4fd93bbb21d237b209ff133b6b741f824e1bf994183abf5f71217aff8c98ba3b

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 10:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe
Size

552KB
MD5

2f487de624de03c1df12168d08ac2e54
SHA1

084424d72682fa9e2d981431a18a49d5558c1bd4
SHA256

4fd93bbb21d237b209ff133b6b741f824e1bf994183abf5f71217aff8c98ba3b
SHA512

3ee0a5f4b928416b33ca42202a183a56004a515ffb35cc5c5bd3b923f5d7e75da32beb5cb5c394e7c6c663dde717a98e40fe0168867be11555934e9f8077ac82
SSDEEP

12288:h1OgLdaOKWctn+MEfOUgbJuMmFcouJqkY:h1OYdaOKtMOUgJHJJqkY

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2852	regsvr32.exe
2852	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dfclhednkemcllkenmhfhnboppipmggk\1.0\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\ = "SearchNewTab"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\ProgID\ = "SearchNewTab.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\ = "SearchNewTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\VersionIndependentProgID\ = "SearchNewTab"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SearchNewTab\\FuGe.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID\ = "{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SearchNewTab"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID\ = "{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer\ = "SearchNewTab.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\InprocServer32\ = "C:\\ProgramData\\SearchNewTab\\FuGe.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{4DF392C5-6A4F-0802-C641-B56BB6C0FBCE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30
PID 2516 wrote to memory of 2852	2516	2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\2f487de624de03c1df12168d08ac2e54_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2516
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" KVq1.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\FuGe.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\FuGe.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\KVq1.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
9a723d1f5523d95c8526ba00bfbb7e4f

SHA1
724aa6ec8cc13ce3566ea7e85e0501b4b7b0a7b2

SHA256
2fcbbbb90bc2a4f31aa68073b9321038ea003897284e89f2b83d0f2163cd1905

SHA512
e713bbef1040e3c50cf61bff56e0ec62eed279c8b5ebe3299b170d51c925071b3044435cb988590ad8576baef2b9c2d80d1f522c2c8621558f09352b42435d6e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
25e275171dd65b607c0695a3345bd503

SHA1
882cbc32bd04ad12bea2a895d958a6c25ad6cdd9

SHA256
6e83f1dd075235b51011a059bf4d526e197aea6cc24994ea3abd9ccc5473a4a9

SHA512
a67cec650bc6610298b32b1af65e74d3b7a36ee6d5548bab3aa0e354502e8fa39ea59116e0bbcb19479b74767799440b7caf8aefd1ba47c89e4fe19d1ef48a56

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\chrome.manifest

Filesize
102B

MD5
7067c7411686222d29cb0181daf18922

SHA1
28dae64c753f7569a9d070f3a5a07a0c1ef59950

SHA256
bccdbb158e2517ff7fc0e0f2fcaeba26314a63c0dae29392c093803f3cc55ebc

SHA512
30fed41a63bd5dd0f124500a64863c0dd9ace6c643119bbee867531f8449b52e5a7728180dcf09257adb8ec69ca6b58573129af8e257dc9cb215bc1ae3c195d3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
4684e4b7f717feb66da79c2f498d1764

SHA1
5ea89e5e4fcb9644c110630cb9b59513253e6ad8

SHA256
27561aac183134f1b0da0e188c632427404146032b78c0898faa405051869024

SHA512
59d9eb8086b866d84693b98673175ac75fa0bf81cfb3a626513f5ee4d7cdfcaf41f4a2d7dcffa185d6cc5c0a1159021717efda083744916a96abe4f82dd46d57

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\[email protected]\install.rdf

Filesize
604B

MD5
ed01911f8f1a607c8e4f691739bd4671

SHA1
2eb7354ba5a79e7ddb2a1a4ebbd75a05588ea858

SHA256
b780d233970109220701f4c2a3e5de406b01d1985df6d50fee96ca16431a870b

SHA512
fed8f0e263668caec42d97cf42f3bf9ebd5f1b1ad5c8cdd789f74587db75dd8630823dec4a34a3d55d3ee9608048467874ec747b4e2a6ebf839f7a2bdcdb6532

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\JXTx4.js

Filesize
5KB

MD5
35cc5c49efefe26af80e1cd0ee48be0b

SHA1
2127e09fe14264f6c15e246c85debf31e060c938

SHA256
9201db5d9d0a360f641575c0a0d7d203d35363883294ba289460c5caf4f0d107

SHA512
6ae9bddc2ce480b48479f3559f660182d78fcb18cded9ee19bdd7343b70c66470258ef9706d707a5390d5abd576d06ab87cfc2ef42047f3be4af3ef90e4f6e33

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\background.html

Filesize
142B

MD5
d3c5fe34c5c3efda93a8893b5154d79e

SHA1
8fbec7b7ef45e74275c94cb4c46b5d6cf44eceff

SHA256
8a0bb4ed4150955c8c457d4fc4adf2e79eefba1734e0f381cae96b5b3b27fcf5

SHA512
ca6cb22d277bd7def2584c4eaec11868ee79b3aa6138fc5975eaa3ec42312801b082bc971eb340059a685de320268dd6c7e1605906ef3d1fb40eed467a663297

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\manifest.json

Filesize
552B

MD5
8071a311337c0df23f4b7d417f6db406

SHA1
b8ee3931a76a601ca8da7a58a939dca9b308da41

SHA256
77c6657c4667649aff331bf26872dc7d1d7377c34567edc8cb995141698bcef0

SHA512
339fc43b3f56beca9e486ba457c7f567020d883e750f644b2dfe7a7d1949c1ef7ce409220686cc3732ebc5da61ba084a90fc659356ae649fb6c71c364c37ed9b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\newtab.html

Filesize
347B

MD5
78a7fb965ccd462afb2b3804f81ac18d

SHA1
192ae928145c8a910533644045dc8841591e7fb3

SHA256
95aa5d83f2bcaccd50cc327a27afef74a0d4e0616c167d82332a4617061bd7cf

SHA512
102faf219f0ac26c451af0ab9bf13f5165a9c70c248a5018a0d868ab2e30080d4f79f1c975bfdc716434ef0a53cfc8e5d821950233c7ddbf92c1e4ab466dde14

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\dfclhednkemcllkenmhfhnboppipmggk\sqlite.js

Filesize
1KB

MD5
44aa2f1757980f94db00bc0292742639

SHA1
176522bcfc5f739d7229be4cd546d6424261ddf4

SHA256
bfb0bca4c34a0980ffff653033dcafee22affa43f805e2d51f707c13dbb6fe38

SHA512
9c2ebca202c7a10148a7ea4b43a5c8ca2ccc2582384669385187bdfbbcca1c1d3a08b87091fc64b488772e6660523baaae156a5ed3edb12ffb6e5e7a8d66f0c7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS9F2C.tmp\settings.ini

Filesize
7KB

MD5
71ac3d62417081c39f1c5d0c1e2cb215

SHA1
12a5d74b6d7caaea3e6e676fa5e8e8068245c9ee

SHA256
fef6292ed9de25dd66d72a9d26f235775518777fd9b29547ba2176b93a71e516

SHA512
6ae3c9ca16bbd3d4622a647aca06e52650a8b4de748dabdf8faea946339c89833412be77a2525d01ba4d074621c941c0f72866229647a8b0264a4bfaab9289f3

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads