85dabe35139763fa802df703aff3330e51aa1048033033bb5fec2d11bf60dd3b

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
14/10/2024, 12:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe
Size

725KB
MD5

4262cb0549d3babbd2b91ae753c52238
SHA1

4cf36913c0073f24fa6722f0abd84058a33f1a65
SHA256

85dabe35139763fa802df703aff3330e51aa1048033033bb5fec2d11bf60dd3b
SHA512

a7394cb5132a5ac65a2d713cdcace5cb43ab78db6f564fd7cbf1a85bbacab8aad017f125a83d2686e977a7833c05421d4e0dfb25f81ad36af3b6bbae8b53eea8
SSDEEP

12288:h1OgLdaOFo99/rsFEt5hDG0SAMs9jR/jeRJKu9TJdwYGZtyjTje5jOSpJw:h1OYdaOFOBsFEt5hDG0SAMs9jR/jaJnD

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2848	eg4.exe

Loads dropped DLL 2 IoCs

pid	Process
2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe
2848	eg4.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ajpipnlbiffkpoddkmedbpgjmnoiacij\5.10\manifest.json	eg4.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\ = "savenshhaurrE,"	eg4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\NoExplorer = "1"	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eg4.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	eg4.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	eg4.exe

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo\CurVer\ = "saavensharEo.5.10"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo\CurVer	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\VersionIndependentProgID	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo\ = "savenshhaurrE,"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\savenshhaurrE,\\sO.tlb"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo\CLSID\ = "{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\ProgID	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo.5.10\CLSID	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo.5.10\CLSID\ = "{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}"	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\VersionIndependentProgID	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\InprocServer32\ThreadingModel = "Apartment"	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\ProgID	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\InprocServer32	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\InprocServer32	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\savenshhaurrE,"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\ProgID\ = "saavensharEo.5.10"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\Programmable	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\Programmable	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo.5.10	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\ = "savenshhaurrE,"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\InprocServer32\ = "C:\\ProgramData\\savenshhaurrE,\\sO.dll"	eg4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo.5.10\ = "savenshhaurrE,"	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236}\VersionIndependentProgID\ = "saavensharEo"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavensharEo.saavensharEo\CLSID	eg4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	eg4.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2848	2792	4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe	28

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	eg4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C119DEDE-FD0C-24F0-ED84-7A3E6206C236} = "1"	eg4.exe

C:\Users\Admin\AppData\Local\Temp\4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\4262cb0549d3babbd2b91ae753c52238_JaffaCakes118.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\eg4.exe
  .\eg4.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\14108781433902581987.log

Filesize
3KB

MD5
ea2e3ff3f7e90b2880d153db34999c60

SHA1
1a16a818f37c979e7cd4149fb03b80b0397e0b74

SHA256
8c794f3b7707024f0c98d87b91f68438fd41921d04abd2f21c518d67842062e2

SHA512
10dacc5cda2d2b1b93d0ada419494253885c179a1b93816b99c6d92ad2355fb6cec2cdc3975545891ba9cdd3ea823367f1fe4372a0ce367b89c207908031d2c4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\Ii7.js

Filesize
5KB

MD5
5d2c949f504e61c5dbdf6858bec726df

SHA1
78439264d7eebc3ec2ccf224403021472ae028f7

SHA256
0dda652820372fab9c79f7d3c200cb90101376cef7c7e9089d67b753fa6bb816

SHA512
bc173d86f4952f1b2ddbe0d7eaf0d5e5b0a53d1fcf970148e480b6b816660ac2f65738ec4ecf099aa4a0917ec216d2899902215364505b8fafe6ae60b72c4ae3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\background.html

Filesize
140B

MD5
662a48e38594fb5e4c8b3af10950f1fc

SHA1
b9b3ef0aeccccbb489d46dc757b05882717f7c95

SHA256
b5d55547b255838e50f4c9c71bab1f1134c9301b8cf7899e83cf97d8e8c2dcc0

SHA512
0b4d27ff5f72b34cd3e90d421ab9c680a9fdcc0ff5355b0abc562ab4ec422b601460c4c0b65b433f28715a16055ca6260657749e51a92a5718a81a9b8e588e95

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\manifest.json

Filesize
508B

MD5
177f9174cbfa3d42e790a58938ceb900

SHA1
857e8602eaed85d27734b34e701e09df46a13de8

SHA256
64f5b789ec2dd04e31a2ca7d6f3247e77c0a453cf51f1b9da3bef41d5b60712b

SHA512
ee0ce4ce3f6842250132f4fff56b0adb49d7035ea45e6b393d7ce49aa60339dde32727073a1c386a4b7a1a257ee2d557a65a5bc3edd684f09e50afeb69b6dbc1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\ajpipnlbiffkpoddkmedbpgjmnoiacij\sqlite.js

Filesize
1KB

MD5
c2dec1c81b6b51f5b5554f4b4f629fbe

SHA1
29ea262c1a01f3e20d86c4284e8ba5162bba3121

SHA256
76a04b9558bf523e10a746ff2c13ecc8b991a40393fa969fdca9874eb78e4dd1

SHA512
e87ef78cda2afd979183af2edb4ac94d018a24398898233e0718f59adc26d16d0ba94c571f8c55c50651ae1df7a0b6df62d9ca1dc828c8d96e9ad43e49034c8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\eg4.dat

Filesize
7KB

MD5
1bc0fb9472e2bf16527f07bc5929ba93

SHA1
ea4b4eb2f48bdcc2c3af8c767972a4e9567b28e8

SHA256
8ef84dbc7d5a092eb7618f585660ce00f2b7d9f9a5dbe26c2da80f6127f1f4d2

SHA512
47b617e1b76f0f7808aa067d0f61a0bf70e53c0b093162990a748140d318884797633ee45d6e167598ff3df8dde673f2594a593eb1524fc8923771753f421c26

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\sO.dll

Filesize
222KB

MD5
e9b27306a18f18b88945cdf066de2fc9

SHA1
4d18490fbb336e261301a967047065dd561cc2f2

SHA256
a9880b90d24af3786886306aefe5c79ff3cb2fb7b36ee5fb7bf2af85f240d63c

SHA512
f255e8bfb13cfa070b31f47b12a4aacf9ab75a6a8191b6b83740d02c3f007b6d5255a5c2c12bc7b599996742973d2faccb5463d96d16c7aba40e34776823c706

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\sO.tlb

Filesize
2KB

MD5
39d776f73d1d3f771aaa8c3561367c3a

SHA1
eef842aa02927bd7fbe7d569c5446ef1a2ea065f

SHA256
c2156787eeb818e587529572599fa124773c71330fb93e1c79f4cb9141090941

SHA512
3174095accbf422730e60f61523dec01a9a4519cb4642a641c5f547d530ad41f5386d383b90f7daf34f1f36635775929e99d7fe0030aa24cee30f4de8376eeb3

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\[email protected]\chrome.manifest

Filesize
98B

MD5
d6fe50c66a625ba1cc2d86111b4a6001

SHA1
aad85adec105d70f30e770273d8e93d8b1e8022c

SHA256
5a675918601be0772a7e197eb6e01989f139ad8260b31e05992e8f14a99bb451

SHA512
02200cde75a8f2c01f0d5b8b11c64066f027ac51cac0986368c4b70b19a4ffb7bb0f313649e58b008e62c7df7115a969aa67aed21fa8b2e66f7cde112ec8911c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
046c750e4a8fa5dd83fc743d6e34d866

SHA1
a9e3e7fd238defe5b682fac7ceafcac9a0e4401e

SHA256
8491349d661d0bbdd70259b28b007c6d469bfb6e751630bd884a07ab83796448

SHA512
9724bd022bb92171e25379fcec4106548c31ce959f8d6e13736dbb3522b7d219a052476e051ec5cfe0bbd0c9a6b857245812d957c8a1d22e794025452407d26a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5532.tmp\[email protected]\install.rdf

Filesize
615B

MD5
a6ac0764bb6b80e9160b0854b88b0420

SHA1
e87f7f1e71c46f92512f6b9ba8dd30a655561220

SHA256
872dd307561b657d335d7517fc1ceea5842f27dab8bd2ad4b38cc882b0635ae5

SHA512
a03837213840016f68cd56461140941be7cd4350410f605ccfb86ed06e1c07d54ce39f05d487e923fb12765887de9141f0e4771b8959a7ceda2685b6be906486

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5532.tmp\eg4.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads