55008db449e45e8684bfa3190960cac5f53fdff2d2b20577d9a7e86fe5d4d024

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 20:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe
Size

1.1MB
MD5

254857c8aa02223b603fde1f1d17bf74
SHA1

e2cfba82f150034906fa43935917bc724ba0260d
SHA256

55008db449e45e8684bfa3190960cac5f53fdff2d2b20577d9a7e86fe5d4d024
SHA512

df9f3eaaaff7662f171fca0dbe78a58e6f4a6a4c6b7683633a2e0944b1abbd9c9be946de758321bddd0c4a2166882a008389af04f39669d02d074b8d06e13b18
SSDEEP

24576:zxllVmuE1SQXKHwyZM1iL+Ag8VkYd7tamWyMJd:zxJ+1RI/Mi8yklmWbJd

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4960	6L7CH_6WT.exe

Loads dropped DLL 1 IoCs

pid	Process
4960	6L7CH_6WT.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gmnpihinlhdbmhkopjmngaikpkkgpipa\1.6\manifest.json	6L7CH_6WT.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\ = "Doowinload keuepper"	6L7CH_6WT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\NoExplorer = "1"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6L7CH_6WT.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	6L7CH_6WT.exe
Key created	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	6L7CH_6WT.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper.1.6\CLSID\ = "{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\ProgID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\VersionIndependentProgID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\InprocServer32	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\InprocServer32\ = "C:\\ProgramData\\Doowinload keuepper\\e_9jOivn.dll"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\InprocServer32	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper.Downleoaad	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper.1.6	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper\CLSID\ = "{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper\ = "Doowinload keuepper"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper.1.6\ = "Doowinload keuepper"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper\CLSID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\Programmable	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Downleoaad	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\ProgID\ = "Downleoaad Keeopper.1.6"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\InprocServer32\ThreadingModel = "Apartment"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\ProgID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper.1.6\CLSID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\Implemented Categories	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\ = "Doowinload keuepper"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Doowinload keuepper\\e_9jOivn.dll"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\VersionIndependentProgID	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper\CurVer	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\VersionIndependentProgID\ = "Downleoaad Keeopper"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keeopper\CurVer\ = "Downleoaad Keeopper.1.6"	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\Doowinload keuepper\\e_9jOivn.tlb"	6L7CH_6WT.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32}\Programmable	6L7CH_6WT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	6L7CH_6WT.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	6L7CH_6WT.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1472 wrote to memory of 4960	1472	254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe	84
PID 1472 wrote to memory of 4960	1472	254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe	84
PID 1472 wrote to memory of 4960	1472	254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe	84

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0FC59E2C-184F-4B0A-9081-B1BBCB509F32} = "1"	6L7CH_6WT.exe

C:\Users\Admin\AppData\Local\Temp\254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\254857c8aa02223b603fde1f1d17bf74_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472
- C:\Users\Admin\AppData\Local\Temp\00294823\6L7CH_6WT.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/6L7CH_6WT.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00294823\6L7CH_6WT.dat

Filesize
3KB

MD5
02a653af07f765f84cb5b987ddd6822e

SHA1
1862d3e38cb63528e939b69699020bf49ca7ee82

SHA256
864511a2d32909aa21dc65e006dd49610a1d85924953b9b729ae15ab6762e916

SHA512
a9feb8cb36c4550ba2e2b11f082890efd7e3ba2c137e0e58c7b8aa4a12030c3fa0394d520dd5aa137606012b1caafc902f5e6bd9624776bdc3729e7c5f478e11

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\6L7CH_6WT.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\e_9jOivn.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\e_9jOivn.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\e_9jOivn.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

Filesize
110B

MD5
97951eeb651ad96af8ba6635c6bcb4a0

SHA1
fadc8e3a2c9deb60674cb484fb248449e31a6aeb

SHA256
febf0a00912c541ecce6d8e8f6e38feefa68adf60267d8e7c67c1ca1a1d2f413

SHA512
439e2bdd84a3ae051896bd115a8701d7f741292612fed92117eaef197f5ad1a14076887dae27a57275f5aaea329d122c775fcb1ba624a390b2501163a4d98ae2

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

Filesize
9KB

MD5
4a78386edc70db311cf06b1046230a81

SHA1
4292754894acb729b11144877974c983344db326

SHA256
d8dafbf4dbb810a65c0fb259d2995c08ab064f3c478eeb010f3ba57dccf5147e

SHA512
f5a507d1255ff62cfb654c4542fd6648b96175c0eb367290f986ac79965b99828bfa4b5dee92ee9b26ad65662713f3570ed0a9f5f2bb1f2d1f7ca4ff015f7d65

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

Filesize
614B

MD5
b721d9dc0c6b503bd00e9b59a9d7669d

SHA1
9aeb88a3c029b22f481af70882cde527bfd9310b

SHA256
248855bac403681ad0ad66c5214177a0d26909b50488484d05b31aaa6d70a4c7

SHA512
a704e4c936705b5cff030e5747e88ffe6f7ad25f4e77fdaddbf65fc18611b9b93a022a6fb3ad6b2dea7122745f69735231b863b326134e8ba5eac796136d1ffb

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\background.html

Filesize
146B

MD5
c69cb8c7613bd2ed91815aec238c8dd7

SHA1
6729c54e7b564482f261a69593ab5919e9969f05

SHA256
dd3b5312db3dadb53e90557b05a636f0e307672cb9bdcc61c0980c3e80e56453

SHA512
e626bfc92acb13b2595914056db1d4270b9305f081f4288660514bf260abb52da9eb3766b8cbfcab12276ad3950c9415fd30692c3df6c76746de0301d0d69e6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\kElnkQ3Kf.js

Filesize
5KB

MD5
efb33275c51c95e8e75ad6c0a07b9450

SHA1
22732cfec1151646cce2cd2c891a72f52cd14876

SHA256
9561694dd3d5e4288c73afbd797033c84ef6d16a524b8ca6e2f2b5e26d7688fa

SHA512
edb5ecc4ccf44eb43f303b64fb9cdb118dd07c3cb17c11e3d8db974c7882a3408bb603a935e958b29f65ff8bcd9b5049cdcfaa4d37a468c25e07c2066c62fcc3

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\manifest.json

Filesize
511B

MD5
b051bcb5b81306e594e482556363bdfb

SHA1
1d714f323cdff0db1275a277e1dc8584bf8aa634

SHA256
d6dd1fde4c5bdc514d72793a72e81f2d7993155d203d72f4490157c063244116

SHA512
352890c39d2ea5ebec7bd93551f55c58cea8a43d67cdcb24f3edd6748317a9d6dabf962360434f312237e115de22df3ccb9a1da6d94f4d200b1e4c83611928d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\gmnpihinlhdbmhkopjmngaikpkkgpipa\sqlite.js

Filesize
1KB

MD5
6659658a89d5dad28b33719ba168b226

SHA1
64182f97f7539ff4d9c3c217eda6eaa6d4ca3c4a

SHA256
688fead21f6caf685f2be4e87c9954ab2beaf7e9cbdc8368fa5e410397e735e0

SHA512
a91e42d9b9bf4aa7b6058a758baadcb5e6751e9ed979c835ada3845a342eb32873ef0fa5b95ed00f786dc4cec19d1775a278550ea4b8eda7bf124dc3d9c3ff55

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads