23cc69a96e7e52ca4f64fb195aa55fbee1709d2532fcc6422e31a20c48625b98

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe
Size

551KB
MD5

405e6b28eecde8d18998b9426313876b
SHA1

58f032717f9f399a1a9135c48b6a8bcff7ac0a66
SHA256

23cc69a96e7e52ca4f64fb195aa55fbee1709d2532fcc6422e31a20c48625b98
SHA512

49e3f4fc0a21b364fae465ec934716064b1d259bb1232e7fce330ef446f4cfcb07c1563bf583391acf86a49d3cd2b1f4f9276df68a945b60e84558d923b2ff20
SSDEEP

12288:h1OgLdaOkWctn+MEfOUgbJuMmFcouJqkv:h1OYdaOktMOUgJHJJqkv

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
1404	regsvr32.exe
1404	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pocgbijifbgaaooahglbmecpjabhoadd\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{010F9AC0-8CEB-670F-6A88-63846A70465C}\ = "safue Saave"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{010F9AC0-8CEB-670F-6A88-63846A70465C}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe.1.5\CLSID\ = "{010F9AC0-8CEB-670F-6A88-63846A70465C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\ProgID\ = "saffe saVVe.1.5"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe\ = "safue Saave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\safue Saave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe.1.5\ = "safue Saave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe.1.5	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saffe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe.1.5\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\VersionIndependentProgID\ = "saffe saVVe"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\safue Saave\\LO_pV.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe\CLSID\ = "{010F9AC0-8CEB-670F-6A88-63846A70465C}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\ = "safue Saave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe\CurVer\ = "saffe saVVe.1.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saVVe.saffe	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\InprocServer32\ = "C:\\ProgramData\\safue Saave\\LO_pV.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{010F9AC0-8CEB-670F-6A88-63846A70465C}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 1404	1032	405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe	85
PID 1032 wrote to memory of 1404	1032	405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe	85
PID 1032 wrote to memory of 1404	1032	405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\405e6b28eecde8d18998b9426313876b_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" v6DdW.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:1404

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\LO_pV.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\LO_pV.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
1376afbf5521d2cf2e2c9da791143c27

SHA1
7f74131380b38da51a23447d8287c81fbe575c36

SHA256
bd9d43806785d654a2dfc143940794704d004e038e4e728a4d3291fd395c1ff6

SHA512
6f8a96d22f53fa2b4db26b9897e062c8586445a8bfda23588fddd6d80688ce32b531be6e3d5ef78878fd0c7baaeeec90f1dc8d7400b3f18edee1b308851af202

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
9a79d723c246d859521ff351f8c36c04

SHA1
4424a5a66baba41695cdb6a756c09155344578f0

SHA256
a9abb554a9a70888ab468509bdd74b32180bbd25834c971912cd3d5eb418ca66

SHA512
27c275dbf5bbfbd01e9ecf0bf71bbfad6cee59fe2a46fe9d83fce39a05e0ae34e32b38bdc1b9be63164ff29f9a1d1551bb12817c724f16d96e3410c2a99f503d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\[email protected]\chrome.manifest

Filesize
104B

MD5
22f4a38b412356c7ca426f1aba3fd0fe

SHA1
944e82d69695fa7545ac784839b016844bafcc6b

SHA256
691d050837b73b5fc74ab2a2a636cb8299400587652882b781e62ab82904d592

SHA512
f89bfc5f42447cb93262544e998d6dbb06f984b409b4e1f78a1fab7211a9e3b7e88cf1c15956a47db131e3a207ed7db48e5d426037241ef71931dd781b29feae

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
e9fd5bafbeab3f819203df7da4ebe5b7

SHA1
2dbaa0e7a6a120c5b3b3bd3a84546c4ba10db6ae

SHA256
63d2c2360cd1e3fc34fcf54acf19802f5733d892da9d39e451db65a861c0561d

SHA512
9c8e9a011115cb4ff542969602f27714f71293524e83fd33e4ef8586ff8a229cd8ae54650911636ac6b0ab6afec2d46a50fbc1d4323f78bfdcb2f82c502cecaa

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\[email protected]\install.rdf

Filesize
604B

MD5
77aaf8e4f1dfc1f51bfa5e7360009230

SHA1
ab9010571b023f5b90fdd8942b1da0c09881aba2

SHA256
ac29229301085dac243e40106d638041ac6f49b041d9888d652808b7bc5fa2a0

SHA512
40b6ca0d5c3e5071b05125f4ffbb65a3e4ab6218e88ce333fb3d43d0bf7b7178ece8e971a00ca5026e692c8662b0cb890486f3a4b0df3e22c66faa0f09d47d68

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\72aelM.js

Filesize
5KB

MD5
eb051076f23d4e45c487f9b724cd798f

SHA1
95faec288ba95a4c9208f42696c65961082f87f4

SHA256
6567bd86c3844505fb482559e2136f671a1ab0dcd58bca8aaf1ce20bcb519dbf

SHA512
d8d22e7a6936af9f133d83d502c4acf06a3abaeb0baef9fc08d8ffd3c9b1e0d996d407ddddde81ec054b316abdb1d8876157dcaa9850116f2cfe4087478b6648

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\background.html

Filesize
143B

MD5
e5e894f9150cee5f6611c08dc3730e3e

SHA1
b881a5a4b8101bb9f38083c29dc9f3192f87bd08

SHA256
28aa6602ecd7c6502c643ee21c4606111a003f979f605d355bf80dc3f6daeb1b

SHA512
6e297f52ca9c8b8b6228737f2fadb6f16df946439f011dd794ad5c3a4b5ff48e30f14d18de038ffe9170f2449b8553148a1498d9e7a0f06520f1322707d58ec1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\manifest.json

Filesize
503B

MD5
65f15cf5b648a5efb86d725b579531bf

SHA1
7d999d2d3ecba3d7c6dea8f30ec99e4cab9f9fc8

SHA256
d876d56c0fa61838e8e8fd9fadcb6c3ca3595380067dbdf803a0cdcbf70e7943

SHA512
130ae0c53115965a54ed032abf66ea3886daec2d4be2eb96a98e8eea32d6a8f1def98fe585a83342992b50f964255983383438689ea8f5ccbfcea02528c4c49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\pocgbijifbgaaooahglbmecpjabhoadd\sqlite.js

Filesize
1KB

MD5
3239873c914ea9065641c1e0c9ef8961

SHA1
7b8efcb2d9577e2057a3d08a20a6d1e2d7470c77

SHA256
5d1ed65c3a95e06740f25aed6d7eb6154107bfb80de7aa4baf0511ac4d0d5237

SHA512
9106f7e17c567dfc37ed4353df462f996afc4fd612215f75a4483d8fb575195a0bc39b2a3058db450c69b9aa23150e3d4148577f31e4eecde2bb0b28f63b32a0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\settings.ini

Filesize
7KB

MD5
f89d88a1c77aa972db1b3321d1e829b9

SHA1
8cd3a697bffe1110846e28d56c826f5f28df99d8

SHA256
17a874b56b0ff8f4e9bc239e571a2d61ab8c65d3c085c26e5b9d4cfd651576ba

SHA512
bd7f9696e00b7d42b1bef817c977aa2865bab17d75f5c25b7a7f7a35d4ff8c33101bfb350a533b2152bc41cabfa7526d8961a6101c34533972d77a1362ce3f4a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS91A1.tmp\v6DdW.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads