74b774a000d99a14b212f1c0fef2591bda0f675e019fd0117be2cac6ba3f84fd

Analysis

max time kernel
140s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2024, 06:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe
Size

552KB
MD5

46361ae8d305d023e2cf1acb3a976612
SHA1

955abd915fdcf20433d519a60c9ffd6021fa6a3e
SHA256

74b774a000d99a14b212f1c0fef2591bda0f675e019fd0117be2cac6ba3f84fd
SHA512

0502eb2c06ba62cc4616253b7ac6110611219bbfc8367447680e19b46c785b7370a016282d2037af19fbd2b5e3beec4d9ecc3a9bedc54e7e565ce61cbbc7a795
SSDEEP

12288:h1OgLdaOrWctn+MEfOUgbJuMmFcouJqk7k:h1OYdaOrtMOUgJHJJqkw

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\International\Geo\Nation	46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe

Loads dropped DLL 2 IoCs

pid	Process
2892	regsvr32.exe
2892	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fbkkghjmmimhjhagclkkplpfhghmkncc\5.10\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\ = "savieinSharee"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\NoExplorer = "1"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\InprocServer32\ = "C:\\ProgramData\\savieinSharee\\8hty4rRGC.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\VersionIndependentProgID\ = "saavenshaare"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare.5.10\ = "savieinSharee"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare\ = "savieinSharee"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\savieinSharee"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare.5.10\CLSID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\ProgID\ = "saavenshaare.5.10"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare\CurVer\ = "saavenshaare.5.10"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare.5.10\CLSID\ = "{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\savieinSharee\\8hty4rRGC.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare.5.10	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saavenshaare.saavenshaare\CLSID\ = "{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6AC7016F-06C6-9371-A4DE-CB3EB44D5300}\ = "savieinSharee"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 2892	2836	46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe	85
PID 2836 wrote to memory of 2892	2836	46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe	85
PID 2836 wrote to memory of 2892	2836	46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\46361ae8d305d023e2cf1acb3a976612_JaffaCakes118.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" fTvwTCE6w.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2892

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\8hty4rRGC.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\8hty4rRGC.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
7KB

MD5
3bbe48e28a2fde17624fc2029d2e4fd1

SHA1
44bd385992e3cd5c410103f4f03a3795bce5399d

SHA256
818a9acf8a322efdb2ddbfbe379f412979c37dfbba2a94974285aa38f10964c5

SHA512
a42acfc95a3d491bbe4adaf30e750af8f859e69fdbbb8e0442199b9bb1cd42fe0aeee80badf1c31f8ae2819588924bb899bbe689f0fd6c732768c282ef61ce53

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fTvwTCE6w.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\background.html

Filesize
147B

MD5
cb63c67e7726309b6b62653a48ce231a

SHA1
0ad97cde7445ce89804cec1980f60a3c8f477c92

SHA256
332fb0d28b235bb8b7572bd6fd3fd406e59ca4c49b5cf67453aa50720589e0c7

SHA512
b78ff0e510f0ce27cb739e526d199f3e9e5206a7d23f2d7eeb254ccb6d1acff9f57d0ab4d085362653a3aed2e59d5e3b858fdb7315c215a1fb0838a45c89ddfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\hGtsImoB4f.js

Filesize
5KB

MD5
d8c1a304db5fc2ddfa511e0ff81220ce

SHA1
0497c1e90156c42723f23c2e0e058556f3509b8b

SHA256
60c368043d78d0681df79dedea02b1e70274e88f5bf579ad3527a4cb2b952988

SHA512
90ef0cf3f23af74cc07543d570452f8f561121d679f94d1f833325b80fc40a76e7e6f8ac44cec85f13297d0506651c6f48b5504cc38655a69cdb78c2504a3e5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\manifest.json

Filesize
507B

MD5
2c0c0d12b93efb0711761f0c1fac8a9e

SHA1
490188b01487f1ccc2e59bd0f9823355b4acf34e

SHA256
990ac8a6796412f8b1792a100539b6bafcf953faf5753cde0dfadef8d4bac7ef

SHA512
f0720fcf5539889f249ffd6a4b8ae479dbeeecf89120d592cdb0166ead6c99eec1e15f59c2de3256d578ce822217999f6bf2b2a7d6f3d062ed5ed897578ad0e1

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\fbkkghjmmimhjhagclkkplpfhghmkncc\sqlite.js

Filesize
1KB

MD5
9c07c2d14ab2bf3d07a8093de959504f

SHA1
8d3c7561088952bca915bffc38ae35e52343d876

SHA256
f00f343043c62254d583942edc36d2e14142fadfb27c7234229baa66246bd11a

SHA512
963eba5389324e809d9fe65c81dffe277f224ba336dab2c5645d8d4d284fc8152a7c69e32ef680fee86212c78f1f8e63d862a9244b41796cdb667257ea4173f2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\settings.ini

Filesize
7KB

MD5
f27a420395c715e12c47de750d6d751f

SHA1
7359e9575836897981bd6a9aa7e229a4949e429c

SHA256
58300aea8ff53e0a212aba49144ba1bf18cee4b7e9ba4e3740e8cf33f550aa8f

SHA512
92a82821ec66ca5d481fd1649a6277f917fc4e6d0067bb695ecb31628ff4b0662663fa1618094a8cd277fa424043f8160ecfbb9f7bc9385013788562039ffa39

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
1ffe6ddfbc909cc3b7d94b2be9c634fc

SHA1
9f8846840e3275b8fc85ed020daa9e0012844563

SHA256
0fad6bce67d33d5a43cfbc718d6bda9a3667f0ae87b308ff070fad00b680f954

SHA512
32b37d18b56174be2ee0c098a70819d8e53e8ded7be9d34bb4bf78650e90ab13ae148f88f2be12571cf7d5d491349bed1e9f0e32ab5a1eb45b3bb00b028d2c0e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\[email protected]\chrome.manifest

Filesize
112B

MD5
61c842116b794f751340dc8a0efb4c7b

SHA1
20c60c63f13442fb9ba71c853b565cda9ac7a6e6

SHA256
cf599b6719a5fd2483207aa7417bd08c2d7f70daeb23d0eff0c79c0526cdf249

SHA512
5f3a1297ea72f92cf098463724ec2283f6bb4d2a6c299f76279e3df0750c9ef4435825dacfedad54bd40726b30c3d8b67c4c2deeb26b83bd08b3266684832bd9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
fdc012bffcb3e3fae889da88a609afbb

SHA1
86f0c159180fcd7adc31ba3aa171f915b810033a

SHA256
25a93cbc2890de7e0dc107d685644a6fd0835475a774b3021372133dfaf7568f

SHA512
b6d1b37556fdeb99b697d5b9473b01cd9a4b7afcf54a6b54cebeaaba556bd8f1d97948c349d345a09e142fb290a58e45003ea8ec037b7a3721bf0050d95cc40c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8ADB.tmp\[email protected]\install.rdf

Filesize
607B

MD5
aaa00b6865312a6b945c4110a73427d0

SHA1
43727acff3c8c413e27cee1355cadaf35141878b

SHA256
36e6f4b65c043923de628f6644f06ad66da6b1ad88f6f574fe725a152aa50b86

SHA512
e03fa8510cb922f26fcc79c2d71c7cf8f2c7472e255cea4eede3c0f3d4202df6f8e7ca84494b3d622026886d1545b12db87d4f6f4235e315578ba1adbee08fd9

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads