39bd6e3dea21d668a31e354829089c5cd056603ff0e20dce3c5b4ead59a01705

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/10/2024, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe
Size 1.0MB
Sample241022-efx1rawama
SHA256 39bd6e3dea21d668a31e354829089c5cd056603ff0e20dce3c5b4ead59a01705
MD5 68c88a8e7405dbdbbb9fb7cf24e0b566
SHA1 dba070a6eb593ba8af948a3acd666cf723c0025e
SHA512 b66212335a1feab34f3f90607890cdaf07fcb16957c5405e8cfc4617c42a455316229e983b131d292f93cde5503d559da3d515ed53c642f42f05fd9112c41d08
SSDEEP 24576:4LihyRNbDI0JGCWSKbU0uPwBp9FGslXqJC6sC2bR:4LIy3M0JEbb2PwBfFGHIR
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
556	29XP4xkbCh.exe

Loads dropped DLL 1 IoCs

pid	Process
556	29XP4xkbCh.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lcmcoelhngbinfabolnbjbidjoillmjp\1.6\manifest.json	29XP4xkbCh.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\ = "Download keeepEr"	29XP4xkbCh.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\NoExplorer = "1"	29XP4xkbCh.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29XP4xkbCh.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	29XP4xkbCh.exe
Key created	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	29XP4xkbCh.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper.1.6\ = "Download keeepEr"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\ProgID\ = "DownloAed, keEpper.1.6"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper.1.6\CLSID	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper.1.6	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\InprocServer32	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Download keeepEr\\8REgJReXL.dll"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\DownloAed,	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\Programmable	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	29XP4xkbCh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\ProgID	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Download keeepEr"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\Implemented Categories	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper\CurVer	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper\CurVer\ = "DownloAed, keEpper.1.6"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\VersionIndependentProgID\ = "DownloAed, keEpper"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\VersionIndependentProgID	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper.1.6\CLSID\ = "{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\ProgID	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\InprocServer32\ = "C:\\ProgramData\\Download keeepEr\\8REgJReXL.dll"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper\CLSID\ = "{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}"	29XP4xkbCh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\Programmable	29XP4xkbCh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\VersionIndependentProgID	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\InprocServer32\ThreadingModel = "Apartment"	29XP4xkbCh.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\ = "Download keeepEr"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\keEpper\ = "Download keeepEr"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win64\ = "C:\\ProgramData\\Download keeepEr\\8REgJReXL.tlb"	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	29XP4xkbCh.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	29XP4xkbCh.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	29XP4xkbCh.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 556	1492	68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe	86
PID 1492 wrote to memory of 556	1492	68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe	86
PID 1492 wrote to memory of 556	1492	68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9E1BF9D5-6482-40F1-9BE5-CDA9615D84E7} = "1"	29XP4xkbCh.exe

C:\Users\Admin\AppData\Local\Temp\68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\68c88a8e7405dbdbbb9fb7cf24e0b566_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Users\Admin\AppData\Local\Temp\00294823\29XP4xkbCh.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/29XP4xkbCh.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - System policy modification
  PID:556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

29XP4xkbCh.dat

Path C:\Users\Admin\AppData\Local\Temp\00294823\29XP4xkbCh.dat
Size 3KB
SHA256 5d601575f655ac4c1fddb7e4293a84a669167fce4ec520af82bd895b064a4b09
MD5 8e150b0367e08c4597caae3543844acb
SHA1 dac82e9250810542c5f533efd8225745c43db579
SHA512 b0a1c29c20adc5450ce7c6c45a5bca635fc5b1783347ebcde2cf0746e39e540d41244a811b09303e2911567b99e99b88a74e9d90e9ed4e3f5bc8de2993c083c8
MD5 SHA1 SHA512

Submit Download

29XP4xkbCh.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\29XP4xkbCh.exe
Size 334KB
SHA256 f54a6814ac06c70ef5b738eca4855e49039783d96b70ba1ae461bd90877e53b5
MD5 8300c91b40229b42301aebc6d8859907
SHA1 0b55e56a6add6b4dd4ceff475a0018a203d02a5a
SHA512 0863750da143e1707513f4a2efe1ad6cf81f5a819c7d5496d1629745afffcf72338aa9de90479d5e0936e848f9b260c434fd369027c56be175814086cafd4d8f
SSDEEP 6144:8jTc99/rsv9Et5hDG0SAMs9jkO/jYZRJKTCy1W7nnJdwY:Yo99/rsFEt5hDG0SAMs9jR/jeRJKu9T7
MD5 SHA1 SHA512 SSDEEP

Submit Download

8REgJReXL.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\8REgJReXL.dll
Size 258KB
SHA256 9900e517bfd4b39bd7af4bb360af52f6c95ef9b3e7ef36d2633485c58bef9a1a
MD5 e1d10cccd5dde588af8ee2cb7309523c
SHA1 0b9e805077320b0ce1e6620488bd34f1c4d7827e
SHA512 a929eaae12f5cb28e224fc31298af2808f995c5a06bc6f47d95879703dbb9369e2e35b4e50a452e91741e6a949336220348dbb3c389c46ea2e0ca41f592dcaa0
SSDEEP 3072:wcIw///l2VdU77Qswd2YVyVaufuP8DnJZSL+LwoyEnLzwb3ska2WJnpXnTi+z+YP:wcJ///l2dVyVaumUujv3skdW6f5x++e
MD5 SHA1 SHA512 SSDEEP

Submit Download

8REgJReXL.tlb

Path C:\Users\Admin\AppData\Local\Temp\00294823\8REgJReXL.tlb
Size 2KB
SHA256 66fab808188a98ba49d99b723a181aa6626197d50bd2d5e15e076dcbc6fbb2cc
MD5 9156db5f76d48049dbc41fd1b58b3f34
SHA1 5eb1df59f9b5b06ab00137fc9e6451e323d3102c
SHA512 742a77e71c34632146e16acadb6b381694072c7f4c2dea1df1dfc645ed42673ba153c832d167474dc41f9b608142a8c41b4aecda1efdab90d87d4f5c718bf149
MD5 SHA1 SHA512

Submit Download

8REgJReXL.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\8REgJReXL.x64.dll
Size 319KB
SHA256 870c280ea861313edda0bd3950dc738ea68d006f315888d66023b54e5f98f0ea
MD5 4f5c722b8686afbea6f09c53171d44ca
SHA1 184c60aafbb12d1023b1ce2aff4d3708607a75a1
SHA512 e471a86079a16d129ea0c01878af77d1aa132e629832d3f0f3d1f8a3dd250ed41c8d2f37403a10c8061fff07c07dda926ba7ffcc417c6e0100005a0f2721417a
SSDEEP 6144:faBBHpyFePfDaZBbVjpC0xSN9RTQo32+m+jU:SoYPCBb60xevQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

42F4YLGnN_.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\42F4YLGnN_.js
Size 5KB
SHA256 17201762303b9cedebd5ca08ee9da112bd0733a96339973eb8952305ade2c83c
MD5 14c2cc9b047896d5f481b73368f3c5fc
SHA1 6c0dc773f736d30ca5aa0c391b417b5b0054dd04
SHA512 3ec4007bcefd8b1a7dd9d0818d601f102d4fc4e7840bcf462a5ec525048790e3079f629e2993436ecf48e5f092d204d6b4065dcc09dfdb604b95623d37a37c1b
SSDEEP 96:Zh5LJxjTWgUweZETTgFuKLZEWN0wvpjeXY7/aU7HJJ0vOaM:/NKgUweZETTgFuKLZE7qpIY7/aU7r
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\background.html
Size 147B
SHA256 de0da469026a0c086ef917827800189f9913579f652f15614d6f827126db91b9
MD5 c8877396790e72fc8a64b1071e582293
SHA1 afd41493df1ccb579e1b5795736350c7410fbb18
SHA512 07d13681bb01cd53670937df071ec769a22e2f3e4b3d56c3d422f1c6086132d6e85d42aff48af9c1a7b3045060386795eda0f2683cb7856112a52a0619a2e135
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
MD5 SHA1 SHA512

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
MD5 SHA1 SHA512

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\manifest.json
Size 508B
SHA256 4167d3402c0ca9d5a88c3e7d197bdc9ebdef5b18615833424e2e6d0c45919c7c
MD5 13ec5e8ecc553a93d1504880d00f32e9
SHA1 1130219d2bebfec643b391496f3b3d4f2ee5574f
SHA512 fead6fd0b89af63c2b1f743107011e0d0cc85340ff62fe91aa60a43ea3440a3f316e8f7666f123dac0988d8ea654f5aa3b364e84cd20d047beca92027a580654
MD5 SHA1 SHA512

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\lcmcoelhngbinfabolnbjbidjoillmjp\sqlite.js
Size 1KB
SHA256 1b7a8d58525a50682e912dd9de8c5690fc5724cc7ff078ce747119aabb16560b
MD5 c3667a71b92d8c62f38685deb6d4e17a
SHA1 19adf3f83c0faaea773db0ea5bfb4914f6439382
SHA512 940ae654b9a8759e4677bef2c3a2f073aaa09f065aa5d7bf0138606bab49d9f8b22f9781fc2c3782226bedcdd001df2d3f6c7fe1b494075f7c4359972fb07795
MD5 SHA1 SHA512

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
Size 2KB
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
Size 112B
SHA256 a13a9c3e8cbeb269ad25d2f721ce1ce1505e01199273ca1332c0fd6c5f299c13
MD5 69933ed7a07eccb0776363d24dbe4e84
SHA1 adba436d8b23ec9853537d3a24427b5296f2efa9
SHA512 74d693a7db96a902cc6ac12b0fd300a579719b132f5127536ea3160f9c2a04fb8a96bf0d8b83390f802816bb152ffd3a7fde9492580a58721c0111091223a52c
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\content\bg.js
Size 9KB
SHA256 f9ed1dce785a0175ce4539e1437ab0f6f2be3ff8fe9310d5cde480e4f7bc3ef0
MD5 8fb4a912c0edae94366473c39b26ee66
SHA1 fda356330aea2735b28d2315eb806ee5fb5b8bfc
SHA512 f125f6c338b0b611d967db78bb7274a2363d82f4de840e0bbfc5fcbdf98e13cdaa6c632ea2b65b02cc96223175a17f3f4eecc84909eccda335b6bf5896c1ef3c
SSDEEP 192:lo3v4VNCy+/235UsZkJn7ERhz4eZETTgFuKLZOVqkYTyac76:uvWNHsu1ZkJ4PzLxgTyyB2
MD5 SHA1 SHA512 SSDEEP

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
Size 607B
SHA256 cc8dd381f054c0c0eaabf066dbf0a206bd38e8a46795fcde40330551e7304162
MD5 6de925026ef4521329fda3525572104b
SHA1 b30676cbbb9be1c490a385f41cd228b113471767
SHA512 540738ac91cd48d316df92676c2a19326b1f6e6232d119f4c401d20caebc5d72033c9a556fdb347539937462cfb48bc897716ca91e2289bc686e2a38e7047606
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads