1d1a6b6bfa102e522593552f9739760e199eb9246909f393b76e40366e37e1d7

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 13:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe
Size

255KB
MD5

8aba1144327c5b361feb48f4566b6a4c
SHA1

674148585ebb3dfa6b22e900ae32ab58bf6939f5
SHA256

1d1a6b6bfa102e522593552f9739760e199eb9246909f393b76e40366e37e1d7
SHA512

a7c61c0603afa4847f8ea792a2387983cbb477752d1d32260315e4eb26428db9035d16833361027c647e490b95ea9e208b93d3a6788aafe1de1fadabb0e3a314
SSDEEP

6144:h1OgDPdkBAFZWjadD4s52T5R5+s84ecfFELXRR2:h1OgLdaOW5R184T+j2

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x0005000000019278-77.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2252	513cc36ad643a.exe

Loads dropped DLL 5 IoCs

pid	Process
1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe
2252	513cc36ad643a.exe
2252	513cc36ad643a.exe
2252	513cc36ad643a.exe
2252	513cc36ad643a.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ojehffjcghnjckgkglpkhibpedcmmlfh\1\manifest.json	513cc36ad643a.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\ = "Broowise2suavve"	513cc36ad643a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\NoExplorer = "1"	513cc36ad643a.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0005000000019278-77.dat	upx
behavioral1/memory/2252-79-0x0000000074A00000-0x0000000074A0A000-memory.dmp	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	513cc36ad643a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000016d6f-33.dat	nsis_installer_1
behavioral1/files/0x0006000000016d6f-33.dat	nsis_installer_2
behavioral1/files/0x0005000000019360-99.dat	nsis_installer_1
behavioral1/files/0x0005000000019360-99.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\InProcServer32	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\InProcServer32\ = "C:\\ProgramData\\Broowise2suavve\\513cc36ad6472.dll"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\Broowise2suavve\\513cc36ad6472.tlb"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\ProgID	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\ = "Broowise2suavve"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\InProcServer32\ThreadingModel = "Apartment"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB}\ProgID\ = "Broowise2suavve.1"	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\Broowise2suavve"	513cc36ad643a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	513cc36ad643a.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30
PID 1460 wrote to memory of 2252	1460	JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe	30

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	513cc36ad643a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{51AC46A0-E003-72A3-BF63-6CE50852C2EB} = "1"	513cc36ad643a.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8aba1144327c5b361feb48f4566b6a4c.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1460
- C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\513cc36ad643a.exe
  .\513cc36ad643a.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2252

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Broowise2suavve\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\513cc36ad643a.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\513cc36ad6472.dll

Filesize
115KB

MD5
00ce3831a16a62c6d7ea4b21049e4b22

SHA1
3e48c8d25b196d67722ed20cd36bf3448a4c9136

SHA256
d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c

SHA512
7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\513cc36ad6472.tlb

Filesize
18KB

MD5
d5980ff8eb0ef4276fad96fba8fc5018

SHA1
2cb05f8b43aa3ae2f5492f590997eec6ff808fe2

SHA256
ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f

SHA512
30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
48371648404f928cc15ff3376f02f4bb

SHA1
2b3654ab2b006fd76e68735024f1fa4739584eb4

SHA256
568ff354adfc90bc3bce5e29f4dc39fda50851e889185234547badf87dfc66d2

SHA512
aff0f627cbe498cdd1c9fa7f3a523c4abada2592c59e24b2385f2510337946410ef62decf5a94f1bd6fc3be5a8f6612811c446ddb3bc4010e9bec5a7cb12cb8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
b88eb88cef266d332d8c3f1c58c5d055

SHA1
b63d3423d482fd2b0ae33157650121b1b4ad076b

SHA256
d05f2ccf382232a7e75c8503c9c806871b569527e560823654e471e7234542cf

SHA512
dc411748ebb1c5092c40d1a165ce08b7df1b31b735761bea567378cf15cec6722b7e04b66814ae4d8e38ef3873cb633413a46352111877a2cc184ae6b1a4e12f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
c90ce1c704d2f7a7dfb304951cea42b3

SHA1
f936107b5be892596d32f45c6f6801f76c078772

SHA256
425ce54630d9ed242b4e359689ebc0cd38fa9d498f10fc175dc94195f1134e1d

SHA512
972cc8e201d7e055af8402b30fefb64cd8de12b57d57b9262fe80554c07dae6050f88d55b517a07ac03d9279ba8da6f67b66a466d6a56e5b508ac93e410cc713

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
13b753aa2580881e0162eccd06ada9f3

SHA1
9ec080b03a91533e52aeebedca4483c34b2884be

SHA256
b3b13249948f5222ab5a80eadb29862f018f116700a4c567053208fe8408e6f0

SHA512
a9202d293d6ea0eecc32a6622b71dc7885f90b79da166615dc91ef8cb371b74b5c31081661ffe998d64686a5332e447474030d60c15837a1b1f3f0c689479d10

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\[email protected]\install.rdf

Filesize
605B

MD5
b66878b07db92401a6760e99774556d7

SHA1
7d900dccf81b3b5d5220c30f8b64c777e1e67de2

SHA256
4e6291b7f57ee234477b91a637dbe4b08eab9b9c5fa8c28a5dda6b5c4db4d7b5

SHA512
308a2bf96d44b6a9a3807a09c20ba47ec1407d4ae81f4e33b8b9a32401bb54f88cd081884f7391877b7f77b4c91cdbbbe00320aa0155caa0f982ae72cc750ae8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\513cc36ad62299.89004314.js

Filesize
4KB

MD5
ef5da73e76282c34edc9345e0b692d91

SHA1
5df98585f3de8bbeb1b1307f6f452396fec778c9

SHA256
c29a279c09d0a262f3c5c178505157f2baf652c01e69121b22ca33847f000127

SHA512
1fe15c5c5d697a3b7a02007491e88550663dac6a63434b43724b665f1a6c1aa3531846b1e81b5de229e00b571ecd6399ceb28ae42c4fe0ed32df0f7a9eac8521

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\background.html

Filesize
161B

MD5
d7e748434345143bb97a68450dc068d9

SHA1
344f29aa2165bdea231dc0cb2a5765ad98dc5edd

SHA256
2b0056a5089608b3f36f486b3ca3381dc6d00735e7a6ee9ee67416596a87b437

SHA512
55a444a4d28d0b563c9064095c72cf1a8cf4ef6dad926c4ccd5939549adc326fadfaba677ec833646eff28142fcb13bb703f9af35a19a6703afaf960de0a96f9

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\manifest.json

Filesize
507B

MD5
978ddf5044453005b9bc733d9afd379d

SHA1
deaba58bf8866636f5058bd915133687c930c47e

SHA256
39a06af04e60844cb910ca1aaf832e8ead1f35ca4168fd5ed4a49dfe34557e22

SHA512
591f183b9b3a9fa47bd7359536f1900a92d594c589d6470a7d457d24f721d430b787007b4758e41b44ec54347f09b35c25ad1146f631dcadf7e7aa3f8b34b3ce

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\ojehffjcghnjckgkglpkhibpedcmmlfh\sqlite.js

Filesize
1KB

MD5
578687607daff29697d76de92da10f9d

SHA1
dfe4beed38312fec2aecf3c324456dfa482a8096

SHA256
13c7ff9336b1252aabddf841df4a8c3aefb0b27cc63e5fc196e98c0639103a06

SHA512
9df209bf69d75c39db256fc5b7ba943250d1fdf456fe5b3bcb7a522af69fae5adb95ffd6b830414c2a63b9082d50dee54cbe5b87670ae4a4eab81591a6ad3982

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSA785.tmp\settings.ini

Filesize
7KB

MD5
b9fab5eda53431a55d7e34a4451b355b

SHA1
fb7527cb374217199b0e69c482c2d44d60e7bada

SHA256
ce017385f0c6e751f7ae4618f9330bc2df3c771907bc787dfa29a1c1dc2d36cc

SHA512
008907ec0fdb4f9edd19814d0b4a35561826c75d42220fdf139577ffc4102d8b8a6a3915f475fd6b08a882fd48b9edbc4b7942f388b735ce689c8edf2475b49f

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA803.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nsyA803.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2252-79-0x0000000074A00000-0x0000000074A0A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads