2e9334ae4c8c3946c14d68c32d227b0f75a6e2c4797701746afe99f999b87986

Analysis

max time kernel
101s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20250313-en
resource tags

arch:x64arch:x86image:win10v2004-20250313-enlocale:en-usos:windows10-2004-x64system
submitted
28/03/2025, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe
Size

551KB
MD5

8ae762a86b64b0a2f8b414a03c9f36ff
SHA1

8e8925325b18616998a8f068876bed112bf4a8f1
SHA256

2e9334ae4c8c3946c14d68c32d227b0f75a6e2c4797701746afe99f999b87986
SHA512

d48d7558a1fdf9d780926a554b2327544e9bb2f3a52a5a00662d93a4ce48ffc9330597cf6754c278cfb4fd888a743228606596955eac94b7d7e132ea41e2e7da
SSDEEP

12288:h1OgLdaORWctn+MEfOUgbJuMmFcouJqkm:h1OYdaORtMOUgJHJJqkm

Score

7^/10

adware discovery stealer

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\Control Panel\International\Geo\Nation	JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe

Loads dropped DLL 2 IoCs

pid	Process
216	regsvr32.exe
216	regsvr32.exe

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lipjeefmcokccgjllmilllfgbcjeaape\1.5\manifest.json	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\ = "safe save"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe

Modifies Internet Explorer settings 1 TTPs 4 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-1279544337-3716153908-718418795-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saave\ = "safe save"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\InprocServer32\ = "C:\\ProgramData\\safe save\\5nuVS.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\safe save\\5nuVS.tlb"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saave.1.5	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saave.1.5\CLSID\ = "{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saave\CurVer\ = "Safee! saave.1.5"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\ = "safe save"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saave.1.5\ = "safe save"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\ProgID\ = "Safee! saave.1.5"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saave\CLSID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\saave\CLSID\ = "{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\safe save"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saave	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saave\CurVer	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\VersionIndependentProgID\ = "Safee! saave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Safee!	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\saave.1.5\CLSID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{07A836C3-7DCE-FBB8-B9F5-58E1F643C042}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	regsvr32.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 216	2388	JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe	89
PID 2388 wrote to memory of 216	2388	JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe	89
PID 2388 wrote to memory of 216	2388	JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe	89

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8ae762a86b64b0a2f8b414a03c9f36ff.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\SysWOW64\regsvr32.exe
  "C:\Windows\System32\regsvr32.exe" /n /s /i:"" LpIlF.dll
  2⤵
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  PID:216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\5nuVS.dll

Filesize
180KB

MD5
0e093772550eb9541dd715c016b5584a

SHA1
20338dc859a5652f5661280dc508f4e5b533e76d

SHA256
028999304f35f7a6fc2cf6e360d4ea587612d63ce191fa979cc98ccca46ab149

SHA512
0030b395e2fde6bc9f70f52e71d8e87d306cff8afd2acbad725c4cc92b6d7916a38c1d6d156feaec841966492d32394982ef51989e2b8673d7c00e103f744dd5

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\5nuVS.tlb

Filesize
2KB

MD5
48e9706fe9f76731f3576122fc3e9e33

SHA1
387c8c4898ead8ace488a7df80fead429eaf167b

SHA256
7bad79916803a14ca817e5c39f5ec2f0f240044d6dc24fb4916c8fda338060f1

SHA512
e9b44a2b1b7a806066182a084ec9df81916fc6db79710256e173377e7cd64a732c006830bbe324a9a734731ecde8b8251cfa995399f6d4df5322faff99c458b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\LpIlF.dll

Filesize
203KB

MD5
41b13b132cb601ecc466654b90296353

SHA1
245258ddccb48826f22d57444f49fa30be1b36fd

SHA256
7fa4bb68c313e1090587a64b90e87bdcbc14ea3fb7c0e8cff94c657c969b70bf

SHA512
0e8de7bbe3695848e299fe3f3506f2e982a60cf0a0dd11cde86de4af67ef3c7b46458680d7bad9cedaa266ea33cb2e77f2aa83fcf1bdd20bf31d1936f2bd69a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\Preferences.C__Users_Admin_AppData_Local_Google_Chrome_User Data_Default_Preferences

Filesize
11KB

MD5
61a4cd94d5357f334613b12de580e30d

SHA1
272845b80275c631e9cfc428cc1c70bffb96e5e9

SHA256
7fd44acb7bd166a59d8d437d62ce98f1fbf852527550c1af453cf1673cb29d5f

SHA512
7e4cdc7d99e0d413a43ce5e3366d13ca3e3dab9ec368be5c32a286240e42845e6d8ab42ed04dee091899c42243279b4dc899da9082308cf7e5663e448996758a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\WiotiM.js

Filesize
5KB

MD5
66058a3192f8cc4b611ccdf4af10f721

SHA1
5e72e757a89b234d41cbf8f5e6e30680a302e167

SHA256
c6c271a2bbcfa2cd2423e465bcb0c529731193036f93c8db3733c53837379ba1

SHA512
22ada75401bd103dcfd89a3e00191287f4b5bb29506bc434ae9f2811a582204cd3b5c1b4e8e4f299286b5a3a954cf530e2441aeb46093624e1f446940a243185

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\background.html

Filesize
143B

MD5
518fe337ed850a0199e492db4a7d9cfe

SHA1
623ccde45ddf04a63042f4427ebeda15dd831473

SHA256
9f583d9d7a8f2b4a1c837d640f16d657d03d2ebc8457dec9dc4c1fabd03bb4ee

SHA512
9e7e38260edaff543d941f659a7ba3b01b3d457c1a40d8a390d2c7429e2238bf6617d433335ba54d3b96d736d81765cad578895668ec7a54622224699e6e7e49

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\manifest.json

Filesize
501B

MD5
977e11ca13c3e242d4a436e3f7a31661

SHA1
3e40072591e887a3558eada10ca5ceaef90f3118

SHA256
fcd05ee0e7ae52ad61014b65bfe87e8185feb6f6352f3103cef2d003a6b766cf

SHA512
7a23081aafd38cba0bd1f1046be3b15922448280c6a338684f7f1ff5cd938d78935f380c0860deca6a89f8eba77b0d46a1362cfc17ebcf28c0459705f7e1ccc8

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\lipjeefmcokccgjllmilllfgbcjeaape\sqlite.js

Filesize
1KB

MD5
5c16a076961dc09a17e73e0a8c2f30b4

SHA1
863562e98285cb1e9fafdfe3b0c595dfed18f4ce

SHA256
4b815dcfb10d0576b6c30346e36d09c8563b95d075124d4c62fd0ec315a5797e

SHA512
814a55e2ca8f12e92c6aa5b0a2f67617346b2e24546bc2f29091b174bbeddf56f7cb1758c2994bdc046cbb6ec51a4de0110466a133a748ee2b01ec335cfe6bfc

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
5ef38f1872a94edea5c2e9c9686a4706

SHA1
170ac1e5ab7929bb5dd4a5ff77b493387f059ed9

SHA256
c97ba2d02777baf2a156397c406f86102c505266b6cbadc1a04bdb0cd13f9d28

SHA512
0c559b7f0df56434b21a754c8e29c9f09d57a4d02e7b58f0fb1ff95316d42c2b378673b7d5bcf8acd1015a465a66a1b6e40d595648bd9d65a74509f65bc2cc36

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\[email protected]\chrome.manifest

Filesize
104B

MD5
2751eea8c302f3ba9030fe8d16b26927

SHA1
baa550cc87527fff0696459e07d90762f38d75fc

SHA256
0d37f4f48d46809dd6f086ac926b4db9abeda8d2c621787ef264d1f51b9371af

SHA512
aef08f8e08c304742192c3d1e5948ba497d2cc10de2fd45fa4e6918ded2b0461c4f262b2ed24ec5fea4dfc24e5101849c07e997f9f26ccdf5c05d2de2056448a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\[email protected]\content\bg.js

Filesize
9KB

MD5
924f7deb38077637f8eaa14956508531

SHA1
e8d7182d17a3d4fbe2b6b2bc4c8b4fe0ce5f7c2e

SHA256
06dbfbfc9e733b3594b11fb70ba7d1b826d72e3104df215749c3acb0a5b1bc30

SHA512
7fdb54f924da645176a9b27295f8fdd276f9d193009da7efa5f60b64d75a3afde364ca3a68d92441407800b3c33df6fa3e0e15682f8b3b9d6482b70d764eb688

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\[email protected]\install.rdf

Filesize
603B

MD5
dca2b94f1357fbe28d6f03dddfb960c8

SHA1
d5fe54235ec6f2fe8421ee8dca714d7c1b5f64ee

SHA256
3f4e925f4a1eefdb7563c974efbb2f4348df42c5523ebc368f394c16e720e602

SHA512
f3b091d592f5a3208c7f178f4ad664360d5a6d1f5b787a56fd642ef426dc451fa03716c37bc912ac3a7b41aca515cefd435c14a900fcd6952b52dd55fcdddfcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS6551.tmp\settings.ini

Filesize
7KB

MD5
b8dad5a250d8c594b4f5d339e22349f2

SHA1
25a8fb622bab78f5759108311f1fe66dc6d47758

SHA256
b7ec2634f1179e70aec533dd5e80b24d3177424a6baef6de2f63c6db8b2d8ddc

SHA512
fd0850799b1b2bf452d4446d2102ff7e3b0163f5b3c326b51bd3ff49881e48ffbc019142e1a274ec99ddf3be4d1570a623583c1b0e2bd1e75120360ca31a57f6

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads