39af0e2ac1baa5f3d4db324d78b3e6af8c8b84969a968110cec88749b5a86529

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
28/03/2025, 17:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe
Size

255KB
MD5

8ae246978095b2de8a41a27657a53482
SHA1

70ee5e5269ffa800008e5e5bb14187b9249a6ca1
SHA256

39af0e2ac1baa5f3d4db324d78b3e6af8c8b84969a968110cec88749b5a86529
SHA512

07b65f58029dd0d79ae3c1ab7774ea7a1e1322710216afd76e9895a2c70f16c8145abebce2249c5dcb3777fb3d8d207c3dde175d1d24d1b180a2547178fe0499
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5rhv7IIpZpZ+5XKf8H50aIQ2c:h1OgLdaO1TIypZWXOk50QF

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x000500000001936b-77.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2064	5145b1806042e.exe

Loads dropped DLL 5 IoCs

pid	Process
1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe
2064	5145b1806042e.exe
2064	5145b1806042e.exe
2064	5145b1806042e.exe
2064	5145b1806042e.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fglodjnkcaegoiloglfhlaighdngplda\1\manifest.json	5145b1806042e.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\ = "GeniusCaoupoinn "	5145b1806042e.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\NoExplorer = "1"	5145b1806042e.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2064-83-0x0000000074A10000-0x0000000074A1A000-memory.dmp	upx
behavioral1/files/0x000500000001936b-77.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5145b1806042e.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0006000000017472-30.dat	nsis_installer_1
behavioral1/files/0x0006000000017472-30.dat	nsis_installer_2
behavioral1/files/0x0005000000019423-99.dat	nsis_installer_1
behavioral1/files/0x0005000000019423-99.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\InProcServer32\ThreadingModel = "Apartment"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\InProcServer32	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\GeniusCaoupoinn\\5145b18060467.tlb"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\GeniusCaoupoinn"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\ProgID	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\ = "GeniusCaoupoinn "	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\InProcServer32\ = "C:\\ProgramData\\GeniusCaoupoinn\\5145b18060467.dll"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5}\ProgID\ = "GeniusCaoupoinn .1"	5145b1806042e.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	5145b1806042e.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31
PID 1928 wrote to memory of 2064	1928	JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe	31

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	5145b1806042e.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{102DA840-A055-FAFE-15E6-D18EF73A5BE5} = "1"	5145b1806042e.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae246978095b2de8a41a27657a53482.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1928
- C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\5145b1806042e.exe
  .\5145b1806042e.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\GeniusCaoupoinn\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\5145b18060467.dll

Filesize
115KB

MD5
00ce3831a16a62c6d7ea4b21049e4b22

SHA1
3e48c8d25b196d67722ed20cd36bf3448a4c9136

SHA256
d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c

SHA512
7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\5145b18060467.tlb

Filesize
18KB

MD5
d5980ff8eb0ef4276fad96fba8fc5018

SHA1
2cb05f8b43aa3ae2f5492f590997eec6ff808fe2

SHA256
ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f

SHA512
30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
db2679578fbe615a9a383dd84ba04e1a

SHA1
60f08266ab628df28f07e413f5eb2945609849e1

SHA256
1fdd5813c59c8d5a9c3ab4d26056e22901c0cf3ac765987e19ed9467a02cb31d

SHA512
6e56e3994b25bcaaeb1dccede0ae4d45235d3bd521ab8edef8f1fbd6604c78126d835443313e7c6f0f68178dca975791143d7312aa5a97a505302fb868a70ac8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
d8b3122ac57fa1413cf9370f8eafeedc

SHA1
2d61dba529e7e29d5dfdde73848e15f4931608b3

SHA256
a0e4baa84ef3cefd0f48fff861519c5befdd67c0c8427361e4f851f579bd2acf

SHA512
21ed6dfa922c1a0c314430b5c1146886d7193b1e7b98906eeebdc59f5ff2be90f0a83412264a328bd7af414df34a6785389e93bb02b7ef48f10265df51c39027

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
f3ea7d62c23e1d6dee90fd2db38b057a

SHA1
5ce007f5b90946e4435da34601ef069e0c85d141

SHA256
51421c4bd75bac2ba1003578f831034bd96941faca3026756c050ce1ed19f53b

SHA512
2e189df00e1dbaa59a9fa7560315cd1686756e9e7c5335d8c995936f7afc6c494beede5b245d647cb82fc2aead9c5088085665b31333d3c155dd663981ad5848

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
43e178830a060be44d05e908b6a06140

SHA1
5546879780d72f2020934e705ed8c5e329238e74

SHA256
570f0439b75a38035cf6e509fcb3ddf860618d2d0a05b89f94ddf0ece8c9f13e

SHA512
e7c7475d07abb79beb8acd78612d7a7c6b1f410b7efed319126c7d9e943dbb3c46d151d102c4b2c851cb3fa65b17a14f85c64c036ec97ef01e25953218db2b36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\[email protected]\install.rdf

Filesize
606B

MD5
7e95dfe243999ee8d47be2a07ce5bdf7

SHA1
72bf298120dfbb2d7107742ccd0fca322458b618

SHA256
d0b64bab70acb1516aa3ae191cbc874c7e7872ea3ae486ae6bfe58072c347d58

SHA512
4c8d65f9a09465cbeef4df66165a80788b878e47824388e12e9a94a49761b294cdb16221badac4f003d3ae3ef3a3a2010d25832a37848d177499a804aebc776b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\5145b180602581.19758012.js

Filesize
4KB

MD5
d261cb5016c5b3265cdf15342b849393

SHA1
98aedf2381e060d1e84f0cf0056911e3792d79a4

SHA256
bbc4565ece817fdd55734589491275f4075d18f0aaacf322c0bbcd5a2144b600

SHA512
12dfc0351ff643287e8aa36670ca9c6a4d9a204761bcababb013097e88a8be6e8ca3c3edf2a19e2259a89ffa23fbdba801b05a1e30427a73e16d5526e8e773b7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\background.html

Filesize
161B

MD5
788d896cb8cd45e1edd6cb1a44982010

SHA1
bb3f46571d73c1e3b8db1585402b5f842b0c7569

SHA256
655d90ecc1fbb2d1a9a855749e989d59fb4ddb1509868dc887908cae358f85f6

SHA512
6451b2c77876c12a9bcb076bd56a12777e4478107cf014683ffa96f490d1fd5a1a5191f308860489b66f80a6071b8b9b02760c45faf9719c22c7dbb57af58881

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\manifest.json

Filesize
509B

MD5
6940c265639cd0f9fa238d30928a3c76

SHA1
9b83ea5234ef6c651434bae5b33d240b08f55a48

SHA256
581f5342380c9ead513a615a012f7de837d9e28367914a091866870ef86f3c6a

SHA512
7a70f4b99c363394d9acd7d3c9829761845fc34f156841584d3d624310b42f26d550aff798bde10fe1341a12e628fc23871f451be21883a50af1ea6741b5122b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\fglodjnkcaegoiloglfhlaighdngplda\sqlite.js

Filesize
1KB

MD5
143a96ecf12a4e06cd057a51a9726131

SHA1
40512ba0d6f4ec056ef2e942dea965d88b5f0182

SHA256
d7596f0b01e00ac163205e5b08c446535e9328a6f41d88994c31b2f58d5f3517

SHA512
a05178a24f45309cd810b0b6d6870ac81aafb87488f94115eee726ae1fbfb0fbdb6bfd2901d769e11d0a1b5a3e171c7f741ee7654196e131d906c1e3072e2af7

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\settings.ini

Filesize
6KB

MD5
c5e6222a3368812f2f11fc12fa6e0797

SHA1
e62a4aefd89668b300870818ef4d46d45a8c9e7e

SHA256
30e265b2b4723836c30c5dd8c46b3520afd080589fe4ec9aca5e4eb3f4ec42a8

SHA512
68be06e3f7c58eff52e82f97c6db929082c16bae1ef102b0632fc0e70a55b31e626d10c5e28cec40c12f508f1dbc22cd792f7b7518a932efdbb29753bf0b6bb6

Download Submit
\Users\Admin\AppData\Local\Temp\7zSE39B.tmp\5145b1806042e.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
\Users\Admin\AppData\Local\Temp\nseE429.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
\Users\Admin\AppData\Local\Temp\nseE429.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2064-83-0x0000000074A10000-0x0000000074A1A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads