2b997ca096f39d8c5c769f1b54308dda7250422e4f8d073bf9fe770f215ac17d

Analysis

max time kernel
93s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 06:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe
Size

1.1MB
MD5

3e47272d629a8fd32dc73a5b1917a3b0
SHA1

4b323750a6b62b79ce457f4e14677eb2b6245b3c
SHA256

2b997ca096f39d8c5c769f1b54308dda7250422e4f8d073bf9fe770f215ac17d
SHA512

5a4e6693e8211c6c42ea6bfa2685af9a4d0196ec71281c7781f44740f91ec75e902d1488ae96b143987580b0621239c65d4d7a5d111d8a64ef313851d459d6e9
SSDEEP

24576:6xllVmuE1S6FZnFsVpd11G9MzL0K07acas9vE4AYn5:6xJ+1BFZ2Vpd11GqzZMasxMYn5

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4068	aA59TUXs.exe

Loads dropped DLL 1 IoCs

pid	Process
4068	aA59TUXs.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cfohiohdebabnhhpchnlomknckcnmeio\1.6\manifest.json	aA59TUXs.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\ = "Download ekeeoper"	aA59TUXs.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\NoExplorer = "1"	aA59TUXs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aA59TUXs.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aA59TUXs.exe
Key created	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aA59TUXs.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Download ekeeoper\\ZD2SBIB.dll"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\InprocServer32	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer.1.6\CLSID\ = "{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\InprocServer32\ = "C:\\ProgramData\\Download ekeeoper\\ZD2SBIB.dll"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\Implemented Categories	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer.Downlloaadd	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	aA59TUXs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\ProgID	aA59TUXs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Downlloaadd	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\ProgID\ = "Downlloaadd KeEPer.1.6"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Download ekeeoper"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer\CLSID\ = "{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer\CurVer\ = "Downlloaadd KeEPer.1.6"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\VersionIndependentProgID\ = "Downlloaadd KeEPer"	aA59TUXs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\VersionIndependentProgID	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\Download ekeeoper\\ZD2SBIB.tlb"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\ = "Download ekeeoper"	aA59TUXs.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\InprocServer32	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\ProgID	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\VersionIndependentProgID	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer.1.6\ = "Download ekeeoper"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer\CurVer	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer.1.6\CLSID	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\Programmable	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer\ = "Download ekeeoper"	aA59TUXs.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\KeEPer\CLSID	aA59TUXs.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3}\InprocServer32\ThreadingModel = "Apartment"	aA59TUXs.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2620 wrote to memory of 4068	2620	3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe	85
PID 2620 wrote to memory of 4068	2620	3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe	85
PID 2620 wrote to memory of 4068	2620	3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe	85

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9BCEF0E4-E229-3A7A-D23B-49FDF8F27EF3} = "1"	aA59TUXs.exe

C:\Users\Admin\AppData\Local\Temp\3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\3e47272d629a8fd32dc73a5b1917a3b0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2620
- C:\Users\Admin\AppData\Local\Temp\00294823\aA59TUXs.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/aA59TUXs.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00294823\ZD2SBIB.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\ZD2SBIB.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\ZD2SBIB.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\aA59TUXs.dat

Filesize
3KB

MD5
8c7a6d00cf9b438419af17c3e610928c

SHA1
e037ee3a65e1792633b6e66b8c0ff0c56821a3d7

SHA256
e4a930245ec8baaa2bdd23ddafdd5c776cf45530bfe92192077e236134f77e96

SHA512
1eb069907230c668a423c454e26e0b24d58cad6d15fd978ce32034ab4edeab0fd8abcea7e6adf5740bb016701088029738f274433d185c874fa7624aea30399a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\aA59TUXs.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\ZEQ0GOcP.js

Filesize
5KB

MD5
6b7e0dad83f568496b24acc98d2c2e6f

SHA1
74da2f67011a9e58a9392fc33c7ffbd54916a0e4

SHA256
55fb2c4383a85caca69d28feba6bbc60e2bbe510a6c0c8521e908931decf83d2

SHA512
6c1c20a6f2affabe6d378d7a922deb465fb0e62a5623a62c0957a187e740035ccd6d826c9dcafb77034c387b21c541c9e4f39373ca090229e288515f7975b01a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\background.html

Filesize
145B

MD5
de5b1b281092cd6f4ef0b18d360b5d8d

SHA1
01cdb11edbeed51fbce2ab973dd4a9b1abc85ac4

SHA256
fdf8cd102cb8424ea356b5b5f7810723006597a39cab0d35037c98462a6eddaf

SHA512
65af042d3b14e61163a7a5707db1a32d129cb9d045ef603ce91de43364b004d6689f1e8ecd1942f56a58d32c132af72cecf3d3a6a520f894ffb47ea713a49d7b

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\manifest.json

Filesize
509B

MD5
eba8307610fcb853f0b1a9a331628930

SHA1
9c0e85f45464b4f43929778c593f27a7085b043f

SHA256
8ae25955cecd242d242d671b2755b073a2a013a5284f6dd70ef1773e6a1b9d11

SHA512
365ae39d4fbada713a45f1fc78e2212e0b4fe1bf8796d1f1decd67f0d702a82d4d1d35b01596037f4346b170603129d90afc67189a1af2ead2e88c524a54402f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\cfohiohdebabnhhpchnlomknckcnmeio\sqlite.js

Filesize
1KB

MD5
21153d7241065bf2f61c9a3928b80052

SHA1
43ab0b35ac346c3db9236b8611f4272a4b11f730

SHA256
d02b8bae8641aecf84fc2cb04eb1e4acb0c25eab0cd6c0ca8574b8c174c416cf

SHA512
06a7b67874e359cff3398a71d849fb3564c46f9087960ddabd50177656986b90979ee894264ec3b23e06f4fb92197c66cbe53b2aeede32059379c4bb2237164f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

Filesize
108B

MD5
d5af00ea5323364fc7e9489d33b90836

SHA1
92dec8e71b4d1f9e1d0c63a16ac92cdd77ae44ea

SHA256
4be2aa26537dba898a930ceecd2addaa85263aa948086a55347bdf883336b2a5

SHA512
18f5080376fde4bbdfe51ebb37264152e9232d97388cdfd8d19e7122cd3dced067e8a361f02d09ba0193b5a43fb65cf525351b6351de482c25d6cc59dae29231

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

Filesize
9KB

MD5
541d93a20bca937cc44851c62b4962e2

SHA1
cdb9c11f4a2d92de3947b41d4355a8b33da4fa0f

SHA256
97afcb1d0e3fa11de27e63f178aae68b7cf1cd8c36405d8cbab2ecaed34f5bab

SHA512
16596d61d9a6cb57898408f45ebe39f5255ca55a00161a21ea6eb24b0d84867e10d9b78e2b3f07e25d8609f930e5a4f2289e8969156024691a4c4f9a45eef093

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

Filesize
617B

MD5
c7fd7b2267c25740ccd1fd7991dcd6a5

SHA1
41155627fc5afb5f823e7ed44411d5f153e45d1c

SHA256
b5dd22dd862779d2314937ced3bfbb98d2648af117dabf6ee930d3d0cf1ed798

SHA512
a4d638446220223c9a538046abe452fd513bd105ec2ad9f02b3f1a5a3297b5b23042cfe250020d082c0022a7ec2f45b35d7ef792f4b6990af02b121f6ea54572

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads