c18802fb7aaed4b451aa1f4b458e2f21ec24a6feb7088d09be09ee089612bf86

Analysis

max time kernel
131s
max time network
151s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-10-2024 01:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
Size

720KB
MD5

28be048c6d4a2d32c49670a511a050d7
SHA1

d62f2b854cc41d85f9f5a7740b802d14c5455689
SHA256

c18802fb7aaed4b451aa1f4b458e2f21ec24a6feb7088d09be09ee089612bf86
SHA512

12fb4ef4b0dd182ae89584243b759ff273aa33a36bd01580f5361ea50d75b1c36409958cdab5ae254ae6af92143d249ca3d69604400be5873f84c42ef9da738e
SSDEEP

6144:Xq3asTI2ExWUZnT357SyC2VL8877pG2CPRg1Xf639tMx24XfXhSVZ1L+ToRDaep6:a3tvExlm2e1g1v638xlpSNKuH/i

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2384	ShopAtHome_Toolbar_Installer.exe
2096	SelectRebatesDownload.exe

Loads dropped DLL 3 IoCs

pid	Process
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Network Service Discovery 1 TTPs 2 IoCs

Attempt to gather information on host's network.

discovery

Network Service Discovery

T1046

pid	Process
2000	firefox.exe
2004	firefox.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\SelectRebates\SelectRebatesDownload.exe	ShopAtHome_Toolbar_Installer.exe
File opened for modification	C:\Program Files (x86)\SelectRebates\SelectRebatesDownload.exe	ShopAtHome_Toolbar_Installer.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\	ShopAtHome_Toolbar_Installer.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ShopAtHome_Toolbar_Installer.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SelectRebatesDownload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	iexplore.exe

Checks processor information in registry 2 TTPs 6 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings	firefox.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2004	firefox.exe
Token: SeDebugPrivilege	2004	firefox.exe

Suspicious use of FindShellTrayWindow 4 IoCs

pid	Process
2004	firefox.exe
2004	firefox.exe
2004	firefox.exe
2004	firefox.exe

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
2004	firefox.exe
2004	firefox.exe
2004	firefox.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2384	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	30
PID 2084 wrote to memory of 2096	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2096	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2096	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	31
PID 2084 wrote to memory of 2096	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	31
PID 2084 wrote to memory of 1808	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	37
PID 2084 wrote to memory of 1808	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	37
PID 2084 wrote to memory of 1808	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	37
PID 2084 wrote to memory of 1808	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	37
PID 1808 wrote to memory of 2416	1808	iexplore.exe	38
PID 1808 wrote to memory of 2416	1808	iexplore.exe	38
PID 1808 wrote to memory of 2416	1808	iexplore.exe	38
PID 1808 wrote to memory of 2416	1808	iexplore.exe	38
PID 2084 wrote to memory of 2000	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2000	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2000	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	39
PID 2084 wrote to memory of 2000	2084	28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe	39
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2000 wrote to memory of 2004	2000	firefox.exe	40
PID 2004 wrote to memory of 236	2004	firefox.exe	41
PID 2004 wrote to memory of 236	2004	firefox.exe	41
PID 2004 wrote to memory of 236	2004	firefox.exe	41
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42
PID 2004 wrote to memory of 408	2004	firefox.exe	42

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\28be048c6d4a2d32c49670a511a050d7_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\ShopAtHome_Toolbar_Installer.exe
  C:\Users\Admin\AppData\Local\Temp\ShopAtHome_Toolbar_Installer.exe -t:"C:\Users\Admin\AppData\Local\Temp\Low\29FVMGIB.exe" -d:"C:\Program Files (x86)\SelectRebates\SelectRebatesDownload.exe" -i:"C:\Users\Admin\AppData\Local\Temp\Low\B85R264U.tmp"
  2⤵
  - Executes dropped EXE
  - Drops file in Program Files directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2384
- C:\Program Files (x86)\SelectRebates\SelectRebatesDownload.exe
  "C:\Program Files (x86)\SelectRebates\SelectRebatesDownload.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2096
- C:\Program Files (x86)\internet explorer\iexplore.exe
  "C:\Program Files (x86)\internet explorer\iexplore.exe" "199.221.131.86/RequestHandler.ashx?MfcISAPICommand=installstatus&param=%10%01%01%00cIh8TWZadr7iiDTOi6Utcg07tcavA3WcY3TV323eREHrpox731DkC58QTRHspeT1YIDS4EjLVPhtaf5poFCU8x20ZoznMAyfiJdmWIThCfaOBu8oZwQeYlIGf6ovdctkBmT_byJ0MPqRgJFTgIdIUxTrMqIQxwK_MXIXVCZAynu0WBUAtKYnuVrUPOTgO32PdwlyoJ6TODuATBAfZvLmmoaISxIVIA98Sx1mrvrAM1Q6yFeendvZQySDuYGx3kj2JePPhZ_BuIgdUFy_1UwBPLKnNgsHdPJMJ4DbvcrgK7OurzHV9jrdtZzcmNy5lajhub4pgyyTAbmAMl6ITh0tE4hHZbap_uXfR00qSYNChMy"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Program Files\Internet Explorer\IEXPLORE.EXE
    "C:\Program Files\Internet Explorer\IEXPLORE.EXE" "199.221.131.86/RequestHandler.ashx?MfcISAPICommand=installstatus&param=%10%01%01%00cIh8TWZadr7iiDTOi6Utcg07tcavA3WcY3TV323eREHrpox731DkC58QTRHspeT1YIDS4EjLVPhtaf5poFCU8x20ZoznMAyfiJdmWIThCfaOBu8oZwQeYlIGf6ovdctkBmT_byJ0MPqRgJFTgIdIUxTrMqIQxwK_MXIXVCZAynu0WBUAtKYnuVrUPOTgO32PdwlyoJ6TODuATBAfZvLmmoaISxIVIA98Sx1mrvrAM1Q6yFeendvZQySDuYGx3kj2JePPhZ_BuIgdUFy_1UwBPLKnNgsHdPJMJ4DbvcrgK7OurzHV9jrdtZzcmNy5lajhub4pgyyTAbmAMl6ITh0tE4hHZbap_uXfR00qSYNChMy"
    3⤵
    PID:2416
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" http://discounts.shopathome.com/ToolbarPostInstall.aspx?TargetPage=http%3a%2f%2fdiscounts.shopathome.com%2fGroceryCoupon-Portal.aspx&A=ErrorPI&owner=nonbundle&ErrorInfo=&ErrorLevel=-12&GUID={53BD8D71-3A5A-47CB-BAFB-31BF75D9C869}&ae=no&source=76338&subsource=SEPDSE&setupguid={56371da0-c3d7-4930-a736-9fc895df3d8c}&setupcid=34580432&cid=34580432&refer=0000&disabler=-1&tbstatus=3
  2⤵
  - Network Service Discovery
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" http://discounts.shopathome.com/ToolbarPostInstall.aspx?TargetPage=http%3a%2f%2fdiscounts.shopathome.com%2fGroceryCoupon-Portal.aspx&A=ErrorPI&owner=nonbundle&ErrorInfo=&ErrorLevel=-12&GUID={53BD8D71-3A5A-47CB-BAFB-31BF75D9C869}&ae=no&source=76338&subsource=SEPDSE&setupguid={56371da0-c3d7-4930-a736-9fc895df3d8c}&setupcid=34580432&cid=34580432&refer=0000&disabler=-1&tbstatus=3
    3⤵
    - Network Service Discovery
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.0.1770814625\1208409812" -parentBuildID 20221007134813 -prefsHandle 1212 -prefMapHandle 1204 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {11e36a7e-4360-4145-9c40-21d38d156fa8} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 1292 10dd6e58 gpu
      4⤵
      PID:236
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.1.1911390813\1057434565" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21708 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {55ff55bf-a4c1-4b10-af2e-9fe802e73a88} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 1492 d78b58 socket
      4⤵
      PID:408
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.2.611858139\538344891" -childID 1 -isForBrowser -prefsHandle 2096 -prefMapHandle 2092 -prefsLen 21811 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {122e4071-a6b1-4056-b0e5-cdf988d9bc3c} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 2108 1a5d3358 tab
      4⤵
      PID:1224
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.3.1796264263\1687101007" -childID 2 -isForBrowser -prefsHandle 2928 -prefMapHandle 2924 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3971306d-f6aa-44f9-9b48-ef262dfecd25} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 2940 d67958 tab
      4⤵
      PID:1484
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.4.1762218500\638539624" -childID 3 -isForBrowser -prefsHandle 3552 -prefMapHandle 3664 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b28ec4b3-2628-4cfe-a8e2-4ee7c1b7117e} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 3716 1f5cfc58 tab
      4⤵
      PID:2760
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.5.782434837\1571715115" -childID 4 -isForBrowser -prefsHandle 3824 -prefMapHandle 3828 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {c463d8b6-1207-45c8-9154-72cfb2b7e18d} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 3812 1f5ce158 tab
      4⤵
      PID:2564
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.6.240138919\955645500" -childID 5 -isForBrowser -prefsHandle 3988 -prefMapHandle 3992 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {16a83ade-4460-47df-a010-67ab2af3afa8} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 3976 1f7f5b58 tab
      4⤵
      PID:1496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.7.1733519774\69812526" -childID 6 -isForBrowser -prefsHandle 2212 -prefMapHandle 2220 -prefsLen 26356 -prefMapSize 233444 -jsInitHandle 860 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {338d706a-7154-457b-95fb-135105d23738} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 2104 22c21258 tab
      4⤵
      PID:2804
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.8.159412178\1913066527" -parentBuildID 20221007134813 -prefsHandle 4436 -prefMapHandle 4440 -prefsLen 26531 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a994ac5a-6e2a-46d9-8b0e-748ff222a74a} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 4452 22d30a58 rdd
      4⤵
      PID:2572
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="2004.9.222620098\2052739356" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4460 -prefMapHandle 4492 -prefsLen 26531 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd7b40f6-ca35-4bf3-917d-8385d10614cf} 2004 "\\.\pipe\gecko-crash-server-pipe.2004" 4556 22d30d58 utility
      4⤵
      PID:2624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Network Service Discovery

T1046

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\activity-stream.discovery_stream.json.tmp

Filesize
25KB

MD5
46dd8f50740e836d62341c488d854749

SHA1
92e47e5023a2bdb40f30293b79796afb39483fb3

SHA256
997f9be724dc36935a6b234d3059d0c287ef3b679910a357e2635bc28dcb6d91

SHA512
044710578551f5e8434a90e50a5f16de4cb8eb5901a82764da1c94b098aa08662a758675e191c6374c355e08aa382088a9a8463b0f4fc2404032f75738241c62

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\29FVMGIB.exe

Filesize
169KB

MD5
f39348b3686adbca62ef358ed960c72f

SHA1
423254699a10cef687d0a8ea3657578f396013af

SHA256
8f767ee96d79581fdda62e6e841ae9143d2401a609e96f3f8746cd845e8a7969

SHA512
6ce1379d23f9c0b7b94d4c9804cbc55035c3bd6dee1a2c36e273185e84f7c274712e5ea01f309432a8e468676898d1b8c369fe4d7d60d6b94394182bfed56865

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\B85R264U.tmp

Filesize
56B

MD5
d32cede39e8b41ffb8f4a30b6006f5f0

SHA1
e4ce679afab2abf9e586f5fc938685354b592eb1

SHA256
eb8e6cab79e6781b58f83a3fff33b520195eab2b2eeb748eec69e14e5a83c64b

SHA512
e2d1c360e077d2b1dbe100869b347967c132036210994ebfcccc7cfda6b894344df89622dbd8ea6e6fab7746f836817425c3920dffe67dabcd70ca05ff50ccd1

Download Submit
C:\Users\Admin\AppData\Local\Temp\Low\B85R264U.tmp

Filesize
73B

MD5
1c1c50eb4f1f6b881054f3fadcebefdb

SHA1
19dfa7ddd3ba46f7ff55e08ee76e3b49030ac5eb

SHA256
020eb4c5f6b8d78b3739b7c3265d5d437e9353f19d0e727f31aa3edf88674c54

SHA512
87bb21b9cef8acd34cacef64931af222cc6afa3d2eeeef29628d131c90556d9a06df6c5b524a1a4c8d106c9004b5c553d8007578888b24e82097ab22b4297920

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
442KB

MD5
85430baed3398695717b0263807cf97c

SHA1
fffbee923cea216f50fce5d54219a188a5100f41

SHA256
a9f4281f82b3579581c389e8583dc9f477c7fd0e20c9dfc91a2e611e21e3407e

SHA512
06511f1f6c6d44d076b3c593528c26a602348d9c41689dbf5ff716b671c3ca5756b12cb2e5869f836dedce27b1a5cfe79b93c707fd01f8e84b620923bb61b5f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
8.0MB

MD5
a01c5ecd6108350ae23d2cddf0e77c17

SHA1
c6ac28a2cd979f1f9a75d56271821d5ff665e2b6

SHA256
345d44e3aa3e1967d186a43d732c8051235c43458169a5d7d371780a6475ee42

SHA512
b046dd1b26ec0b810ee441b7ad4dc135e3f1521a817b9f3db60a32976352e8f7e53920e1a77fc5b4130aac260d79deef7e823267b4414e9cc774d8bffca56a72

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\db\data.safe.bin

Filesize
2KB

MD5
4b15a436bf3c5cff216e9c5a277af23c

SHA1
bbe70c3585007b66e7549e418fb5bfb02e4ed865

SHA256
deca75ab9eec8e42ac10acdf4144cf34cea41f2f49a980780aaadefbe67dd783

SHA512
a7a5598c34f45c447f856f1f26b0279c98ffbb86ed98139317aec3552ba31a99e5cef166eb576d1e863b067008c9a5d20ae29e1615965e6a594c6686b7f1ae7a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\398ffafa-6729-43ee-86cb-e7adaabf5e2f

Filesize
12KB

MD5
17c719b4e605cfb77820b9aab01d9a52

SHA1
019698635a6ae332abfe36a2bf9da3697907ccd2

SHA256
d83a24fc902be4aa85a58318559cffbedb8cf4f742535aa3c4cc49bb69b1ccf7

SHA512
12463ab7d189c3697144b548f178e9c35dff3552a4923aaeee84ca37a4c489c02a0aca9d2c00ca122e97ff9b7e34236d8631954358dd84d5cd741acdb619b46e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\datareporting\glean\pending_pings\b6f1bd7b-980e-4403-b20a-edc1c5be4082

Filesize
745B

MD5
c57810ea7fe6c7f47f57cc2d93ee61db

SHA1
186b3a05c7a8f02fb8c70a0670b1c601bde14a2b

SHA256
a8dfe1ddea3e95ea5c5a2ddb3ef8175a3ed84554d51cb1734d73edee9f04be1f

SHA512
affcc894ee7dad473c1ce8a5eefaf79a3fd727b5415fb414f7f9d8cdaa889da0c8fd6bf8eaa1764776d22dac9f881316811c0c7ec14eb8dac52c01ea2efd92c2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.dll

Filesize
997KB

MD5
fe3355639648c417e8307c6d051e3e37

SHA1
f54602d4b4778da21bc97c7238fc66aa68c8ee34

SHA256
1ed7877024be63a049da98733fd282c16bd620530a4fb580dacec3a78ace914e

SHA512
8f4030bb2464b98eccbea6f06eb186d7216932702d94f6b84c56419e9cf65a18309711ab342d1513bf85aed402bc3535a70db4395874828f0d35c278dd2eac9c

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-gmpopenh264\1.8.1.2\gmpopenh264.info

Filesize
116B

MD5
3d33cdc0b3d281e67dd52e14435dd04f

SHA1
4db88689282fd4f9e9e6ab95fcbb23df6e6485db

SHA256
f526e9f98841d987606efeaff7f3e017ba9fd516c4be83890c7f9a093ea4c47b

SHA512
a4a96743332cc8ef0f86bc2e6122618bfc75ed46781dadbac9e580cd73df89e74738638a2cccb4caa4cbbf393d771d7f2c73f825737cdb247362450a0d4a4bc1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\LICENSE.txt

Filesize
479B

MD5
49ddb419d96dceb9069018535fb2e2fc

SHA1
62aa6fea895a8b68d468a015f6e6ab400d7a7ca6

SHA256
2af127b4e00f7303de8271996c0c681063e4dc7abdc7b2a8c3fe5932b9352539

SHA512
48386217dabf7556e381ab3f5924b123a0a525969ff98f91efb03b65477c94e48a15d9abcec116b54616d36ad52b6f1d7b8b84c49c204e1b9b43f26f2af92da2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\manifest.json

Filesize
372B

MD5
8be33af717bb1b67fbd61c3f4b807e9e

SHA1
7cf17656d174d951957ff36810e874a134dd49e0

SHA256
e92d3394635edfb987a7528e0ccd24360e07a299078df2a6967ca3aae22fa2dd

SHA512
6125f60418e25fee896bf59f5672945cd8f36f03665c721837bb50adf5b4dfef2dddbfcfc817555027dcfa90e1ef2a1e80af1219e8063629ea70263d2fc936a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll

Filesize
11.8MB

MD5
33bf7b0439480effb9fb212efce87b13

SHA1
cee50f2745edc6dc291887b6075ca64d716f495a

SHA256
8ee42d9258e20bbc5bfdfae61605429beb5421ffeaaa0d02b86d4978f4b4ac4e

SHA512
d329a1a1d98e302142f2776de8cc2cd45a465d77cb21c461bdf5ee58c68073a715519f449cb673977288fe18401a0abcce636c85abaec61a4a7a08a16c924275

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.lib

Filesize
1KB

MD5
688bed3676d2104e7f17ae1cd2c59404

SHA1
952b2cdf783ac72fcb98338723e9afd38d47ad8e

SHA256
33899a3ebc22cb8ed8de7bd48c1c29486c0279b06d7ef98241c92aef4e3b9237

SHA512
7a0e3791f75c229af79dd302f7d0594279f664886fea228cfe78e24ef185ae63aba809aa1036feb3130066deadc8e78909c277f0a7ed1e3485df3cf2cd329776

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\gmp-widevinecdm\4.10.2557.0\widevinecdm.dll.sig

Filesize
1KB

MD5
937326fead5fd401f6cca9118bd9ade9

SHA1
4526a57d4ae14ed29b37632c72aef3c408189d91

SHA256
68a03f075db104f84afdd8fca45a7e4bff7b55dc1a2a24272b3abe16d8759c81

SHA512
b232f6cf3f88adb346281167ac714c4c4c7aac15175087c336911946d12d63d3a3a458e06b298b41a7ec582ef09fe238da3a3166ff89c450117228f7485c22d2

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
cd522e08940ad62d87c2d030d6f79ca9

SHA1
f21af1b2e9501d38103cd5174ed8ee42acc1be96

SHA256
ff9a2525835a0b820134c0025ab1fedb04308e22689d86592118c7e01d111bdf

SHA512
fa68c5aa53365a0b6a5b07c2bed5e8c783bb78da2541f8c3c0a3417bd24a43d595c7687c6daaa73ed7ba882b1768f298a214cf3bf950c3bd94e8bd75ac4e4097

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
7KB

MD5
abdd9eb109261bea6e21ec04095ea8fa

SHA1
a7422b28865499d378a7dea1a59051af89079067

SHA256
0e93f857fabe70a5d73c445a2ad8ce654ff4bf968eecafdb6134536a81455ac9

SHA512
2d187b18b4e737459b4ee9866e31c580e91eb001d75b6632f96419b968021abd67472b901c20ff138b4651866067344c209f1e3b9af04c852d6cd523635b44a3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
7KB

MD5
a4b5335c5d82bf5d577bb928ac9fee88

SHA1
013eea59a06f4f487b9e52fae27f784183af680f

SHA256
355203f2f4ea6846d2722bcd35b575a65c921b85222884fdb49dd8dd6a81a483

SHA512
c5cc72d6e623c45f22dd0053d476f207285367d6d60e9daecd62d0878e4b0faeb3740e6533aea237c2fc08362b4d65df3041b13c95c300d989337ee9281cae10

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\prefs-1.js

Filesize
6KB

MD5
2b58a060863b7006144a4134eb1dba1d

SHA1
f058616d0fcedd98181e7e336196f2f2afce1862

SHA256
b31abd54cc9313172476595a468ee21ff962252bad70150109cd4bea73b99515

SHA512
f8f0146b3d6c141ccfd5c32ef68a4ecc25cc4659dbdfd45e3636ff61ad226b8fb1a288e2a9145c930af54854ee2bee978335444bbf924e369b917ca1198dcb6a

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\ytcgl2sn.default-release\sessionstore-backups\recovery.jsonlz4

Filesize
3KB

MD5
87ce7ef4af1db019134336597ce78472

SHA1
cbfdf7235814aca4915dc5034096ce62b3f23bce

SHA256
e06480a32be04b1ea13da8dde2e751af7c30f886b2b8d1c70da207ee82c99844

SHA512
bca0a1c35d051a40ca834cd8927d9b8c2555f36a3859f0b8e501a5c51160504e4139d9b2a7a9a71c7c11e62a3a866244c3427f1301ebdcffe21ccee74ab62b8e

Download Submit
\Users\Admin\AppData\Local\Temp\ShopAtHome_Toolbar_Installer.exe

Filesize
185KB

MD5
d09992149527ca5fc2a3cd3ea9bcfbb9

SHA1
c4d2dd7711ca3a7747b66331ac54d8e258fc1c1d

SHA256
6a88c4ec017f69d2a7d7491b352bd278f78dfc32491ebdd2ec4ac9ce7c9b7d98

SHA512
d6f638c364550e85fcaf1f0b12d15a75dd8e049d13335ca71b37c29fb8675baaccc0463a735fa3808c336b5137d0b1e5d8f749c13079de9f29ca2d9857efb200

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads