c7

SHA1
244e9b8579ea4521dd13e2bdc7965da4b8e3e274

SHA256
62613dce6fc5471c7dfadc5957970aab7963c4a70db9cf7ce9067bb6d470515c

SHA512
cb2c6f8cd29d04e977c2a28b530862e6d6a9ce3477dfcf6e7d519c286ec5496840099b0c4240265acf230639b28b7fca8cf6b4c674431e0035e12238acb4dc33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\51e4a26e072307.74264868.js

Filesize
4KB

MD5
5498da8a6625114a13b842136ac15cb8

SHA1
f571e0b47b13fb2626690277cd896d9d0c0c1f01

SHA256
c6e5bfa11ae4ba4c2987226bce9ae32f60ff6cbd59c32a10f572b4f5f8c51541

SHA512
6801359e5de39c102b515a1900082923a49a0a657ed65c53a2f3e7dbe7b50f6c2407d9ae4f65ba9e08d83fd9ea8c65c3cba2793ce241c6d8ba6aedef53405ac3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\background.html

Filesize
161B

MD5
75e4570bbd0ee2fcaaa7db62f9d5b265

SHA1
87d80756bb6aa586e200925e4482203249882cbe

SHA256
5dc8f40fa78bf18808f06d9e4f154b9f01d83cb91989c9dacb807b9d76a72076

SHA512
a1b648f07db6d86f69f12ea0bfb429c9e8524d6eed4b46f62ea61fc1d5a8236bd0732590593bf8199d05b2efb5ab6247a62dc9adae0d6440f8f330b951e3933c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\manifest.json

Filesize
504B

MD5
162150e08ecb898e9a49fca2208b660a

SHA1
2ad3e283b3748277d4e1a73493bc4444ff0d91c7

SHA256
894495162b997ea7d9603ee1ee9adff15ee55009839cac8a97c5bcfb620f2501

SHA512
15786311ee487a846830f1fcd2339396c4a89118ea9ef974fb7d782f922fbee53b712bdb465a6fcc185043ec3ef491d9dcaba382dfd18e7042ceba546f2bfecc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\fpnfchcmpckcmimcaemknfapipniepfj\sqlite.js

Filesize
1KB

MD5
d34335096f1d3364651fe468dea475dd

SHA1
3337fef972fce9193006f589b990dbc6b9bbaaaf

SHA256
8dec0317beeb22963fbb3767911e8e7e38dcb27f4fb48c1ef87e433d8a300b38

SHA512
ae353e608f9a21030fdb8f5fa639bb3137251927e64a21862c521ffdab33436f49a596951fa8caa591609424df934a0a859a549a378664b22252dd53ce036cba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSC40.tmp\settings.ini

Filesize
7KB

MD5
dfdbb2235bbc9d08f291427553276f0a

SHA1
8e90ae2e9473374a9a5f22d62d09b47e7faf53b5

SHA256
46ced7e731e2824ff4330de68d7d5755fe62e32bd0a716dcc931d6ecb956bea2

SHA512
79338e9669c75fc1cf6b7d93cb19fb240380c9a9dce604bd6876c4fe02999820c6e94ec05100ebd4ba86d6314351ab0c4ec0143648c607a99a88330922ac2f73

Download Submit
\Users\Admin\AppData\Local\Temp\7zSC40.tmp\51e4a26e0744f.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC8F.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsyC8F.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2900-75-0x0000000075130000-0x000000007513A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads