df5c5a07977f0e83613b7007fe944ba6b9f92052896796bbb16618a91dec113d

Analysis

max time kernel
121s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
18-10-2024 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe
Size

551KB
MD5

554ac94960e1d5dde06c7eabceb7c080
SHA1

3fad93b975f7c87beb11ad3d3cef7adbe34662e9
SHA256

df5c5a07977f0e83613b7007fe944ba6b9f92052896796bbb16618a91dec113d
SHA512

d1e6fb1d917c1ef9d5d7f39a862765435756957d09f6dad92dea6e78b814e36f403385794107f4e27c3827b92ecbd8ea1f3a76b8c1a65d58fa4a26ca7d172b21
SSDEEP

12288:h1OgLdaOJWctn+MEfOUgbJuMmFcouJqkO:h1OYdaOJtMOUgJHJJqkO

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2936	regsvr32.exe
2936	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ihbcfeigpicicfddooecilgenhmbebfe\1.3\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\ = "Vauudix"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Vauudix"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\ = "Vauudix"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix\CLSID\ = "{3E070B5B-7816-39D0-959B-2B05AA3F98B6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\VersionIndependentProgID\ = "Vaudix"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix.1.3\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix\CurVer	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix\CurVer\ = "Vaudix.1.3"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\InprocServer32\ = "C:\\ProgramData\\Vauudix\\4.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\ProgID\ = "Vaudix.1.3"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix.1.3\ = "Vauudix"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix\ = "Vauudix"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Vauudix\\4.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix.1.3\CLSID\ = "{3E070B5B-7816-39D0-959B-2B05AA3F98B6}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3E070B5B-7816-39D0-959B-2B05AA3F98B6}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Vaudix.Vaudix.1.3	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28
PID 2868 wrote to memory of 2936	2868	554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\554ac94960e1d5dde06c7eabceb7c080_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" T.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\4.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\4.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
a83ac6557cf2df060491844f7c7e0939

SHA1
ff325c7c4e9ddb7d7bda9b3b3a4339bc5d0cc154

SHA256
38311ce141499e04b1dadc3a9ca9beb07c49b9b490ce35ce89844d1fdebc2c8e

SHA512
9506322e0e4a0363bdfeb3a683b74ce5669d9b1fb51af0c1b279b84a6609a1a950d8d359134af69a5b8519851bc9093dc8cae77a9c6f9d22a647e2d9a91736bd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\T.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\G9.js

Filesize
5KB

MD5
c441132a1a112568ca08d7a7253afc96

SHA1
d0e68a87737797735f60a32837df84cc023bb357

SHA256
e3d4571c87a951fd829765b85a86eb1216b142147ad3ca29c0eb3582282e8835

SHA512
e7cb3b673419d60e3546f949664b66f6e2e48483217444aafb0b25a76090d38f56bd20d7294d59d192eee74964af97c2db9b1ecebc640da3794a8555030ba89b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\background.html

Filesize
139B

MD5
615db029fd3e61b667c3e299dc70d36f

SHA1
68eb8bc300a324ed65050aad4be246bfad545b57

SHA256
51e18f4ee708db7e0c4c83f33ef52a98cafcf4e875fe6ced318393cff7ca1516

SHA512
7bb3211d6c80aa325ba07b8ad73f6beaec37e7d22dc2ab7ab8500aca757e0c86b6d8aef29f1ea0ae1b370fa633955b5b2ffccaabbded01a6e46b076480efe61a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\manifest.json

Filesize
499B

MD5
083ea3aeb3391174b16aff46316801c0

SHA1
46ec3dd7a0eaf102960153b45c54dc1425ea29f8

SHA256
7d5bbb71dbe5cf921d1ceccdf8c9308586968a02e56b40e576d9196d269c680c

SHA512
c57d2988226e3ee2734bca6e1f07185dda2ed5911c0502372bd52e436061ba84b01a72f98ff829277c50b3fbf13d400b8c68a7055134f51f5de41d01b9cdf1ff

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\ihbcfeigpicicfddooecilgenhmbebfe\sqlite.js

Filesize
1KB

MD5
30af2a8881a26b013fdce6508e2b5c44

SHA1
d279700294e2e634c25c0cd47f5f48bd17c2a8ed

SHA256
976284a92f5958752aea103ac71bb3a8670b8866fcb49b1e8cb883995541c48e

SHA512
fc634540ac8e0fdd0989efeb3d68748d2a020a3a9c06bb2bfe0b2d3c23fb8efeec50d3701ccb85ec040a397dc83ea9e5aeddd7a6bc2380a7ce67af50c7f7fb36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
8cf6a02adbb9afb0d81f37b8f81368b8

SHA1
55623a89af0c03949803d9084c2040107500efbf

SHA256
3076c8f6a0476862f65187318108995ca62043f3d8dbe9cb89c6c143b6d62619

SHA512
f56e1691bcad98f94adb83c89fa7df3fa788851108a5a48bf2ba07725aa8f4cf5d3f80550dceb82fb53d9b4e4d4fec74984d4964ae6cc016631768bf213b2f16

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\[email protected]\chrome.manifest

Filesize
96B

MD5
af9e80fd1e8686411ea6e5b466929982

SHA1
969c714bd006f2bfa32232c469f8d1c90ffff00d

SHA256
24ad4c0506dde5943aeff52abc118fafb4f84905d472dce92acaaa6b36f1be7a

SHA512
be77fc9d062271e1fd9c0b0360d3c1538bce37b2e5ef19f8fd91b49e5a98066ecd40200bb51f48cfde5959da86eb08ea4b7df76fa0ea22a56f078182fa0fb427

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
739e86e561f79e5cfbe2aec7c562ac04

SHA1
190b3668a280ad42d39218751240b5e456fede52

SHA256
e074311789888f6f6cb702e762e746b4b73bd4caaa0614e5861f0d9195843db4

SHA512
abff523739d5aa53629393410a5b2d30dcd3729faa512d5f05c5b35cc623b805e578618e40f9b49d6d8aad9e7c6812221520f57439f5c43dc29f605b9fe5f971

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\[email protected]\install.rdf

Filesize
595B

MD5
ccd4397df0f3f8fd06feeb6acea2c081

SHA1
95b13f3085cc71482b3b85e7fcb317fd88a26b67

SHA256
69347c288ee29154058fce21cb80bc156b6aafd081f3b8c70fee24aab0bd18fd

SHA512
5d3c255399f8a8cca776ceb94e8e8ea8d1730f471ddf5457a1a117fd345c0de9527be039c855297424593fdc03b713905aba17403d123fb8d47c9aea2cb7fb63

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS8881.tmp\settings.ini

Filesize
7KB

MD5
30f7037580d15e213e873c3af57a4d72

SHA1
6bda155a74d3df7c19e347bb061936bf237fc0fe

SHA256
8ccaec63ca5ecd9ce0f0a3b7481fda84871b43d2cb313cebc25dad126ca637f4

SHA512
2caa13f2bd559ca1392bf99ee3c08b69edc557de3de34b8b94c662c58cc0836df1f7b62325720c8d4d6cbece3f2edd43344514a670ff346a3bc6bb60c52561bd

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads