427c442a2134a6ed2d3ecb2cf8a39f6c6c8ddd45d5c2bbcc706af4c2403ba69c

Analysis

max time kernel
125s
max time network
128s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 12:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe
Size

551KB
MD5

135da09eb93add35c166f996d7d19fc2
SHA1

c637fea51f52a72eadb01d80cbf102b600f125ea
SHA256

427c442a2134a6ed2d3ecb2cf8a39f6c6c8ddd45d5c2bbcc706af4c2403ba69c
SHA512

de7b86f4a0831a54c905597e148db29866978daeda452117bad2bc9d0255bb038e88253bdd03e18a343ef6d6f65da9e2fe62375af11f1098b8d1e351f7d5b1d1
SSDEEP

12288:h1OgLdaO0Wctn+MEfOUgbJuMmFcouJqkN:h1OYdaO0tMOUgJHJJqkN

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation	135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
3956	regsvr32.exe
3956	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\idglnokgbaohcmpokdfnpchikoiblmop\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\ = "safE saavve"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE.ssafe	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE.1.5\ = "safE saavve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE\ = "safE saavve"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ssafe	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\VersionIndependentProgID\ = "ssafe SavE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\safE saavve\\xusm2Qka.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE.1.5\CLSID\ = "{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE\CLSID\ = "{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE.1.5	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\InprocServer32\ = "C:\\ProgramData\\safE saavve\\xusm2Qka.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\ = "safE saavve"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE\CurVer\ = "ssafe SavE.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\safE saavve"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SavE.1.5\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\ProgID\ = "ssafe SavE.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{2953B7A0-1415-EFB6-4C2E-5AE6286B40C1}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3956	4364	135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe	91
PID 4364 wrote to memory of 3956	4364	135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe	91
PID 4364 wrote to memory of 3956	4364	135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe	91

C:\Users\Admin\AppData\Local\Temp\135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\135da09eb93add35c166f996d7d19fc2_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" _SOH4giQ.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3956

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=1036,i,4356837537417149674,16553092232944545509,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:8
1⤵
PID:3372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
a88bd4fe2c849f0d7bffb2b079de36bd

SHA1
c17de07be77247e726b5ff06c579fc62dcbf0046

SHA256
1671ffccbfbdb51a092a1732e28cc099fe25b9a517fafeb9c67f319ea4b8a9a5

SHA512
fbd0997578226bbd8c1301339ac68c78140363ff3fe811ce21e3f9bcd4a39661e7a37756d00b87bb604e110b3fce7dd6ba944d2a9e155b17d288225aceccf1be

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\_SOH4giQ.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\3rLhQCsmP.js

Filesize
5KB

MD5
8767fc3270a0e7dba35713036cb1a971

SHA1
9321689ba9dd65b434f55d07398261416fc435c6

SHA256
ebbbd75921acae561d79569b073e7a343ecb39695d301c92fe7525dd0c19de6a

SHA512
e8a1ef6e988d11624570f1938326de07805898a5c2f7fc285de1af6fe9f63e565e180df001b23b365d9d4b018fbee1ee8e14483493afdb62fcf861dc74ed577c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\background.html

Filesize
146B

MD5
6363791e89c2256c01b3225cc5f25a05

SHA1
6f43d7d1ac25626c00170f70617d4a4b92dfa0ee

SHA256
4833cdd86ed7940c243d6f7df517c4931d3ec4962b7ff0a50baa8aeb50fbcba4

SHA512
b2d01dc776ec7815408daaed939ddb5d938a4aaa5ec44fc1450909132b7c96468e8aabf0baa3a76389d0a770b41fa75d354be061eaaa8e7403eae11b39d4deea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\manifest.json

Filesize
503B

MD5
2b8038c040353b3049fa9597874aff42

SHA1
af9cec1eaebabd0c110a6e47ba4ec9f935db8c51

SHA256
d46863daf167375c24918f1e02b9fa6276083da74e7285a66b50cb57cf971aa2

SHA512
170c95568cc49446294f45ee12d86b64e986c5cde00aa0626dd3c6c0789f0cac9f9be94f2d6fb60130f09c935016f00ed276e044b92dc71921f6bb8e2c4f5d3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\idglnokgbaohcmpokdfnpchikoiblmop\sqlite.js

Filesize
1KB

MD5
a85aac14a6b62b75380612290e6ceac6

SHA1
c3bd6a1bacf960c95e867e7f2c7c7a52e0ab1a4b

SHA256
ac39dafdcbb5739a8ddf780e35a1365e7c3cc1a0528bb3b62a11109be773de71

SHA512
cbf155e78c5acdc56d682e975cd7cfad41db285b9c3d0ff77148799ee87f337627f3cd467ac69ae45e08144c3a950315eaeb874f3b70a2f46fe5585e50e3f242

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\settings.ini

Filesize
7KB

MD5
504e7afcab2272e7dc7375e1629d0d22

SHA1
246f4e0856bccafd4aee709374e2867b1924996b

SHA256
017942a994882e78c78ab26a605fc3f28435f9d5594d2182b3dfd31e683ab4e9

SHA512
cfa107381bf6a76c6e5a176b673d648a69b66a7e0d3b252401bf4f0256dfafb34a5f847d1cd8500566cd5d9d676fed329b05aa6b811ad48169424c268cac6602

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\xusm2Qka.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\xusm2Qka.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
ffbe59b12bdef333a70cfcd0ed0eebd0

SHA1
b8cf8b5b8ea9a45b78ced1bd15b133bf88e3b122

SHA256
3fa9d652115e68406c1fbb8b7293a5133cfdd04059fb1c10e2cbd5ac00c7fc6d

SHA512
cece33f77af19e94b843d076dc390ffa28f9aea16c5db4b29f125365291efd222811ef0f2c614541d0e70805543c36eafd844d6dc4af01dbc24b42bdaaf36148

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\[email protected]\chrome.manifest

Filesize
110B

MD5
31a894e0818c06d82a1f874feaf13083

SHA1
d805f044f8a8e0f826bf014df27271fc91bad7fb

SHA256
e613e2f6e44c26cc8523da78af813c82d3fde5de88a83915540e1fe4972a55d1

SHA512
f613e60764ecadf5787217c46b294bbe8fb311a2c7207df33a8210890929592043f7816fd464712b0c668537b2997c0c3aadf52122b0c36c51eb5b5b227ecc00

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
88651ccf9967acfe750f7561dbc518d0

SHA1
28ce9e219b17dcb1686c210ccab888110a52f109

SHA256
2d32d878ffccf389a3d932c29b3d52f71a207537fd0ae7b97cca498d89ef21e7

SHA512
1eb39f9592bced4e91276766ca51b4625b67a63179af6bd3e263603914878ab747831e9374854c970cadfb08f756242616d31fe0f28fd8f3a58d38f7a840c91d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS4040.tmp\[email protected]\install.rdf

Filesize
606B

MD5
a29ba9f4754280db80899782be873efd

SHA1
98374ab5f183d4aea8398d2407576ea2b71dc4cd

SHA256
f091d326ec5cc9a849f8775ed716dc101c60e223c8f27b14b9f712e63ba7a3b0

SHA512
f05cba1b031abc1379bcbd8e5bc6f580c0a2226cd0e1c50d2e3d204dc21070e0140b923a50a7f6d643ea1113252275d2ae99be90b6c169afd8abd3f42a54106a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads