9affe839c52a72498b1e20c561b11d6b2b9b40cd48fc28cbc5006f40698f859e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 05:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe
Size

1.1MB
MD5

2bf66c4856e1d1a52d6bc289407e32e9
SHA1

cb452e4b18a6bcd27f4b3a884a5e31dde7b08e9f
SHA256

9affe839c52a72498b1e20c561b11d6b2b9b40cd48fc28cbc5006f40698f859e
SHA512

66069c8ec494b9cc0b21ce5b5a304c3e567a1043386e8f6ba5ff9f7723d6421afc82cf7a22ab5989faad72202ed772d89a6f2bc3c9b99502f2fb8c769fdba64e
SSDEEP

24576:h1OYdaO+OBsFEt5hDG0SAMs9jR/jaJnTJdwY68+UhnWb3aQK:h1OsnOEt5hDG0SAMs9j8nTJ2Y68hWGQK

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3492	0HL.exe

Loads dropped DLL 1 IoCs

pid	Process
3492	0HL.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fjjfgckafehljdieebjcbohadhkkhmpm\1.5\manifest.json	0HL.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B044D982-48CF-37CA-F679-36BBA90B620D}\ = "saafe! savE"	0HL.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B044D982-48CF-37CA-F679-36BBA90B620D}\NoExplorer = "1"	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0HL.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	0HL.exe
Key created	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	0HL.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve\CLSID\ = "{B044D982-48CF-37CA-F679-36BBA90B620D}"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve.1.5\CLSID\ = "{B044D982-48CF-37CA-F679-36BBA90B620D}"	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\VersionIndependentProgID	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\ProgID\ = "ssAfe saavve.1.5"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve.1.5\ = "saafe! savE"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\InprocServer32	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve.ssAfe	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve\ = "saafe! savE"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\Programmable	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve.1.5	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve\CurVer	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve\CurVer\ = "ssAfe saavve.1.5"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\VersionIndependentProgID\ = "ssAfe saavve"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\InprocServer32\ThreadingModel = "Apartment"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\Implemented Categories	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\Programmable	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saafe! savE"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\ProgID	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saafe! savE\\pr.dll"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve.1.5\CLSID	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\ProgID	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ssAfe	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\ = "saafe! savE"	0HL.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\InprocServer32	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavve\CLSID	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	0HL.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\saafe! savE\\pr.tlb"	0HL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	0HL.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 3492	3112	2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe	84
PID 3112 wrote to memory of 3492	3112	2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe	84
PID 3112 wrote to memory of 3492	3112	2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe	84

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B044D982-48CF-37CA-F679-36BBA90B620D} = "1"	0HL.exe

C:\Users\Admin\AppData\Local\Temp\2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2bf66c4856e1d1a52d6bc289407e32e9_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\0HL.exe
  .\0HL.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\0HL.dat

Filesize
5KB

MD5
7a4df93e66d1ac20d205c4859b476478

SHA1
56575958a71f0b64e3a71a2b182e75908e3e9006

SHA256
85d874a3a5bc4d19ecde681e85cf12cc0a2c0932f0ba863ccca67e0f061bf6a5

SHA512
715fe307664ebad7d17d41c4fc4c4588407bdb8cbc4f5c0c708bfa33397196ddb74ebc708ea8b33536b999d968f9a32d7232d999761c5da44db649a837be80bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\0HL.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\1084170925.log

Filesize
6KB

MD5
60d987b71c83916cea2c556fd8fa1cbe

SHA1
ba93b3229ba3877410aa0637b01a29a1abca1e19

SHA256
2b2a7f6f35c4d5721308a43b55fe709006d349f29c48f8d4b2fb71c4c92a0cfe

SHA512
2086e9c0f1ef3112dd3b756de3fea06fe39b0eb44a26df070dd6598d328ba82693045628a6dfeb868bb79ff610b11a421c8dcdf706694d16b93dd6552b7b00b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\[email protected]\chrome.manifest

Filesize
98B

MD5
0fac06576d524f96901cceaa8c863295

SHA1
a157814bdd294443ba3df8e1009eee1e36fd8650

SHA256
2484730dd7d9dc947c13685bf1f4aaf265086e00734450c3094eebfa6e80fd5c

SHA512
15c3a69c0950d173651d498ccd6ccf786e80d01a55517ccae23c0837465f48bfea5f88897a9b3e2591d8bc36a8203f79fdfdce836cb0c07587a8e4f9531892f7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
4f0f635b5bfc4b775b35686365a4198d

SHA1
64f6d2a333fa442bc6b0b81181012d0fa1f5461f

SHA256
3b85d7ee0a02d184f42f37a145448ccff8472e8abd3c46bdc626ac5e38ec1d90

SHA512
b507637225267f05f95ce1b91d94ed9d6bcf9f733627b8f57f810fb1880c516705aef42da760e17eabed3e3ecbc6559c678cf48a1f6b5cc2ce46c10fad31cde8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\[email protected]\install.rdf

Filesize
605B

MD5
cfeeb6be02b9eb61d15818586e52bf45

SHA1
7977f3b512ce546cfcbc07395436c41cb3e5b7a7

SHA256
9273e1fa310dc8de1ba9021a52e8f19590799e2fdeb322d6782d89ff37c2e5d3

SHA512
fea57d4b5144d65dd2180e2becc3214546969a988b7bc61498faad1c8d0d5bf0a96df42a50e3ef726286b6ed099c982b8f093ef1d223c5e12f5558eae7e39095

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\MdM.js

Filesize
5KB

MD5
c7594c2afe51fd2be96dc5539b564700

SHA1
c764eb49e6c9e57d4e52e935796be1838abddbb8

SHA256
696d7ccc30e76dae6ba037d66d45c23c5d437e62b6876f7e97e4e9f8c7467692

SHA512
28f8d705f28d22e0b5134694e0647870f7ebdee08cedb02d3df40721577d4dabec0b813fdb44e39883f6d86505792f2308bef41b74de5d04a2c13835286c5f6c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\background.html

Filesize
140B

MD5
d15fc2d70ef18df76db5851616d4d9f8

SHA1
eb1af8ccfa981d2ef8200f5142c2fcf35f25d555

SHA256
991ec88675a6585dd8187709e24c8d301daf7392f0d8ade849f0b66124b77f99

SHA512
d2e145aa48286fd5296486a9818517cf809f987699c2d07cc26943cb75e986a15514975dd18dfa2049a11055ec44472e903a60b0791d4783666cc30e60a7ee01

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\manifest.json

Filesize
503B

MD5
c5d7e1659558a9bfd678a386992077fa

SHA1
446ae28a01002f2ca60a407a3f4f141be5841675

SHA256
1bcdf3fdcc4ca8d2aa722daa4e811ee5568eb3a125f344094d1d831557bdd332

SHA512
39f326bd2e8f154d0d1b08fd9f1393021790ee703647d85e18bf576ec69ae6271c6f0c4d41a748260c09250a43c37a384545df5c28ffe8f4a7606b3f2196c5f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\fjjfgckafehljdieebjcbohadhkkhmpm\sqlite.js

Filesize
1KB

MD5
a7f46af55c08558a581a7a71b41d125d

SHA1
acf7dbb139e5efede5cf4f9a34682ad2bef85dbe

SHA256
4e6cb0c29a43543ee0be5a644e744888f2715a0cdb100fa81e36d07355f66706

SHA512
59d43a54f07e88744b02603a932d071a98472832d0651b02e31f8ba17f8fb3fc66806ca0d7fa4e9a718630f8efebcb52be9afde21d036084726b7b8b10b0e3bb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\pr.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\pr.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS275C.tmp\pr.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads