97b06fa040c8c5e197c0d791db8082ab2267dfc5f5a164497bafedf9dd66b08f

Analysis

max time kernel
119s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
10-10-2024 13:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe
Size

551KB
MD5

3017f6f7ec92ba040ccbd671b440b4ed
SHA1

2ecf935bf0b791895e53b0227acba07e3e320d3c
SHA256

97b06fa040c8c5e197c0d791db8082ab2267dfc5f5a164497bafedf9dd66b08f
SHA512

4874781aa71049a7f72a50fbba8d0c14fed45c6bbdc2494390529d4a7b5b3dcc7e26756c66b46f734bff8bcd99e93a7e861cfb9f6df05d2fb8a13478e6889dd2
SSDEEP

12288:h1OgLdaO/gbJuMmFcouJqkXWctn+MEfOC:h1OYdaO/gJHJJqkXtMOC

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2160	regsvr32.exe
2160	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\amdggpmbeenmpkoljjabopoaladldbnp\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\ = "SaaVensshare"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare\ = "SaaVensshare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare\CurVer\ = "seavenshare.5.10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare.5.10\ = "SaaVensshare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare.5.10	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\InprocServer32\ = "C:\\ProgramData\\SaaVensshare\\TPU.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare\CLSID\ = "{EF29BF38-7786-0FE0-80EA-D8067D28AA41}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare.5.10\CLSID\ = "{EF29BF38-7786-0FE0-80EA-D8067D28AA41}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\ProgID\ = "seavenshare.5.10"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SaaVensshare\\TPU.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SaaVensshare"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\ = "SaaVensshare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\seavenshare.seavenshare.5.10\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EF29BF38-7786-0FE0-80EA-D8067D28AA41}\VersionIndependentProgID\ = "seavenshare"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30
PID 2420 wrote to memory of 2160	2420	3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe	30

C:\Users\Admin\AppData\Local\Temp\3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3017f6f7ec92ba040ccbd671b440b4ed_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" ojR.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2160

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
61a4fe069a42ef4a52be222cf637abe2

SHA1
f902614a49e853e981893a39fca83196d9d161f4

SHA256
9c3e3a9fad61bb8ee24f14490d9f2bd735e69f571f0e7540522cc6e7ebabaa14

SHA512
1fd79742fee68370b4ffe0f58bbd06df31e027c29ca06f856acd199988b54a43679b708dcc9fdc7d2b86bebec2d72b63564d4652cbeefc5163d91f94d1a494aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\TPU.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\TPU.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\background.html

Filesize
141B

MD5
a7431ed74ebd3c6913bdd9733b3dd3d0

SHA1
17212f5e354f61392acd2e2890cdd971d81618f5

SHA256
fb52074595cd84fe2bf7938cc20d55beb4969917b007bc97c4d70505be829fa0

SHA512
9d78344b917d613d85f17a453c71af868641cc74d78e4afd60a1ad8d39d632baec333c6987b094cd15ccbe743615be5c60c0db86665ff083d599d4b9f4ce9067

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\manifest.json

Filesize
506B

MD5
d420cc2f82ba8cc3177fa7bd71065e85

SHA1
52186c15029093524413eae067198b12dacecc32

SHA256
69beb6055bdaf0de66b79c4a4d899a14eda379afd07373c47c28e16ac2d2bab5

SHA512
e131ea62df7b1adc10d2c4890dd11e6abb281415b3292ef3575548a53f0470dfad249d990805efdb3e4a25700104778be7043bb0a9d00166ab82e65a6e3764a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\rIfH.js

Filesize
5KB

MD5
ee1a9ee39d7a1750f199ac16ac36d1e9

SHA1
a27981387bff14fdc2d9ccb9996421b6aad95408

SHA256
88f310e6d306d352298cf22b6cf882ffcbf84a187d51b293d103e13a61142d5b

SHA512
cf31f5faec57df4de68968efbdeeb32617275fac1aa304ccb13df91718e3fb600ae383bfe80bf558ac598ff077e5ffb7d82ed33dca0e086ab946034f92893691

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\amdggpmbeenmpkoljjabopoaladldbnp\sqlite.js

Filesize
1KB

MD5
c47bf8bb8ed0681cf1a6fd00ee7a26de

SHA1
23af41f5f5a6cf66eb35795e23fd3be976904677

SHA256
e2202edc03f29b8837047a4ff03bfee9b93dbc53f797a81f6405d053617f3166

SHA512
81cde47c6fe253502a59184dfc378863a6245aa86e4735b833937e1faf12a763176f8e44c976287e217a12156e010682140f1403641c58cc2f73e3f937ff2a15

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\ojR.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\settings.ini

Filesize
7KB

MD5
58cd85fc0c6b58e198bd968aa9e7b3ec

SHA1
27c748463f410aae0b5a6e4df78b6bf2def04035

SHA256
70b1015d1b9eb99a2b02a0221e3b99404b4bcf557d16d08939df411155ffbcb2

SHA512
fa8b6017d63d8655f25b691fec410bd9592c00afa94c777ace13047bdc994d6bacf321a8cd2fc9eeb72134456a8e0aa5d62fa6fa9d8ab7d159a11954000528ec

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
004e74195a5b38ab239f1f1485b4c29b

SHA1
bcfbb67891340e4b1cb10b843c9921ce8beff74c

SHA256
b1d3a1b118a94b857127139143ef7983a4fd3725f48772ffd7f9b2856cfae052

SHA512
bafdfa1ee74106d76446ab7ed094c6dca92924842e32c76b45fa57d0f59e36f0b196b54222e8224662e72e42999e077b38af716ec8be38bef71efed69d4650ed

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\[email protected]\chrome.manifest

Filesize
100B

MD5
a6f0185e533744cfd15a1adb31a90466

SHA1
7421c9a1131c91d3c1dce5392deb35e733002517

SHA256
85f9ed39bd771fd326efba047a94a47fddc133b7057c17848a16c2f529c3a3a2

SHA512
de9916841b739974ceca329bc982374827c0cf36f1afbfa878805947939ea0d70610813d7a5a9d0de80da93f681bd71758360b9cb0527f2f80703eb2c57032fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
eae5df6ff10b804be339ab394e0fab8f

SHA1
6192b0c8ee440e22de0ef9e5ec52b22455b34cf0

SHA256
d7414356f8fe64f1f2451c6163d0e613fcce31c83a5c89eb4f3ab391c7e51185

SHA512
3330a111aaaf1c38935a36bd32d911dbd04021e218fb0c2110afcae9e8b5879230551a84b19f33180ea958f4daefec580c5e6c3a30e62621d466f71a22330223

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA7F3.tmp\[email protected]\install.rdf

Filesize
607B

MD5
28bb633be6adacfa5ecd2cad5aec15d9

SHA1
990e0ca3a3123d2b47044ea1ff95cec67268f138

SHA256
3194d1bfbdb71611d1a264084c647e08d08ee3178fd2416d14156c62567c6bae

SHA512
bfd471f70daf22fd6c682427ce380c21c229f9e98677ffa79195ee0817303ee70ddd192a5f2f30bc4ff22bf0d45ea39960b96179e26f1d3d11fe446e1c1b2874

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads