76706689031f218ca95e49d057039a983362a549aced4071b079f375c758b93b

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
04/10/2024, 00:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
Size

551KB
MD5

112dc26f534e4e55fefddaa621582eb0
SHA1

5597de93bebe233e2e1d7e945f246a071528cdab
SHA256

76706689031f218ca95e49d057039a983362a549aced4071b079f375c758b93b
SHA512

deb4c57bdc7848bbeda69258928cfd5a36c7ee4a4eab1fb6ad80ee243ac20ca3f4541e4faea7a153ca74e85cec6a5670040729adfc56e66d5286b082b5cb39b0
SSDEEP

12288:h1OgLdaO0Wctn+MEfOUgbJuMmFcouJqks:h1OYdaO0tMOUgJHJJqks

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2784	regsvr32.exe
2784	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pfnfgiejniaifjddlbblpaancnkdnelm\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ = "savenShare"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\savenShare\\j43M04.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CLSID\ = "{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID\ = "saVenSSHare..5.10"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\savenShare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\ = "savenShare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\ = "savenShare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32\ = "C:\\ProgramData\\savenShare\\j43M04.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare.\CurVer\ = "saVenSSHare..5.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\ = "savenShare"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVenSSHare..saVenSSHare..5.10\CLSID\ = "{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\VersionIndependentProgID\ = "saVenSSHare."	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4CB8DB66-EAE9-5A2B-8A09-0C54D6F020B1}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30
PID 1628 wrote to memory of 2784	1628	112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\112dc26f534e4e55fefddaa621582eb0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" sLlkS2.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
546b345f7f9945dfd0dc2f305c24b19c

SHA1
809b176a86d66354b5311fdb47913b0209f7b8d7

SHA256
ca8cf75fb5631267b97cfbc679133bb7c314146ff3ff9daa4b1c8e269b0fb2b8

SHA512
27710fc946b671e34393d4228cd6e85da476cc17bb7e460b4a8e657172b0a40f37214b8a4b0e63167f8b2ae971b8820b6f6fe2eb64581a5ae4ad41d1aeebc0b3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\j43M04.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\j43M04.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
e302eade9949c6e4ecc999f454c61497

SHA1
17b84af250f821a9da87cc26da87abff54fab87b

SHA256
d0393399c9dda621e88f0ef460472970f0c590d38a3067224d00c1fd12226b1b

SHA512
3b3aadd02c25b5b68b976eece4a160950f1a4ecb45cce36e3545b25efa6d5e8a64c3ad398bb4602d8e80fa48fe4a57c4d3e3f8efa040c72d8175b9acbb4e4d60

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\chrome.manifest

Filesize
106B

MD5
e6fc5045bb7aaffe4c69b6131fb1cf34

SHA1
5fe1d0dc634ea39a8744be530ec7d72cd9bd0d20

SHA256
35c27ada4fb4e210867ca8fd99d4088d3592a3e51bd4fdae708e08f304527a3e

SHA512
8a412a7b6509b69f84b53b6882edc37fce720def54bb60cbbfccd3bcbd8a20fe00eaf7d2e4e02ac32e06e1fe6ed3d4fc554a77cc10dba2be5b844725c587c175

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
b756a3f0fa7135274f8dd7eafbd1365a

SHA1
1ee64829f159da5e0b7c20260ae8cc2921870826

SHA256
0ce5a17e74f96a5df9a38ad37a8a1247b11c8979ee09f6c1d93254f02c0abb31

SHA512
0a2411b430ff7b8e2880ef58325df865cb069b16754e4cbd4ed22aedf101e1eb3986dca5470d319df30ee535669f176fa33bfcdaaf39e5b7ccc86ebf63b02758

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\[email protected]\install.rdf

Filesize
600B

MD5
50c2d2a701f0e1b5e1e97a5ceaa054bb

SHA1
2247ee1e1af9dddee1574a6af0b3f9bc2028f5de

SHA256
9e2b7ae5eb5ba1466d1bfa5ab3ece371b3d005f70da4e7fc84942c874782e9f4

SHA512
9b95d22047d0b61a5054efab1bcb9a5f816f3ddf834615c6545eff8cd0d54d77d0ecb9ba8ec59e2ac2967e99f804d9e524629f28b5883b68d1e60ee3a04ea53c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\GN22afr.js

Filesize
5KB

MD5
b01a499868ec838003d89beeda475524

SHA1
fcb760445adac3d46cd3df380c9ea5a18e4f9799

SHA256
b15400dfc96ce05056f4ebe45b008cd29a16bdf44905526d13dac0102138ad27

SHA512
d0718409bc3e6f0a7e11fadd7ce3767be8dc4275898e5f9fbb79e14f792457577998694e9151ecb7d6660fa98d5e5a32773e219f8265635f5d85bdb55e0ee02a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\background.html

Filesize
144B

MD5
fa990da9f6f58d35adb6202d8cde92be

SHA1
09df4badb9876df8882000b15b801afbd9d26e4d

SHA256
4efc59adae6a9dfb672788ac98d465a2256181610846e6c0eb374277b3b269bd

SHA512
c7d45ee21b4e032a32d5badff8bcf3ff0181e1791272b31dadf6932449fb35214f8e07c99a7e9ba66f7b139141bdc543c3c0a83ee9420d4ad67a57ff475770e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\manifest.json

Filesize
504B

MD5
a661344ba03dc31dbe48ec17e75846d5

SHA1
078dd3172685f0f0dcd2e01901267d2dabb5f657

SHA256
c47666baa1315c322a85e01f4c18ca1bc89f723a0224fd1b499fa715eb92c196

SHA512
9022c5d63db00505cdc5faa2a1c63e5f0d2cbf49086b90e78475c75e437d9ec5fb66e8d1c4f541eaeb13d76f349de54648c51f61e0697aec5767d18357acd664

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\pfnfgiejniaifjddlbblpaancnkdnelm\sqlite.js

Filesize
1KB

MD5
b0058cef80b67e4ec180c85fa456ba25

SHA1
c0fefedccfbc36e3f1730ad614bb90fd721a2f17

SHA256
707510a3f9795f7386205fdfb7c07335879c835c21e9cd81a315779fb23763a9

SHA512
cac111a5898b2230a23669e2afd57c736152392f59f2c200f370165587cfc7daacbf50ac54400a4d01376da7cc22db5ac0c284de61921110f66ac2bf56e2b0fc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\sLlkS2.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS696.tmp\settings.ini

Filesize
7KB

MD5
30cebf4f79c82503fb6d3fd63c02ce58

SHA1
723361e564a83bf0c0ebd70e42e15b4c3168d2ab

SHA256
b43878aa7f4377df7882058f153bbf548e6e4daa8213674c22e11a2a91f282c4

SHA512
86df63cfc2ffa2af343ce1a6d8d9e934a8aedfeec4058fd2a4dccf97b87e716b7408772128e38eee457ef51e684518c8235a8654b38111e77db725c29c608306

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads