48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166

Analysis

max time kernel
94s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-10-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe
Size

255KB
MD5

0d3ce7ad85820a1399cb23e931d04260
SHA1

53de601a5c9f3864c2ee6388e150576ae2baf7ae
SHA256

48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166
SHA512

7cfa13af2560a227cb88f07cf44e295a7fffa93d7dab28d2f7a6aa090b4b9f3d2367cff83cd240cc51c6e1cfeea82248ecdb8502007443558f0c3b9b29b3f6ee
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5HFxyZ9iHx2Jo553LSeovJ:h1OgLdaOH+Zwn52eoR

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x000700000002349f-69.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1320	51fcb4ea15aaf.exe

Loads dropped DLL 3 IoCs

pid	Process
1320	51fcb4ea15aaf.exe
1320	51fcb4ea15aaf.exe
1320	51fcb4ea15aaf.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nfoagbdjifmnclffpaeinfniibeehfoi\1\manifest.json	51fcb4ea15aaf.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\ = "ssAfe sauvee"	51fcb4ea15aaf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\NoExplorer = "1"	51fcb4ea15aaf.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/1320-74-0x00000000742A0000-0x00000000742AA000-memory.dmp	upx
behavioral2/files/0x000700000002349f-69.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51fcb4ea15aaf.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0007000000023487-29.dat	nsis_installer_1
behavioral2/files/0x0007000000023487-29.dat	nsis_installer_2
behavioral2/files/0x00070000000234a3-98.dat	nsis_installer_1
behavioral2/files/0x00070000000234a3-98.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\InProcServer32\ThreadingModel = "Apartment"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\ = "ssAfe sauvee"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssAfe sauvee\\51fcb4ea15ae7.tlb"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\InProcServer32	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\InProcServer32\ = "C:\\ProgramData\\ssAfe sauvee\\51fcb4ea15ae7.dll"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\ProgID\ = "ssAfe sauvee.1"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssAfe sauvee"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51fcb4ea15aaf.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D}\ProgID	51fcb4ea15aaf.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 780 wrote to memory of 1320	780	48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe	82
PID 780 wrote to memory of 1320	780	48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe	82
PID 780 wrote to memory of 1320	780	48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe	82

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51fcb4ea15aaf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{F731E0ED-79EB-7AE1-D133-5677B267FB2D} = "1"	51fcb4ea15aaf.exe

C:\Users\Admin\AppData\Local\Temp\48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe
"C:\Users\Admin\AppData\Local\Temp\48fc1d3c363f7cd2006806d13a8ebaaf94d269328229e635ed6dc061b7d33166N.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:780
- C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\51fcb4ea15aaf.exe
  .\51fcb4ea15aaf.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:1320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ssAfe sauvee\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\51fcb4ea15aaf.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\51fcb4ea15ae7.dll

Filesize
116KB

MD5
05234975b085632d70d89c2f420c5107

SHA1
078fb2a3e5de54c3737a4541242a4725c02c6b9c

SHA256
a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a

SHA512
f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\51fcb4ea15ae7.tlb

Filesize
18KB

MD5
c1e296ff01d3cf37f91c7473bdd9de52

SHA1
832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6

SHA256
a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492

SHA512
aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\51fcb4ea158a98.00073335.js

Filesize
4KB

MD5
209ddb3096dc04ab731c71ea7efb245c

SHA1
2e60743551658928dcd5135b71865c3b6692fb83

SHA256
3f32f7b00c3c3abc17ac3031f710b11daf6fb1930d4d64407c41f02b055aaaad

SHA512
e436f58ae9f436d82201210c9bbcdb2db22bacb985afaf2deae0093f8035e7f9d383cb58553da10b914836dda3a0f0216dbe46e3d5f9762f5a7d02f540b3eaeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\background.html

Filesize
161B

MD5
4b2be3347b700c86e63720fcce074337

SHA1
c4436534a9433215a5c76b1ed5a0474316025efb

SHA256
f7306b013af527722745d0b5ebeef806b86ba79d23620e2d916666c973b651d7

SHA512
1bf4172ef59f753d4354833022990b3c8dc3743b2f955a04f0795ed334b3a6436f98c4cd4a9cde2b872b333e65882beed78fe295037e0e14b4f6c4b31f957e23

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\manifest.json

Filesize
504B

MD5
317725a346791a1939e016d052852aa3

SHA1
d815cb314143ffedef78f4075ebf71e79562ade0

SHA256
694afa2f785362a67e2ace2a0c79ea9ac0d2db6659ee6d3d1caad63a1ee2344d

SHA512
46b01a1a398bb418ae6862860c981866cf4678744c0899ddc49750e52f686df40f159dec42210fb307fc1e6db8e00ac64d37039f0f3c8c391ee5774d04039f11

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\nfoagbdjifmnclffpaeinfniibeehfoi\sqlite.js

Filesize
1KB

MD5
6573c993d5c037afb7cdc8fe6545c679

SHA1
e317f8a04aabbd68f92a52777950c220d1b6dd61

SHA256
48a814a16f27dc5b3f6ab45037b5784ebb517e9fee3bdac19de9d9be0ae2770c

SHA512
a3f37b49dc2f084dc4b994c261a21c9681bcad469be1ac80c35a80dbfa42a22fbaa3f80b91b9e49c4b5d2e81cf2fa607dbedd366f8ac3985ae89b587d4954d15

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\settings.ini

Filesize
7KB

MD5
5efe7e41ce9f7445e5d0fdc8bd5c3f62

SHA1
e0ccb69ebe8dc0491db50f11f2ad3e6594296852

SHA256
a9af082247f3e37133ba0121d90b203b741f198806cee47e8c70a9af3411291f

SHA512
30cb87f2cf9f64bedb5358e6098124866ffe7ccc87156d63d545d4f2a3c9a397e0347790418554a24c7e9d5368d5a844a101c29f6c36343378d3e60a088ee295

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
b7258429ceaf7f9b187d8a579865e211

SHA1
5f7b4b62e36f39aeb3f2c64853e93683d15008a1

SHA256
22588c960ed8000075793ca2c9f37dc706e4b21bc5c50d7f000a08a199af2a86

SHA512
3fa2be249f0eb2570516dc4beb77e729d15cd1714fe36c14d5de1eaddbf17218161c288fe00a679e893d98ff9ad0fef72eccf4f2f6b5d54ad4091fadb4c4ec06

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
60996c49724c426899e1e0d512042de2

SHA1
0def0ed4d17ab880ad0349ed3004104e1d1585a6

SHA256
204abcd25774ee99312b76eef5d034fea5f575ddaa1f4e89be9b7f549ef6f250

SHA512
35aee8052beae4d1906a9b1f509b9f321c4b410b6e69e66f1303a7c67bf096b6f60e86b6eaba3c0201af1085713f765ed3f90e8e16926fe5612ea119d0e817dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
53ae0a76d849ce1508181c4a9d1ea4fc

SHA1
91d0b5df63ce78aaf5b05eafa861f5d60d98313f

SHA256
df916af70c45d665ac05b684d8e61395534ae360499657830a1d826e281d7481

SHA512
202644491a319158deeb79aaea7c7b4034d7c3a887282a2b08cb51d06ba0febb2212196ceafd458e521d8f2269483f8fb007c9dbd33e5347afc29dbaaee1e038

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9606.tmp\[email protected]\install.rdf

Filesize
606B

MD5
0707bc6738ad269e8b9b7ef88b0fa04f

SHA1
39152abec67bd597e90696591628bb42dbd4eee6

SHA256
fb17bf144c4dd2bafeef07577556eedc159616b49fed003d9c0ff8281755418d

SHA512
5ae2e970dcd358b127681163ce3c9ccae3e40b4bd3d9e8a0edc61e054fd98769cb4b7c6e972098b0d9818abc46e3c3e007732d1f6530d25c8789a074951d0ef6

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw9701.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsw9701.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/1320-74-0x00000000742A0000-0x00000000742AA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads