10143fa9bbe3d2765bf321580182fcb28eabc8e5614440fdb6d3651c50a87654

Analysis

max time kernel
119s
max time network
121s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
06/10/2024, 12:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe
Size

255KB
MD5

17ffd59af55b6d4e1ad9986852c18980
SHA1

ff0c470dd2627941f16008018814ba5bc0e74901
SHA256

10143fa9bbe3d2765bf321580182fcb28eabc8e5614440fdb6d3651c50a87654
SHA512

6d635238bf8e0eb516ac30ee3113f1f4c7d7d4b5997e2b19dd9f0726feeded42d3d9a424d2b8bd8178f4beab4b585d26acfb85a0917869a727ae78bcfb93df39
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5MXPaCazBwoV4h+CyjLd+J34:h1OgLdaOmPdajWh+pLdq34

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001a09e-72.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2704	51f6162539f5e.exe

Loads dropped DLL 5 IoCs

pid	Process
2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe
2704	51f6162539f5e.exe
2704	51f6162539f5e.exe
2704	51f6162539f5e.exe
2704	51f6162539f5e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jpiedmbpklppdbpagpdpcdbakgdkgejk\1\manifest.json	51f6162539f5e.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA73D854-3037-ADA5-A4E0-0283F2818F86}	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\ = "ssafe ssave"	51f6162539f5e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\NoExplorer = "1"	51f6162539f5e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x000500000001a09e-72.dat	upx
behavioral1/memory/2704-74-0x00000000750D0000-0x00000000750DA000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51f6162539f5e.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x00050000000195d6-31.dat	nsis_installer_1
behavioral1/files/0x00050000000195d6-31.dat	nsis_installer_2
behavioral1/files/0x000500000001a41d-94.dat	nsis_installer_1
behavioral1/files/0x000500000001a41d-94.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\InProcServer32	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\InProcServer32\ = "C:\\ProgramData\\ssafe ssave\\51f6162539f96.dll"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\ = "ssafe ssave"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\InProcServer32\ThreadingModel = "Apartment"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\ssafe ssave\\51f6162539f96.tlb"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\ssafe ssave"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\ProgID	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f6162539f5e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86}\ProgID\ = "ssafe ssave.1"	51f6162539f5e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31
PID 2732 wrote to memory of 2704	2732	17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe	31

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51f6162539f5e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CA73D854-3037-ADA5-A4E0-0283F2818F86} = "1"	51f6162539f5e.exe

C:\Users\Admin\AppData\Local\Temp\17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\17ffd59af55b6d4e1ad9986852c18980_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2732
- C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\51f6162539f5e.exe
  .\51f6162539f5e.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ssafe ssave\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\51f6162539f5e.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\51f6162539f96.dll

Filesize
116KB

MD5
05234975b085632d70d89c2f420c5107

SHA1
078fb2a3e5de54c3737a4541242a4725c02c6b9c

SHA256
a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a

SHA512
f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\51f6162539f96.tlb

Filesize
18KB

MD5
c1e296ff01d3cf37f91c7473bdd9de52

SHA1
832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6

SHA256
a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492

SHA512
aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\51f6162539d732.58246558.js

Filesize
4KB

MD5
39a5eb458ff2fdec53073d8ba2b425fa

SHA1
81dd54fe2deb9209e2ebc49d086af6450d1d3382

SHA256
ee2ccb4e58a7bbf43f05800daf834348c449526e91fa9fe5f8a7591a8efece6f

SHA512
8ab405f54ba6b6429eb48ea9985ae8ea0f8e65c636b1dfe67d6f1c1d1b880a3c8de0d1a4f3110bbd1946a1351b78b46101f9f29eec7de5f82952d5e518806e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\background.html

Filesize
161B

MD5
acca647e665a3ab247c7125475e437bb

SHA1
69c05459816fb507ff8151a46d897cefa55aabb5

SHA256
975991785e7f4d01ab7aae1fbbe0c40dd1eac39749f5b02d9ad6fa79d21528bd

SHA512
53fa4e759fc1d8fb166f0fcbd81d5f84c615db23b2c3057559587c26e567cdc42e963a23a31f7e021d4efc20f30e3de36591c89b414a92085bdb72ea356e2c7a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\manifest.json

Filesize
503B

MD5
f523c6560d89d56c1dd2a0afe94f49c5

SHA1
6e701d307e9ca05fa6e5ffbdc1c418cb4a9b3d38

SHA256
e26a084f92762024ded9d552657b382219149952b4e083c538bbe7c5e798b6e5

SHA512
ba9af1735f5c02c86361465f0d8f78af2142e5fceaf365d1c18e614086e4087f40cef130c296cb02ad5ab71f0f1221b31471136097faf033d25a50411e4690c9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\jpiedmbpklppdbpagpdpcdbakgdkgejk\sqlite.js

Filesize
1KB

MD5
002f6c773b8f1df64721a6391c95c9cc

SHA1
50bf79df1f89c38e102f3edb70f76d415c1e5bab

SHA256
a717c55df6280736298554d16edf10bb90a5824c8288aa51f06a9f0c67caf435

SHA512
0f24cfd851d23fe5753444e1f9c6147e53e1fed6f8d7555e2229a2fc44b323c21f87ed7e636ba609da6e888d498858b23cf0b596e380ca3972d07677f57c5f76

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
dbb54b01bd81aba7147a93a906f22ce2

SHA1
ceee2a5ef21c95e66b34dc8763847f4edcab106f

SHA256
025c4779a62b89f4a41cc50f916d5b8d51ed26e2408b859bb5041c4881b341c1

SHA512
47e5e26e2335256185abccb4821dd9508448dd6bf38633795c6e99ce1f970cd454979de02a43fcddb65db9bbae84acda24164cdad1caa4a30ed3e984f37c4012

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
8decc357f4fd31c8304d39ee9a93dd66

SHA1
c6f6cef3d085894b5876ccbb3462073c32515d63

SHA256
10829f626b54ac31e00210dfd0080ea8a1765e5243d03f0e5a7a0e05a3a11ce5

SHA512
af3afef1d2c4dea406cd1ac29eac1c000364f1e1ebda6ff491c930b7a29206252de29351f33ec001e8ff7184715e6648204b644829ef3165759caf4ee4cddf6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
9b7914609067ed70232ebadce5716fb5

SHA1
bfac80d7771b9e321fa1fba14466f0266ae98f0e

SHA256
958a2cc3e579c91d3a0bd012748e48f0f6fe74445f1a2deac1cbe134dd94d61b

SHA512
3a187ca679ea5421f97ac167755b81d4d53263796fb0cd62366bc71dba85fd48d52d818293f3292a0637b0bf986f20650db8832be450d53b806b7c0b137645ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\[email protected]\install.rdf

Filesize
610B

MD5
9555bbda36b6927c746bfcdbc9dfedc6

SHA1
68d51cdc467b4155932be27212235f2b0498e003

SHA256
bb5d53adf83a89dfd663ec42b0d84aba20fcc9abc1f9c0199ad926b2d8f17d49

SHA512
00c22daf67e60f3c3e3cc67ff09722705db81bdcfb6be632523aca6d030326912150709f8ec5b5b81df26419e9657f4cc37c35411aec9d8072f9467545cb5213

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSEC23.tmp\settings.ini

Filesize
6KB

MD5
99ce6c8fb2c846230e1831e3371abd6b

SHA1
6a31170f34d18f58519a65c4129daf59a329fc88

SHA256
019eec1bdf394be1fcd1b79c609c5940fd4fa2b6271ee7f87e66e969c6bf7bac

SHA512
12719b1eb86c6a4fa25142bdd206c596e15afa44b99c0d831d20ea18b704c2e0748935aa8a9d2e6c2a5e57b1b9d2c6267a1efbaa045b69ba42f8424f7a8dcf85

Download Submit
\Users\Admin\AppData\Local\Temp\nseECB1.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nseECB1.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2704-74-0x00000000750D0000-0x00000000750DA000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads