Malware Analysis Report

2025-03-15 04:38

Sample ID 241027-2t3vgsskat
Target 765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118
SHA256 09dcac07347dfd28950539b6e5a97063ffd1a5b5798d341c560a8129813e931a
Tags
adware discovery spyware stealer upx
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

09dcac07347dfd28950539b6e5a97063ffd1a5b5798d341c560a8129813e931a

Threat Level: Shows suspicious behavior

The file 765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118 was found to be: Shows suspicious behavior.

Malicious Activity Summary

adware discovery spyware stealer upx

Loads dropped DLL

Executes dropped EXE

ACProtect 1.3x - 1.4x DLL software

Reads user/profile data of web browsers

Drops Chrome extension

Installs/modifies Browser Helper Object

Checks installed software on the system

UPX packed file

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

NSIS installer

Suspicious use of WriteProcessMemory

Modifies registry class

System policy modification

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-10-27 22:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-10-27 22:53

Reported

2024-10-27 22:56

Platform

win7-20241010-en

Max time kernel

118s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhdekhglbpcpidjnfhfonlehaodjpadg\1\manifest.json C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.dll" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID\ = "saffe saevue.1" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.tlb" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} = "1" C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe

.\51e8e611a83cb.exe /s

Network

N/A

Files

\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a83cb.exe

MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\settings.ini

MD5 140ff6ea77927ed5eac49cf96fa4c5b0
SHA1 820e2e22390419845b359a9d52b6c7162bfc8fdb
SHA256 d7d7db8ede6fba8c7456b5ef3ca2678d5802ecdc7e3d772c38187a4023e1b848
SHA512 98331f40439d5ed6c75e425b3ff109805b0524eb4843f09a2479958be5649f70f2a0664326bb469a8073ef5cc68542f08bbcf41b6b7e7ce2b33d200d45ebc8ad

\Users\Admin\AppData\Local\Temp\nsz5C16.tmp\UserInfo.dll

MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\bootstrap.js

MD5 ab4383ac993b4fb6575c772f218e3f09
SHA1 96290924add5f885c018d6746d05c65e9a56f1f4
SHA256 7c9200c7c223d32a10c4240e1a88bf868776c1a739cd35621107daba8b2ae1ff
SHA512 ca7e3e490d8d8fa5d4b640bb2a09e65155a0826b12c5363dab8bb587d6a9b9832821c7f3a9fc15b722f1ed07b79e331bc06fc0dd3fc1e43c7ced7c016353587c

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\chrome.manifest

MD5 daf5263cfd9bbaecb562b23ecc745fdb
SHA1 7c81cceaa807d2550a80e390c5869b1f25ccd248
SHA256 4ee519aaa98db6dc6b7e3c11d418a4bda63f86345dedfcf05dc3cc9e4487da70
SHA512 0bb6e0a63b214415f96b7aae2af8199877f9d55e5cbac3cde2f7575f8935e929be0cd144c6fd90a7b774aa11bbef79a5f39d54b4f310c1a6bcabdae682d6f71b

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\install.rdf

MD5 6485a09518209dc955e9b81dcc7e7b3d
SHA1 a15d64938220566a031eea2692d02612b5ad0360
SHA256 53f6f2d2c7ebda06fedc9342beb69fc9c6798bc301406d3e7b2cc82ab2afb75b
SHA512 61b8564c52bc7c01a7a2567a97a72651408f15a4c63cad3464407e60df0a8db51c20dbee65892e5cda8b1ef28c63aa84f94f1d9ee7371512a5e8dacc38d80868

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\[email protected]\content\bg.js

MD5 084aec693fa093b650bd650d2213028b
SHA1 16a160ef8371ba5698c315d0bd6e3dea9da3c47c
SHA256 bb4e16e1b5fbac58ae4565ae9a81abcc1a598bd6a5d0ee5730d3ac817e69e61f
SHA512 2c53b3f8a4be5162c0f88674f2ea1b7ae22cff80bbd13354c47131d685595ce7ebd7d2cc378e6dc1beee2e4124105ef401f690e7d33f540246e8c043295d1c79

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\51e8e611a81e17.02675710.js

MD5 39e5e68719f07e9a0c2c600b25ac4377
SHA1 42f0571a3180f1d36a0829bb84decec5190c9421
SHA256 4f93b69b45bf73e1e58debd2a787d1d38b92c1fa3beff632d41445fc342d27b3
SHA512 866915a506851b19105f2f5db1b90411359201450b1a86fb68bd4730695d0db110b90c48c32784649fe06247a09dd845b0dceda9a9d38030ce08af83c2552c94

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\background.html

MD5 dc3ac91dddc699fb9092ee7d06d12287
SHA1 4359590d8562c8315d000805b171b691033ad51e
SHA256 14711b58731ee8ed01a251bbd179ebb5ea65dcf84a0ba8b3ff2d747aa0ff28db
SHA512 851f7715d70f291ecb7b2a0cbfb94a35cd0f8e309e8b4aff97243afcff4ea1b89e898d336f5fe7510002569c3bf82c809a2be194cc22bbb519e422ad0b807ef6

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\content.js

MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\lsdb.js

MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\manifest.json

MD5 e74a293de62fd297f21536a7f30b92eb
SHA1 7840f24e31050f8fbbd12bbaff11699ca45ae526
SHA256 34246e56e28f5a391aa7f64bb74611667a7265146ee92b5a905cd380226326c0
SHA512 5de49d74d74bf8c5c6d29a8b294a8e0b2c948f0b8683b00fbe7ce1b7f6cce22005c4c333680e6f975e830496a3cddc0e27585cc33f4085a8a62f9280de4d8221

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\sqlite.js

MD5 c43c5a3c2f9ace3f85d58942f414a998
SHA1 ef2309d0dfd886f03053d656aea1cf398e2a595e
SHA256 f1e9ce4a4acacb7dbea1bc93ab0a4ffe625f858511890b60c5e2996ad826bf99
SHA512 2deb31cd5e7c73f1a9b5809b1c22ab9b39fef297853597682d63008b4723d137e99b3e0895f7d7a9e487b059de21d3789839ab9266eac8e73c7bab52550bc69c

\Users\Admin\AppData\Local\Temp\nsz5C16.tmp\nsJSON.dll

MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

memory/2912-76-0x0000000075270000-0x000000007527A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.dll

MD5 05234975b085632d70d89c2f420c5107
SHA1 078fb2a3e5de54c3737a4541242a4725c02c6b9c
SHA256 a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a
SHA512 f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

C:\Users\Admin\AppData\Local\Temp\7zS5A9E.tmp\51e8e611a8404.tlb

MD5 c1e296ff01d3cf37f91c7473bdd9de52
SHA1 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6
SHA256 a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492
SHA512 aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

C:\ProgramData\saffe saevue\uninstall.exe

MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Analysis: behavioral2

Detonation Overview

Submitted

2024-10-27 22:53

Reported

2024-10-27 22:56

Platform

win10v2004-20241007-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"

Signatures

ACProtect 1.3x - 1.4x DLL software

Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A

Reads user/profile data of web browsers

spyware stealer

Checks installed software on the system

discovery

Drops Chrome extension

Description Indicator Process Target
File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bhdekhglbpcpidjnfhfonlehaodjpadg\1\manifest.json C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A

Installs/modifies Browser Helper Object

stealer adware
Description Indicator Process Target
Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\NoExplorer = "1" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe N/A

NSIS installer

installer
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Modifies registry class

Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.tlb" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ThreadingModel = "Apartment" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ProgID\ = "saffe saevue.1" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\ = "saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32\ = "C:\\ProgramData\\saffe saevue\\51e8e611a8404.dll" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\saffe saevue" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F} C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Key created \REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4}\InProcServer32 C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A

System policy modification

evasion
Description Indicator Process Target
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B6479A7C-00AB-556A-C94E-0FC2B2EE2EC4} = "1" C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe

"C:\Users\Admin\AppData\Local\Temp\765c05d132fc95c861fdfa284e1d6a8c_JaffaCakes118.exe"

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe

.\51e8e611a83cb.exe /s

Network

Country Destination Domain Proto
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 79.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.28.10:443 g.bing.com tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 197.87.175.4.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 241.42.69.40.in-addr.arpa udp
US 8.8.8.8:53 77.190.18.2.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 70.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 15.173.189.20.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a83cb.exe

MD5 b78633fae8aaf5f7e99e9c736f44f9c5
SHA1 26fc60e29c459891ac0909470ac6c61a1eca1544
SHA256 d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22
SHA512 3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

C:\Users\Admin\AppData\Local\Temp\nsrAFAA.tmp\UserInfo.dll

MD5 7579ade7ae1747a31960a228ce02e666
SHA1 8ec8571a296737e819dcf86353a43fcf8ec63351
SHA256 564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5
SHA512 a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\settings.ini

MD5 140ff6ea77927ed5eac49cf96fa4c5b0
SHA1 820e2e22390419845b359a9d52b6c7162bfc8fdb
SHA256 d7d7db8ede6fba8c7456b5ef3ca2678d5802ecdc7e3d772c38187a4023e1b848
SHA512 98331f40439d5ed6c75e425b3ff109805b0524eb4843f09a2479958be5649f70f2a0664326bb469a8073ef5cc68542f08bbcf41b6b7e7ce2b33d200d45ebc8ad

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\bootstrap.js

MD5 ab4383ac993b4fb6575c772f218e3f09
SHA1 96290924add5f885c018d6746d05c65e9a56f1f4
SHA256 7c9200c7c223d32a10c4240e1a88bf868776c1a739cd35621107daba8b2ae1ff
SHA512 ca7e3e490d8d8fa5d4b640bb2a09e65155a0826b12c5363dab8bb587d6a9b9832821c7f3a9fc15b722f1ed07b79e331bc06fc0dd3fc1e43c7ced7c016353587c

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\chrome.manifest

MD5 daf5263cfd9bbaecb562b23ecc745fdb
SHA1 7c81cceaa807d2550a80e390c5869b1f25ccd248
SHA256 4ee519aaa98db6dc6b7e3c11d418a4bda63f86345dedfcf05dc3cc9e4487da70
SHA512 0bb6e0a63b214415f96b7aae2af8199877f9d55e5cbac3cde2f7575f8935e929be0cd144c6fd90a7b774aa11bbef79a5f39d54b4f310c1a6bcabdae682d6f71b

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\install.rdf

MD5 6485a09518209dc955e9b81dcc7e7b3d
SHA1 a15d64938220566a031eea2692d02612b5ad0360
SHA256 53f6f2d2c7ebda06fedc9342beb69fc9c6798bc301406d3e7b2cc82ab2afb75b
SHA512 61b8564c52bc7c01a7a2567a97a72651408f15a4c63cad3464407e60df0a8db51c20dbee65892e5cda8b1ef28c63aa84f94f1d9ee7371512a5e8dacc38d80868

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\[email protected]\content\bg.js

MD5 084aec693fa093b650bd650d2213028b
SHA1 16a160ef8371ba5698c315d0bd6e3dea9da3c47c
SHA256 bb4e16e1b5fbac58ae4565ae9a81abcc1a598bd6a5d0ee5730d3ac817e69e61f
SHA512 2c53b3f8a4be5162c0f88674f2ea1b7ae22cff80bbd13354c47131d685595ce7ebd7d2cc378e6dc1beee2e4124105ef401f690e7d33f540246e8c043295d1c79

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\51e8e611a81e17.02675710.js

MD5 39e5e68719f07e9a0c2c600b25ac4377
SHA1 42f0571a3180f1d36a0829bb84decec5190c9421
SHA256 4f93b69b45bf73e1e58debd2a787d1d38b92c1fa3beff632d41445fc342d27b3
SHA512 866915a506851b19105f2f5db1b90411359201450b1a86fb68bd4730695d0db110b90c48c32784649fe06247a09dd845b0dceda9a9d38030ce08af83c2552c94

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\background.html

MD5 dc3ac91dddc699fb9092ee7d06d12287
SHA1 4359590d8562c8315d000805b171b691033ad51e
SHA256 14711b58731ee8ed01a251bbd179ebb5ea65dcf84a0ba8b3ff2d747aa0ff28db
SHA512 851f7715d70f291ecb7b2a0cbfb94a35cd0f8e309e8b4aff97243afcff4ea1b89e898d336f5fe7510002569c3bf82c809a2be194cc22bbb519e422ad0b807ef6

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\content.js

MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\lsdb.js

MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\manifest.json

MD5 e74a293de62fd297f21536a7f30b92eb
SHA1 7840f24e31050f8fbbd12bbaff11699ca45ae526
SHA256 34246e56e28f5a391aa7f64bb74611667a7265146ee92b5a905cd380226326c0
SHA512 5de49d74d74bf8c5c6d29a8b294a8e0b2c948f0b8683b00fbe7ce1b7f6cce22005c4c333680e6f975e830496a3cddc0e27585cc33f4085a8a62f9280de4d8221

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\bhdekhglbpcpidjnfhfonlehaodjpadg\sqlite.js

MD5 c43c5a3c2f9ace3f85d58942f414a998
SHA1 ef2309d0dfd886f03053d656aea1cf398e2a595e
SHA256 f1e9ce4a4acacb7dbea1bc93ab0a4ffe625f858511890b60c5e2996ad826bf99
SHA512 2deb31cd5e7c73f1a9b5809b1c22ab9b39fef297853597682d63008b4723d137e99b3e0895f7d7a9e487b059de21d3789839ab9266eac8e73c7bab52550bc69c

C:\Users\Admin\AppData\Local\Temp\nsrAFAA.tmp\nsJSON.dll

MD5 b9cd1b0fd3af89892348e5cc3108dce7
SHA1 f7bc59bf631303facfc970c0da67a73568e1dca6
SHA256 49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384
SHA512 fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

memory/1884-73-0x0000000074050000-0x000000007405A000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a8404.dll

MD5 05234975b085632d70d89c2f420c5107
SHA1 078fb2a3e5de54c3737a4541242a4725c02c6b9c
SHA256 a758ad4fdc8949ea005258075457a972eb0672d69d98d688117b85221fca096a
SHA512 f9fa6aee142e32875127feadebbe235f4f376b0c3b7415036b8afc81c0a09a8ba0c5ec9e1703f1a34b220b7646caa1ca02629918185c4afbafe6926014044c4e

C:\Users\Admin\AppData\Local\Temp\7zSAE8F.tmp\51e8e611a8404.tlb

MD5 c1e296ff01d3cf37f91c7473bdd9de52
SHA1 832e3d1ddeb5a0ceb5b13c1ee271eb94bf9bf2a6
SHA256 a8e54ad3e1fbc91d5a7b02bf177a24a02f2558419ce46859bf15859b81478492
SHA512 aeb1f3962746caa3858c27b4753959d5ec9db2727e94642d5db2710633a96e7ceef5f9c0ff3b358f83143b6594459b5d9a94e095fed7a5d1fa97ae6a3c4e564c

C:\ProgramData\saffe saevue\uninstall.exe

MD5 f3c79bda3fdf7c5dd24d60400a57cadb
SHA1 1adb606aaeedb246a371c8877c737f0f8c798625
SHA256 a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b
SHA512 c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935