4f7fdd1178960b81f28bf1ddb505a92232aa9e275a41891f207f971ba6bd2ffd

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
05/10/2024, 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe
Size

552KB
MD5

176b19e788c4fdcc550f21ba7ed2dee6
SHA1

6809d3d8d6578338f94207737e7807846da627ea
SHA256

4f7fdd1178960b81f28bf1ddb505a92232aa9e275a41891f207f971ba6bd2ffd
SHA512

2df1bc7bd9aa04b1407843cb71a0f93cc7ec281a1f8e01cc60609267e5e82a986eb6ac0d7836621ab4a5d832af6db87b8753787089de30391ac9cb8a9ec3ca1d
SSDEEP

12288:h1OgLdaOygbJuMmFcouJqkXWctn+MEfOH:h1OYdaOygJHJJqkXtMOH

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
3028	regsvr32.exe
3028	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\aijjopemdhghifndapmdifhppacnonkm\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\ = "savensohaRRea"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1506706701-1246725540-2219210854-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\ProgID\ = "savvenshhare.5.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\savensohaRRea\\yQx1QHXe8.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare.5.10	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare.5.10\CLSID\ = "{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare.5.10\ = "savensohaRRea"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare\CLSID\ = "{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare\CurVer\ = "savvenshhare.5.10"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\savensohaRRea"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare.5.10\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\VersionIndependentProgID\ = "savvenshhare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\savvenshhare.savvenshhare\ = "savensohaRRea"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\InprocServer32\ = "C:\\ProgramData\\savensohaRRea\\yQx1QHXe8.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6452A5A3-ABC0-BA90-56A2-DF4561DB2EA2}\ = "savensohaRRea"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30
PID 1992 wrote to memory of 3028	1992	176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\176b19e788c4fdcc550f21ba7ed2dee6_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1992
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" Febcr0cNt.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\Febcr0cNt.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
3a46646d681a7ad2892b6273924c6e42

SHA1
97e5ddae7c14eb3b507fa6021291f89d61d80917

SHA256
b5422fec5191a783fb2dc458d4898465def1c438dd5f9e2ab1c78d0654f28d13

SHA512
a3770831c44925eb65a3836c9dfeb4e80c1a6f596e1d67e27493e3788056739cd99e42d7536abf5c037479cf15fed23edc214aacb5db2a540539a353993e7bf7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\5xhVyyvJka.js

Filesize
5KB

MD5
5583f9e4ccb6cf55a67ecff5ec2c09f4

SHA1
ca151565808189c214d39b57078142b0ed1c09dc

SHA256
767b96849f308f5d388f98ecce2fa345e5a20cc66cdeaa4a5476e4e5c12a9b85

SHA512
72d3725058e78dca4b068623f0df1ee221d938a2235b52b491fd2982ae03d37631800d1e21c9e6aecfdbaf2616a4e3317c1cb99e2a671037667276b9e4ff8804

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\background.html

Filesize
147B

MD5
3a3a8d80b4fff0954e3cb44cef7c4acb

SHA1
56d66141c773e2c0481cdae9431a66a2d7edb564

SHA256
c0db905ced1276747f1a69481bfd4caf3452c3b31881eb1de3f8961581d5d675

SHA512
78cc7dac85df7d6929d6cd5a4f3c272d1e0d8a1548f0155d9ca3461ba3d6522b86ffd9d7a934416c1407b5038b2f55d95de9c800f20f332aa5eb7841e7dd9ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\manifest.json

Filesize
507B

MD5
52670849a7ae8544663cc9f5b703810f

SHA1
75b5b3a5edee8f02b19cce8c5f57ed03f72c3036

SHA256
9f1e8385945a25d2ce8e5595cadaafd2023489abb10d04d9ef0ba93a45e71977

SHA512
3f92b905d20764c060cd05e4c22f558b601f22111cdad292ac397ebbcf8dc8a828983b31e3744c6fbe84cf7eb1191a74da58a351f9fa5c1d845ba833d57d24b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\aijjopemdhghifndapmdifhppacnonkm\sqlite.js

Filesize
1KB

MD5
8d6def3e30ca9c64e32e4a9ca808709b

SHA1
eea402fab29cb8f39fea76a61bbc664077425168

SHA256
1c133bf3e88eef1d26c637fd5933b24274fa17ffb530c02ac110c3076ad020d0

SHA512
465b2ea538c891d0210e44bdf268209df9c0bef1de1d324c42533b955d763c0d50d1be73a023439dcd9ba086a4e599f9e16f65cb61a67f5f91d3b73e80536c04

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
2e25cbc22d19f4c736b0a24794f4cb6d

SHA1
dc1f3787390e6338386c1f64834b78c3e7675b0c

SHA256
135742e7db6e99c40d39912caf9ecec2c8fc8e343301a0d000b0280dad80ec65

SHA512
ad974c2ab5e469c6702a6e635f60a2bbd7991954050701eb187911e2905948b112a7b919c848ae99c0ae30b4840467adfc86de574b9f3491d43602ae93124f0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\[email protected]\chrome.manifest

Filesize
112B

MD5
5bc7f85e6c11dd57a467bfe855ad7217

SHA1
bfce92cacc8046e7e6680237a644738f71f271e7

SHA256
5d7c355678fa30a7a040d512a32b3569fba9dfa3af80fa0ea6e7bae170e0f502

SHA512
72ccd645a66ba158212acf945091a1db8426de802d70116d6405d05dfb3fcb2d7fd6907db35ddd875bb1b19a228eaec028b615f01db2e9470f29253f0b12863f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
b6d8b1c8065f9625bd6ea51a79ad7df5

SHA1
de3660f995c9af225d1374aec3c856b81deaf5b0

SHA256
3b5dcb9a3fe5aa3a9467b4ca4788bf8b4c16e6358c12f3b90f5fd36fb4a24008

SHA512
ad603a0798312d812751775dd68d1eca757a62534989a969f7755c2340a054777aa7d4dc942af8008aad86fcfa4b14f0a739fe617b2dd371875146405a1ce226

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\[email protected]\install.rdf

Filesize
606B

MD5
0fe672ba69c659314acd007a3e22ca45

SHA1
90638d05338c691828850829264eeb9d5cbc71d3

SHA256
f0164739ab90f26345c0887026bf01b32a37788b6f28c936f7ce2136c06d073c

SHA512
c52df731704b9b7ed5e42e5f054131539604bba3be9f2d76464b46157bf3458f8aa53fb8b1305de98f6b38ff5945aacb1d1007e1d5b5df698b258d6475c98dba

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\settings.ini

Filesize
7KB

MD5
09f7014b6e33833484247d4a01a6cf76

SHA1
19ee1595a105202b73a4bb3f77c2ab010ba10a56

SHA256
79b4eb3fe73ace6b1bce4162f07e9d682139095754c28bc4f674835d3e3e8fd4

SHA512
0c2b31bc3747ec4c4b6070b1eb2c3b0ddd4115aca1b3944cb511d773debc4a66ebb6353a8ceedd7bbfd511d3a32d5e535c5be6a0cb4dc4c391967fb2bfee4db0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\yQx1QHXe8.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSBAB7.tmp\yQx1QHXe8.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads