421e0e6a873d54e8c0a9e237f06c56614b551c5a376aed49b73e1c2334b86802

Analysis

max time kernel
119s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
31-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe
Size

551KB
MD5

826ac4ac8bd58186603919d44e7c1d38
SHA1

911bdb25be59b6154b43d2cbb097e4705ec1d756
SHA256

421e0e6a873d54e8c0a9e237f06c56614b551c5a376aed49b73e1c2334b86802
SHA512

8a2e81bea35666b8abdc6846e6e2ec866aefe660790ea3038a28a8d4ed3862b026894ba22d4e7b61044bed91d81bb361a09563f296404ab7fdb47a81dc988100
SSDEEP

12288:h1OgLdaOwgbJuMmFcouJqkXWctn+MEfOS:h1OYdaOwgJHJJqkXtMOS

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2736	regsvr32.exe
2736	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\loomgpnoenclacbpmhidpnllgpdjfcfp\1.0\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\ = "SearchNewTab"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\NoExplorer = "1"	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe

Modifies registry class 63 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID\ = "{2820D3A4-6993-31F6-5DAB-715AED17D20A}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\VersionIndependentProgID\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\InprocServer32\ = "C:\\ProgramData\\SearchNewTab\\XXXVTk.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID\ = "{2820D3A4-6993-31F6-5DAB-715AED17D20A}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SearchNewTab\\XXXVTk.tlb"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\ = "SearchNewTab"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer\ = "SearchNewTab.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\ProgID\ = "SearchNewTab.1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2820D3A4-6993-31F6-5DAB-715AED17D20A}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SearchNewTab.SearchNewTab.1.0\ = "SearchNewTab"	regsvr32.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28
PID 2792 wrote to memory of 2736	2792	826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe	28

C:\Users\Admin\AppData\Local\Temp\826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\826ac4ac8bd58186603919d44e7c1d38_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" a2RAO1.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:2736

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
5KB

MD5
49343d1bc7817d182339faf795e65052

SHA1
80a4a58ec14b73344944384572ca49a487d0ba56

SHA256
fc0e0c96627b57fa77d0f01b8816aa2b9c9b39042b6a40dc2f27b0f4a75da71a

SHA512
0133364c4c43b8c8abd0c4e4f11f9f613a3d5369876855a4818d2a33042802c9a42f5f91f3271303c0c7d80e8823c493d77164b22d08bb23f747afba1352adfe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\XXXVTk.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\XXXVTk.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
e45a2c6b92d1c01d5436d1ce65eeb30b

SHA1
e156559382feb4bd038a769cb89af4f905b9146b

SHA256
2d1a6f152742a3d09ada8ef9a7482549c42c898d30e7a56bc26ff8d2faf14079

SHA512
23ce3fd46d9669156338225e27819c0ceb1ebb489de27800a1722d68b9b4a51ad6d8403ada50645acb110e8795a5cab8dd5e104ff5179c2c4af36909182433f5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\[email protected]\chrome.manifest

Filesize
106B

MD5
b4053622830298638e19c2c291442872

SHA1
3004a3a23e4aef8b6abba496ca2417b337bc1fed

SHA256
c1606c5debc16f1f26f40acdecd917615912ab6b5ef914dd734899f4432ac8b5

SHA512
f2fc6c966f35d8265a5333414aa4e9be4860922192a6f6ca04bd7791494d0a2147575ae8ca66c19ea96fdcb959b63b473f15b2937dfe50e0a54eaeb7999c085f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
429619e9ec72bb89649f52a334b44b19

SHA1
5a58439d6ae7a47d6dfe8a983fb676f004a73247

SHA256
58971e008ad19f4580aa36b758b827b3ca87ccc9bb1a593bd87b2b2effd7342b

SHA512
3ce0de8dfcdb2fa67ebc7d10dfec1f3596796dc46c12d234bd53331fa4543be62590cff90533c66fd4fa48b2baccab6325025efc3e4b033317a59a647f96fd36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\[email protected]\install.rdf

Filesize
606B

MD5
6e0ed840517d16ba894ec8ff78013e50

SHA1
93f36676ad1c6321da4d08170e1ef0efb399bddf

SHA256
0444650f716c2a0879d5c17433f7ef2cfeb4b7e22f60a5634f4416a6b914f4ce

SHA512
39ae86f71bbc3bb1c6530dd022812d5f17ad8660ede811ddea15bfb7e86347f780fc9ebdb69b9a249d545e83d5d554144bf5339728f5eaed95e1d0c8a6f048ab

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\Uih_nOF.js

Filesize
5KB

MD5
a669a3071a11b7f554a93f8243043337

SHA1
283255d1f60c38d70bc0f4815626d3c5b07f5f28

SHA256
be8941f7e3a0a11097e9228d04ed69201ff97f1d5b7f0f024d9eb9199c1c9cd2

SHA512
04759ee65ea700417f617542cedb1b3ef2ef95152a054daaeb6af8beed3a8f627824d83c1cd10334adebc2d743f8b97d409727daf2bfb0abf86189f5e5639599

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\background.html

Filesize
144B

MD5
27920dc9e021f72d099bf0417fd0535d

SHA1
609a390e9722f8c5fd9fbcae28524a144a87713b

SHA256
56123e671c7481930aa27e124e3e7df509b8cd73d450d22c288a3f7eb6694008

SHA512
2abd2fccc75650972b6d5ad8f69802c7b15ee7c9b70fb15ff6a86b107c67e7e0ce51b47f44f945737722948a8aca592f8849834b610e9b7e8bf414841abc3b82

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\manifest.json

Filesize
504B

MD5
64a50cfa61c46058e2b31bc0aa209fef

SHA1
23d088ca274aa7aa237ef8c1cf3882da2a9b5d8a

SHA256
ec42ce0c8fce105097ccf84464a6c27d0c3fdc3f80d3b0a8d992a9c8378f1875

SHA512
b63b486c6588a8d701e3a7e6c6846b3aa338767a3173d6d2549cc14fce43ad54b3de225267317770c5b104a20aeee8e6af4ce74e4e8e12e0e075a5bd9bdd774a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\loomgpnoenclacbpmhidpnllgpdjfcfp\sqlite.js

Filesize
1KB

MD5
6b8a4afc29f498b8b81ac9c1e1734239

SHA1
7a0c0ee15726a021f07809c0839ce1a75a08a449

SHA256
76e8d1830e3ad0b04412a125efceb6205384ac1b176b70c6eb9692ef89786ad1

SHA512
a25de67339c55b8a613fbd040a7fdff460c6fe38b609b8fd622f4a6125cbe78ccade5ea1f05586015b9d4b7243d25c508315f9de412cc3bba5c3cab6ac111b8c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS582E.tmp\settings.ini

Filesize
7KB

MD5
dd492b4527cc6cd09c0d9e39e42b8e6f

SHA1
2982fcfa95f7e20dbfbbc5133987bdcc1808fe55

SHA256
668e034fd7320096e1eb6da9b807f65929ff5ad343f80bc5765f34d775dd6e98

SHA512
e821018a8686df13d341467cd227af964835c68e9bdede694ac0611ea82e1de3d74fb3e728d3d14ed809fa808b5ae947c256a6013535b83af351088fc3a905d1

Download Submit
\Users\Admin\AppData\Local\Temp\7zS582E.tmp\a2RAO1.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads