49e2f8893c4008fa4f23458ff30b0ba6ea2f56e354bf8c32bb7168f29bfdfba4

Analysis

max time kernel
121s
max time network
124s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
03/10/2024, 16:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe
Size

551KB
MD5

0fbdf7bac5f94f2f17416f5e8f7c6228
SHA1

3248e88f1d989715992e18789a87bda8020122c8
SHA256

49e2f8893c4008fa4f23458ff30b0ba6ea2f56e354bf8c32bb7168f29bfdfba4
SHA512

d0d35c06759786a01ba67d38c7e74a6c82fdfc8d29d8718c1b93cf88cf731f82d3255c8c1c8205d76eeb2d1e44bd96e0af08535e67cbfe552376da52e4d6e522
SSDEEP

12288:h1OgLdaO9gbJuMmFcouJqkXWctn+MEfOQ:h1OYdaO9gJHJJqkXtMOQ

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1928	regsvr32.exe
1928	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\candjcdcdolopidnbjgficocgfbpkndi\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\ = "ssafe ssAve"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\ = "ssafe ssAve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\VersionIndependentProgID\ = "safe save"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\save\CLSID\ = "{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\save\ = "ssafe ssAve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\safe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssafe ssAve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\ProgID\ = "safe save.1.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\InprocServer32\ = "C:\\ProgramData\\ssafe ssAve\\O5fZ.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\save.1.5\CLSID\ = "{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssafe ssAve\\O5fZ.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\save\CurVer\ = "safe save.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\save.1.5\ = "ssafe ssAve"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save.1.5\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save.safe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\save.1.5	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D33A7CED-23B8-011B-98F7-E50EBDBE4B32}\ProgID	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30
PID 2876 wrote to memory of 1928	2876	0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0fbdf7bac5f94f2f17416f5e8f7c6228_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2876
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" Jsex.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1928

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\Jsex.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\O5fZ.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\O5fZ.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
75cc409c1e4fd5e327f6ed30de7da536

SHA1
f034d1619c0eb20af17baa23808d13ed1c1dfb4c

SHA256
d7eca167292b06ba65a17bc5006567b8e62d013524a947107456f5ea43e160b8

SHA512
8f34a7d4ecfbfd30f74f84d9ba8db067d0970cd2e9a79e9edfda29bcf0d68020a18de40d793eb77b740bb98bdc238ae3153884a54517b238af3723ec058fb37d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\JQvyp.js

Filesize
5KB

MD5
75a7e99d510fe0d54fe58154046a5238

SHA1
902383de27c5e7dfe15d4a53c15b50e02029d162

SHA256
ae7ba40b4a0e22a6bf4fb04cebce098c3c46496f44cd371e209d2992cd3f3bf5

SHA512
4607ff6a44f1d83d8f5ec5842b9fe830ec5fa462a6b454ba9d560c9d51eb6242c930adcb5d3a420d283fc1fc320b81f1d585d2cc92600bd6b72196bc735cbd61

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\background.html

Filesize
142B

MD5
5b23f0e925af815ffac07abd2a96b9b0

SHA1
51c376138f81784b8f78a0ec61ef51ce262a9ad1

SHA256
f9061dabca44b14a159a79694b896b327227872d1b751ad0ca119e87b49a158c

SHA512
4e7c200af42b1694e233537b9edbd943b38df3141f523c491461d549c195ed1b2511fcea1bc25d51d0bd3d5766d2c966b8564f792acb0868b6c49b1a16e897d6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\manifest.json

Filesize
503B

MD5
68c44240b3909e9e9186cb7b7f196837

SHA1
56d5894163376ad8c077101fbb09e862bee0a4a2

SHA256
e62bff68edc2ee23df20b1ab8d4e03b052f3dfb643788f50e2ec82b084e63308

SHA512
b042ebf18dd28b36dd614f1d0a82dc57ca83630304ca3c9bf4741585096aba4551dfe3759d27b640b1f8f2da9c0dac00b4d8919c6d8da2531a619d988b101602

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\candjcdcdolopidnbjgficocgfbpkndi\sqlite.js

Filesize
1KB

MD5
61ec0e043a2b1ea022626450db764cd2

SHA1
8027b4f42ab5f4585edce2469fbaab1ac690960a

SHA256
f56948a8d86a49b5e1291bbb3fc5f0ddac53551964f80632f2b544b1f5f359d7

SHA512
e3c044b2906dc5955cf2435fab93ef0281396363de36d6d1ba3fbc0b83130495403704d46930fe4cf7f545a226d00275ee945900d76b5e29d3e143a7aa2a8f82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
6b311f5e8f5866697528908a5f7d19f5

SHA1
39c554a0a643a3f8c02c68191e0fc47463bf9deb

SHA256
9e5a37e861fb83ed4a7e922ac663fe942caa4fdc5b5306ffc78440a8f522ed7d

SHA512
1437d679353b4dba0782e1c1268363a403f56aa56a929bc7c9ef3ca0c618e48f08c7209d76952f547a7f5b12ffe61ec34c27601b017e4989163bebfc4f974036

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\[email protected]\chrome.manifest

Filesize
102B

MD5
834f0009449d4bc070e686c5ef6ded5a

SHA1
53178cb70f4d9fad11274675d90eed756bed98b9

SHA256
67812b531490a6ee42c5c70299d64a266847bf8bca189ac88312310a6b059359

SHA512
cb60e385bdd9ee69e7d946788cda29283056cd9f9f792e2dda3dd9bccfba1e300d6e5b33e418ecd6455aa58374ad255458e59ff94bd54e680b68a2068713fc2c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
cdd8ac5925b12b0f606682049c54e9ae

SHA1
a5a8141dc855baf1cd6854d3871d82e42063d4a7

SHA256
0c4c4adf097403f58647c10f4c2b7782132f7cc125b98202d4bca05879679cd7

SHA512
4ab64924c1366814312a690a5931d0c3a96f7a5b8b9ecf6e071b3cf888b9ada0fb1ad0d764b9b540d927187d653ae84a94506b2afd7e6e2e2b6ba436bfd37094

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\[email protected]\install.rdf

Filesize
602B

MD5
3295de370f6f2ac9f31e296b119c2a07

SHA1
ac91a70cdf82f77db97aba11ed9e894e1e119cda

SHA256
ea0c1ee4b4ca04a18a00211b9c02d75e79c7d47afe8d19682c7b1d48dea7b45f

SHA512
91394b79048379bd2117506a9282d0553cd4e009bf666b204705a6dff5d17959746318d73e9aff7c5a55ec590fa0551fec439769219517116ebf7e16cc7cbe0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS67E7.tmp\settings.ini

Filesize
7KB

MD5
39b6a54c10deff96be2c471c0e2559dd

SHA1
0da88d5861ce0118a19779844e2b7b30b7f98fea

SHA256
a5e44fd5c2ccf990a60df50d36dec964113c06e26590ca5afc4675d712acd227

SHA512
4133cd71cd214b33fdaf7f7a0c8402921ad1a801c8c7e5e5291fa8941b5ddd74e1ac5d31118bd5c38bf27317a4cc654c4fefb156964039c7877313496123440d

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads