2796463be8c3c3ac6051130a6e1714d69a56974cf5627e13d8b2bbe1bf700eca

Analysis

max time kernel
130s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe
Size 255KB
Sample241022-e6qz5axfmg
SHA256 2796463be8c3c3ac6051130a6e1714d69a56974cf5627e13d8b2bbe1bf700eca
MD5 68eb6289aab34800ddb921b51bbbf2d0
SHA1 f518fd1f51e9bac7300787bd25c426b637d5e6f5
SHA512 623198083231db86d6ba37cccd2d93106cf2475f02162fca3d86f9e5cbe7ac4850d0f3288504d52cb8a8b7454464605ead508927b7ea7a525c31069bf17c0639
SSDEEP 6144:h1OgDPdkBAFZWjadD4s57cjIeDcsZ3X7w7S:h1OgLdaOojIvsZ7w7S
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023bec-69.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
1356	51f17cca37465.exe

Loads dropped DLL 3 IoCs

pid	Process
1356	51f17cca37465.exe
1356	51f17cca37465.exe
1356	51f17cca37465.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nkipnkkmhnmgigcojmapmchhnpdecclc\1\manifest.json	51f17cca37465.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\ = "saFe saVVee"	51f17cca37465.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\NoExplorer = "1"	51f17cca37465.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023bec-69.dat	upx
behavioral2/memory/1356-73-0x0000000074020000-0x000000007402A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51f17cca37465.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x000a000000023b87-29.dat	nsis_installer_1
behavioral2/files/0x000a000000023b87-29.dat	nsis_installer_2
behavioral2/files/0x0008000000023bf0-98.dat	nsis_installer_1
behavioral2/files/0x0008000000023bf0-98.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saFe saVVee"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\InProcServer32\ = "C:\\ProgramData\\saFe saVVee\\51f17cca3749b.dll"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\ProgID	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\ProgID\ = "saFe saVVee.1"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\InProcServer32	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saFe saVVee\\51f17cca3749b.tlb"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51f17cca37465.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\ = "saFe saVVee"	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7}\InProcServer32\ThreadingModel = "Apartment"	51f17cca37465.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2264 wrote to memory of 1356	2264	68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe	84
PID 2264 wrote to memory of 1356	2264	68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe	84
PID 2264 wrote to memory of 1356	2264	68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51f17cca37465.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{F00EF0B3-E3AD-8057-84F1-53CCA06DE1C7} = "1"	51f17cca37465.exe

C:\Users\Admin\AppData\Local\Temp\68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68eb6289aab34800ddb921b51bbbf2d0_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2264
- C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\51f17cca37465.exe
  .\51f17cca37465.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:1356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

uninstall.exe

Path C:\ProgramData\saFe saVVee\uninstall.exe
Size 48KB
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935
SSDEEP 1536:zLXB65939tY6HBg4sXJH74RoKu/DvrCyY:zLk395hYXJb45uveyY
MD5 SHA1 SHA512 SSDEEP

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\[email protected]\bootstrap.js
Size 2KB
SHA256 75816015e47340257fb98a249b28ce392da0eb94cd6780d562a109980d63b92b
MD5 7d793c0de29bae3fdb00af8f9cfeee68
SHA1 65f37c2df99e4c9ac0725b9a59ce14da26ad4dbe
SHA512 b8c26caf99eaf7b30a87790ebe6ae0bd5b33ff394f9acc13c775b63151da6a065b356d244e384f235fb6bb62ba2227f9687aee705b019f08ed6413ee3307b827
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\[email protected]\chrome.manifest
Size 116B
SHA256 7e2688883ea55b0e1ca295a3f222c0e213b1e023ebc7da4c881d59edf0cae68b
MD5 5f88fef6718442bf0e3e0295831a61fc
SHA1 6505139a179fd0ef0c8e6600b08102bb35220e90
SHA512 fed9d6daeecbe4b64860f16f87e7b597b6b8b9e5e829c29699d1d4df21c8fc6e8bb340fde0523de92173a5f5a99c7e5029e01a077a985fc4f36a060be12edd05
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\[email protected]\content\bg.js
Size 8KB
SHA256 77a339f8e229ff57b59018f5e3c284add4ade7bc32c8696e9a4eba0a34eaf436
MD5 91e9c1c178b991345c18be2192906d4e
SHA1 b933abf4339173806c7c607478c62c1e93c62933
SHA512 3d44dbfc82d34c997c5a14db21ff09fd01693b868ae4a8ffb7de24892e4850a9dd7101af53362f215eab9a8223aee393abba4f501a572d3c6c204043aaa31997
SSDEEP 192:lo3v4HCPdT235UsZkJn7ERhz9xpVqkYTyac76:uv4WZu1ZkJ4PzbpTyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\[email protected]\install.rdf
Size 598B
SHA256 fc35992c85858a951d323117c02367f7184ea7753c79bc865737d46dbb5b082f
MD5 672f8a31aaaa5002cf95a19abd6cfc04
SHA1 e0048a525fff10b34280ac774c4a57e9704f1192
SHA512 25fb78e6b0fbfc76a73dca3937d165bc5561ea587a1173daa1c013fcbeff863485d886454583877dd9512190a764fb4a933e07f18e99b1021b4d7d737dd4f25d
MD5 SHA1 SHA512

Submit Download

51f17cca37465.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\51f17cca37465.exe
Size 71KB
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43
SSDEEP 1536:zLXB65939tY6HBg4sXJHN4Romu/FvIqrCj/LnVL93MnYCyG:zLk395hYXJt45QvIXnda9yG
MD5 SHA1 SHA512 SSDEEP

Submit Download

51f17cca3749b.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\51f17cca3749b.dll
Size 116KB
SHA256 a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a
MD5 05234975b085632d70d89c2f420c5107
SHA1 078fb2a3e5de54c3737a4541242a4725c02c6b9c
SHA512 f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e
SSDEEP 3072:qX5UN7y6FLMpc577/k2CA+D5AjN5mWuTx:qpMy6xMpc5f/vtVjXuTx
MD5 SHA1 SHA512 SSDEEP

Submit Download

51f17cca3749b.tlb

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\51f17cca3749b.tlb
Size 18KB
SHA256 a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492
MD5 c1e296ff01d3cf37f91c7473bdd9de52
SHA1 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6
SHA512 aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c
SSDEEP 384:ix+/oLzbS7H48fU+rdHBI0qA9T1dLtFn19hXKwYw:i5bSDls6HBI0qG1dLjvf
MD5 SHA1 SHA512 SSDEEP

Submit Download

51f17cca372972.15170478.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\51f17cca372972.15170478.js
Size 4KB
SHA256 387d7c33a42f6ca80160d4c65cbb7f9cf191068765dceea1754e201b92645094
MD5 12ca606c5182f3f5ffce4dd3478a1ce9
SHA1 a0d2345e0064ce144ad64887d4d93c4767c26675
SHA512 82799a60ae361b05df53384d8addf75d9e80de18b62edda3a18812a538d78fb4fa06bf439a33594397441d89523af8a8a9ead8df63c2d70ff8a3a1d110b888df
SSDEEP 96:Zh5LJxjTWgUFxZWN0wvpjeXY7/aU7HJJ0vOaB:/NKgUFxZ7qpIY7/aU7m
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\background.html
Size 161B
SHA256 b5f470ef3dd66c3d9074d9bac0a096aeb984911157367b60c7bb0d7b16c41cbf
MD5 e7f6cb251a860c4f0ea67e414ed5a94f
SHA1 b0bebad1091405a9dd75bef3d6e5cbd6f3dfc6c5
SHA512 3829e9ca922bcb3609c68d37c5d83c508161a223309912982d0079a7369643b909f72fd5ce720b0bef56fc9dafd30bbd1a53e200dbd18db7d6898a0d5e85f5b7
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\manifest.json
Size 503B
SHA256 afd8862b9ac9de0084145ad3cf5a1461befe32bbc82d9053c1f3eac099da67a4
MD5 675ebd42f39dbc7a5fb689ece4ee1a35
SHA1 ac250c6c8d0892c12d88130683e105a9628bf3d9
SHA512 efe81f54758c7e56590b1df9af4cc1b52ed244a94b8c81c408bdde9b5a06bd40a6c928e7a7dd24da0baeb5bdd4b57d7b181b301258051d1df66596e2459a1c69
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\nkipnkkmhnmgigcojmapmchhnpdecclc\sqlite.js
Size 1KB
SHA256 a8c119f4b7ab58dedc91bfc389be72e8503781f04b518f09ea990ab1d7674937
MD5 e840751f28bbbe0c019d794ff5375e97
SHA1 2664fbb86979a88d7296b7e9d1581e25b146ac20
SHA512 8a406129e51bf2a67610969f81442199b85521c6c2a3bc37e79b1b0f885fec95cda9550b1a50d041600cd9049272420b3742d7e92221c3f9395d1398413d3053
MD5 SHA1 SHA512

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSA0C4.tmp\settings.ini
Size 7KB
SHA256 cb1b834979e01a6612e924a7a58a11e82b8686e856bdbcf09a554d65ae870797
MD5 dc26b1d766520aa409b8480ecd975a4b
SHA1 b9d6c5e01065acb5814c1f34bc019706364e3dbd
SHA512 7a7643a58f4eea48f8934ca7168bdb4daa65d0a0007b101332405c1322d4a3db2aa8301677f17a1775b5cc606dc2ce9f0576c33d6a948465b9055a5645af9b55
SSDEEP 192:uLV33CCTsWdTsWhTsW5TsWBTsWwYDUVMMBssoWxCLks:0dTfdfhf5fBfVfMyks
MD5 SHA1 SHA512 SSDEEP

Submit Download

UserInfo.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA20D.tmp\UserInfo.dll
Size 4KB
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b
MD5 SHA1 SHA512

Submit Download

nsJSON.dll

Path C:\Users\Admin\AppData\Local\Temp\nsqA20D.tmp\nsJSON.dll
Size 7KB
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90
SSDEEP 96:Zw8NZ0x0OOdzJt0TwYKj7W/NYDNd9fQ6blfW+KrWC69r7ncnrD6Qdm:6e/7vAmrHblfW3iCmDcru
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1356-73-0x0000000074020000-0x000000007402A000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads