0e037fbd4995eb66f430410734257f016b069a9dff4cdbaf5bb8632dae881182

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15-10-2024 06:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe
Size

1.0MB
MD5

463ea00aecda40e767147a75f7f7a804
SHA1

605ecb5513ea086a6a5cf49e5873e79da641f6a1
SHA256

0e037fbd4995eb66f430410734257f016b069a9dff4cdbaf5bb8632dae881182
SHA512

0171249841e9d355b4924c6f8ac5bce789fa8ac80052e1b75824087a715d959a09dcb7a702d36b133f2614f6da18b11241b2003b14000fc0a93ebdc8b726da36
SSDEEP

24576:PLio6lwFw9Z1+/VO9lu8o06s+BL6pGa+3WjxPY6RMI3Aq:PLxIDFT2xDL6Ma+GRrT

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3008	9c1VtD4B.exe

Loads dropped DLL 1 IoCs

pid	Process
3008	9c1VtD4B.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jdmaoccfabojldjgockhdhimgpfmcenj\1.6\manifest.json	9c1VtD4B.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89978012-D1F9-F662-F1D5-CE57567B93C3}\ = "DOwwnlOiad. keeper"	9c1VtD4B.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89978012-D1F9-F662-F1D5-CE57567B93C3}\NoExplorer = "1"	9c1VtD4B.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9c1VtD4B.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	9c1VtD4B.exe
Key created	\REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	9c1VtD4B.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\ = "DOwwnlOiad. keeper"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\ProgID	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR.DowwnLOaad	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR.1.6	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\VersionIndependentProgID	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR\CLSID\ = "{89978012-D1F9-F662-F1D5-CE57567B93C3}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\VersionIndependentProgID\ = "DowwnLOaad keeepeaR"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR\CLSID	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\InprocServer32	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR\CurVer	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR\CurVer\ = "DowwnLOaad keeepeaR.1.6"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\DOwwnlOiad. keeper\\zDogRbY.tlb"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\DOwwnlOiad. keeper\\zDogRbY.dll"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\Programmable	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\DOwwnlOiad. keeper"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR\ = "DOwwnlOiad. keeper"	9c1VtD4B.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\VersionIndependentProgID	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\ProgID\ = "DowwnLOaad keeepeaR.1.6"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\InprocServer32\ = "C:\\ProgramData\\DOwwnlOiad. keeper\\zDogRbY.dll"	9c1VtD4B.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\InprocServer32	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR.1.6\ = "DOwwnlOiad. keeper"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keeepeaR.1.6\CLSID\ = "{89978012-D1F9-F662-F1D5-CE57567B93C3}"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\Implemented Categories	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DowwnLOaad	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	9c1VtD4B.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\ProgID	9c1VtD4B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	9c1VtD4B.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3}\InprocServer32\ThreadingModel = "Apartment"	9c1VtD4B.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3912 wrote to memory of 3008	3912	463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe	86
PID 3912 wrote to memory of 3008	3912	463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe	86
PID 3912 wrote to memory of 3008	3912	463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{89978012-D1F9-F662-F1D5-CE57567B93C3} = "1"	9c1VtD4B.exe

C:\Users\Admin\AppData\Local\Temp\463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\463ea00aecda40e767147a75f7f7a804_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3912
- C:\Users\Admin\AppData\Local\Temp\00294823\9c1VtD4B.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/9c1VtD4B.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:3008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\00294823\9c1VtD4B.dat

Filesize
3KB

MD5
19aa27ee22f5a349abb1c782146655c9

SHA1
ac492738cc6c83ac45a2ad67fe3654da89e4f9a5

SHA256
a358497c2374e92d82a383e61199cebe2dbdd040d1a3fcf6812ca19747635774

SHA512
cc150f7412e2e8a3982ff28c46ec445ca08aec97f0563e004adb525249a2d00c7b0c14c9214ec8fc0fdc708c07aac94a53af15fc581bb9d468363854ba4240c8

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\9c1VtD4B.exe

Filesize
334KB

MD5
8300c91b40229b42301aebc6d8859907

SHA1
0b55e56a6add6b4dd4ceff475a0018a203d02a5a

SHA256
f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5

SHA512
0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\BocxPmtt.js

Filesize
5KB

MD5
6c685815b07edec59023b0f57dddc78f

SHA1
4d39c4574ef5e57432944d4e14c7f1a6f1aa04f5

SHA256
756756bdd20a0875a2cae25a038685e8bfd770c27f73d306f58f1cbf2b579f37

SHA512
7e3ac90222348cfa6f7f3b74f07b0099c9a58bbf798f8764a1164aae751601068d8915a2669f4918ae3f4b2e388fd513f055cd85e431bdd812c95c2e1404518f

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\background.html

Filesize
145B

MD5
f9e5aa51eb8ab57fbe028400099c9cb3

SHA1
aff62267f0044761edeb5da73c4bb4c310538f17

SHA256
b3dca3ad18962099e88c2d952fe4c0f21deaa252f1572505a8ec7396b92ced10

SHA512
7004cbdb7e1395b8eee53fb7edd1a09ddf418952e8a2e496f26fc4f044f5ad06a3dc942c0a576884ef7779fab9aada2f2de44550ada8dcb7a44103c3fea82116

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\manifest.json

Filesize
510B

MD5
c6cc05b0a1c66b0a5842c5aaed1ab513

SHA1
811c5a77836c2d67d2609f247d88c9b28d07335d

SHA256
d0cb3660002004d8de5ab262329c9497408f0cb5e5361c48433b0566f0807375

SHA512
dee402f84354901ac7d855c66114eb53a1bc005c808ca7091e59d35c333a42ad82b5c5fc47846e7a73c69b0e35249624c9b0e651f6a876ef7050853d362ad0d1

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\jdmaoccfabojldjgockhdhimgpfmcenj\sqlite.js

Filesize
1KB

MD5
17404586eda18a94a8f48d2831434afa

SHA1
325c203155f3814a30a93ec28809544e369e062c

SHA256
3923ad5babc7cde1bb7ff5bce35d720311506c581486742a49fb02294e6b217d

SHA512
380a37c33e46f68965f100ca20ca101cc551590f192b089676d8397658b532ee2858a7ad0cbe010908a117c5588dbc2635d1727c310f92081b8fcd6731c56d6a

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js

Filesize
2KB

MD5
1b53c596cfb1aa2209446ff64c17dabd

SHA1
2542da14728dcdbe1763f1ee39fe9ceae38ad414

SHA256
a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f

SHA512
be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest

Filesize
108B

MD5
277b775a02c9a66d89b59ceca312d24d

SHA1
85fa9cf31fda1c131f30c95fef457929adf537e4

SHA256
a065a0e77fc98044010b7043e7435dd5cbec05197911a0239aa1baf3c5882f80

SHA512
2d657545084a80a51a4d58c47474ebc1af19b74c16a025102e9db9d6e298b6e68058961194299d032ad77b5887a685618f150f959b1f2c5b2cd7b642c1d91949

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js

Filesize
9KB

MD5
988a2bc641f365795f914b8d0002f812

SHA1
67ee1730ed8a99d69a85752a77479309d86c468c

SHA256
6b64417bb3d7976b62d6c65ec7c8e27897b1ebeb8793a84bb711a99bff179b96

SHA512
9db762c73b091f07deefa1094dba2aad4d7c4c109101821814b12280d4a9158f7ed9be5f89ab28e90888e866f0c4503de7b1bd32ffbbd6842a4fe1e4a0ab8b1e

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf

Filesize
616B

MD5
c19ec3b1f693b290e9de4b01c5a87070

SHA1
082b266c61ebeee37d7159685e343938c4b6e886

SHA256
9d896c64b712391197f63d94c60caede9398996b3e926eef8c279beffee77c7d

SHA512
d2645dd8dc201876dddd4abb7094c8cad7c3d944eeb7ea026ee350baba9a463f40533b0c95eb25e529d47577188776e2480020aebe92a8b9928bcff2f23f240d

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\zDogRbY.dll

Filesize
258KB

MD5
e1d10cccd5dde588af8ee2cb7309523c

SHA1
0b9e805077320b0ce1e6620488bd34f1c4d7827e

SHA256
9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a

SHA512
a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\zDogRbY.tlb

Filesize
2KB

MD5
9156db5f76d48049dbc41fd1b58b3f34

SHA1
5eb1df59f9b5b06ab00137fc9e6451e323d3102c

SHA256
66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc

SHA512
742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149

Download Submit
C:\Users\Admin\AppData\Local\Temp\00294823\zDogRbY.x64.dll

Filesize
319KB

MD5
4f5c722b8686afbea6f09c53171d44ca

SHA1
184c60aafbb12d1023b1ce2aff4d3708607a75a1

SHA256
870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea

SHA512
e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads