9b431acb98f277289ab7a1fbde9103f937c03b9b494d8fff4bae47b882e1bfbb

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
31-10-2024 08:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe
Size

255KB
MD5

826fd5ac8f2e67c4a481c6d85aadc001
SHA1

fb37a2cd4c7a7da4c7ed28ec7390de8dc9a26f42
SHA256

9b431acb98f277289ab7a1fbde9103f937c03b9b494d8fff4bae47b882e1bfbb
SHA512

b1586f6d1985c69b2b1d3265fd82cf5bca33dd4cf5b200879e1c4dfb991e5712c780fb90a3ad5f7f75b1741c612fbaaae57a2b89072a26903e3427baf054ceb0
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5/8YNHnCFvQY1q8QStWMS:h1OgLdaO/BsFvFRO/

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral2/files/0x0008000000023c6d-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
860	51b70b50f4136.exe

Loads dropped DLL 3 IoCs

pid	Process
860	51b70b50f4136.exe
860	51b70b50f4136.exe
860	51b70b50f4136.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nlnagmokfoegpmnhfknopafjgfbccgao\1\manifest.json	51b70b50f4136.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{548FA246-90B8-C170-3CE8-4650E25E4A4A}	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\ = "SearchNewTab"	51b70b50f4136.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\NoExplorer = "1"	51b70b50f4136.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x0008000000023c6d-74.dat	upx
behavioral2/memory/860-77-0x0000000074500000-0x000000007450A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51b70b50f4136.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral2/files/0x0008000000023c13-31.dat	nsis_installer_1
behavioral2/files/0x0008000000023c13-31.dat	nsis_installer_2
behavioral2/files/0x0007000000023c79-103.dat	nsis_installer_1
behavioral2/files/0x0007000000023c79-103.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\InProcServer32\ThreadingModel = "Apartment"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\SearchNewTab"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\InProcServer32	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\ProgID	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\ = "SearchNewTab"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\InProcServer32\ = "C:\\ProgramData\\SearchNewTab\\51b70b50f416d.dll"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A}\ProgID\ = "SearchNewTab.1"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	51b70b50f4136.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\SearchNewTab\\51b70b50f416d.tlb"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	51b70b50f4136.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 860	408	826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe	84
PID 408 wrote to memory of 860	408	826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe	84
PID 408 wrote to memory of 860	408	826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe	84

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	51b70b50f4136.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{548FA246-90B8-C170-3CE8-4650E25E4A4A} = "1"	51b70b50f4136.exe

C:\Users\Admin\AppData\Local\Temp\826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\826fd5ac8f2e67c4a481c6d85aadc001_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:408
- C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\51b70b50f4136.exe
  .\51b70b50f4136.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\SearchNewTab\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\51b70b50f4136.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\51b70b50f416d.dll

Filesize
115KB

MD5
0f449a5256bcfd0c8d914040735f55de

SHA1
3145a00b9c81bc2804f4ec9ead4b903951310b98

SHA256
2a73ccdc5de5e3ec7cb9d549a6d2c69ce3c2f09dbaf36bb3e25b624c92347a51

SHA512
07c903259d0e0a8c72a3aa70ee408ae4fe7266946f1f1f10f00f01922caeeb2edbbf211be25060f68910b1b224a8e14a535ade2eb04252715e4ffcdbba579314

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\51b70b50f416d.tlb

Filesize
18KB

MD5
ee294e40b4e8b5ddd4b3d04563fc06bd

SHA1
134a12b6e3a28badfd8682bd0d5855dcc779518b

SHA256
cb4b95b52ce00b82c39c3349f61a7967c65119cbc354d76d2294017c80006779

SHA512
23c190b3053a679073db27161c8cb0745f42f37a00fb382efcde52b2826c00ef15b12ae83c3b5fa5e2821302aa174ddc1e20555354f5bf2a058cfdca72ffb05e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\51b70b50f3f520.46404814.js

Filesize
4KB

MD5
2dbdc6a3d9b8eac3ca148411c32e171a

SHA1
6d58896b2dacfa46dd4a96153275c7247cf780f6

SHA256
f6f71979bf332c47dfa53979aba039a0558af90cf8922e51b9734a79d37566a3

SHA512
f3efff6c6c743d1bc9b9591efdde76041d6bdf520bfaa9eaef636545d79672f145a38a7f42d1fde0f2f522c362fd7ce52f63816d86fe3dc86fa27d4370082a2d

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\background.html

Filesize
161B

MD5
7308bb8ff5f5b8eb0c06a65e033b02b1

SHA1
3010eb136208179d5a4ce35872c3321980336235

SHA256
51d4fc982b80fa2b1b8195d8344d71f71732760e0d1a62ee0c792322b0a21931

SHA512
10168e8883421a5d2cfb73bd9704388c45281a022d17c7f15341b40cfbd064e0463155dc579a6a0664058c9eb288c2eacabf008b13bad0e4c21afd3eaf48ecf6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\manifest.json

Filesize
555B

MD5
b43fc93b920a4acbd657869fd8926b7b

SHA1
5c167d5778482b59777743af4d49982f8c6804d8

SHA256
03661b8e5ce1e7c8ab167e91b7929c432bcb7295963dff40b8ed0f4283e8af41

SHA512
e6d96dc06cb39ff30f49b67d03dc9f3ea60cce71a06c656112397ca2f2d4cc2b39e0cc009b96918c6b8fc9119f6fe53272bc52c55e5e7929231a8d533ddae8ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\newtab.html

Filesize
376B

MD5
7046770830356b65a611cd127273e396

SHA1
1d864c7dd460e904258c7ab9e442c8aa1299b10c

SHA256
2c3cc9f06568fd4be3e5ed55ad261a7083de3c30c2d1774fd80c0b8da273c6ff

SHA512
c4b1315561e8611a14453e83c1abc733ac40a8bd80c8df371918b7c69c8f7a6db2f7fc1cb08886c43cdcb86bce7008a4614d4303d21c7d12d82cdc9a2997c802

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\nlnagmokfoegpmnhfknopafjgfbccgao\sqlite.js

Filesize
1KB

MD5
20f9d535906dd908ad94fb322aab36b1

SHA1
74e16b863d7b599551c06665530f28cc5b3de465

SHA256
88696f489056aacf127be3f59ae2f243300c3f904c143347b549178bafdf4414

SHA512
a802daf6c7e061afe95c80e7a52e0eaed060714102439f47bf79a75017af3a39307bf324c4219e1f952fdaf290b2c5ac3f094327436548f7b8aff19fbc574333

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
5c12f62d0df0c441a8bb9705542bdecc

SHA1
1121ccf9d470437cbda1b8b1fce17c067ddfb383

SHA256
57d40d57a233f7a5ec8d363777d346b1be05ac06a4e01a5d33fbc33a7e324f91

SHA512
5acf1fe0256104882883e63556e94914fc634e5ca299ab8e5dde5755291adcf858915ca5c77d813868ba33bcad02551ebd890a4a06036bcc116f75de32b18265

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
919315c38b20545ee59efca1e71def10

SHA1
274329f6521f9993b628226b3c5018c021d3d460

SHA256
12630e3ea6717200540a7cd181fd1f4fe70f810f9265e1885d7b25540a94740f

SHA512
05ca36a448eabc8610347a99e620950259e7ba6e4ac48172440a741f8f68641d07df265c1c56d70a3318579164753c65bcf578a4729b3dfce5f9a0ca6ae38fdd

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
d94e5353157f3725871e486acc59f199

SHA1
b72044757bd2cd76dcde548d28602a94ead39d16

SHA256
83240498c72d30a99d84d231dafb6c1587fc11b7b9fe15e4c4ba3957c0bb646e

SHA512
4e9735c0529ba4cedfd334e3a6c368c0817dc49af6b50be05bb6c9b202b0d0c69b649e87239ed9dcb407fd6f415173249eaa620c88fcae57e5453b35be2a90a2

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\[email protected]\install.rdf

Filesize
610B

MD5
bfccdd45fe592ddede2dd05b7c249cc1

SHA1
2e4a28821eb3007f877da3e6724637abc8a5a079

SHA256
2e675505bc67dda17764b104fed88e095dabe54bcaf3603f8ca47a486a88fd95

SHA512
28a722beafa4c341dd4b1b54109c8ed811887e54721a434d8f9f86f7cd72073d57c59230adb2deeda6262d18754c8cf1d636292f425ba1dacb5af204364c873e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS70EA.tmp\settings.ini

Filesize
7KB

MD5
06919dffe261a39f8a99770b2562e4f7

SHA1
242aa4cf96602b13819b8042132c3b5e44db5bbe

SHA256
a8d60091619a0554bfebd7eee3b7baa88f89f8b3523fe8df053349ae2e1e7119

SHA512
29c4ef190b772928fea512d1559eb9bd1b53a122420a4e96b560b0e6aecd29f90f587ed18bc3719f774ad6960cb4afc7dfadcaa19def5fca8fbcbaf40746eca8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm71E5.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsm71E5.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/860-77-0x0000000074500000-0x000000007450A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads