303a46a9e66d920eb382c765a8639343f752c5519524f47a6c4265f489d66cec

Analysis

max time kernel
103s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
01/04/2025, 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe
Size

255KB
MD5

9a5c38e4816242f194c1052d2f72ce31
SHA1

eeded7771b8bb0807b0bc70989099ab1ca3ec49e
SHA256

303a46a9e66d920eb382c765a8639343f752c5519524f47a6c4265f489d66cec
SHA512

2074f77775ae16554bdb742f94f9044233af21c1c18524306f1758bf44c0795cb13b114fddcfc8517c35d0486e7f95945e4899d9c2d72219eed3febe72931512
SSDEEP

6144:h1OgDPdkBAFZWjadD4s5M2/ivSf01z7B55j2hwvEUt1dZzd:h1OgLdaOv/CSf01f3BtdJd

Score

7^/10

adware discovery spyware stealer upx

Malware Config

Signatures

ACProtect 1.3x - 1.4x DLL software 1 IoCs

Detects file using ACProtect software.

resource	yara_rule
behavioral1/files/0x00070000000242ae-74.dat	acprotect

Executes dropped EXE 1 IoCs

pid	Process
2444	514032ab7e790.exe

Loads dropped DLL 3 IoCs

pid	Process
2444	514032ab7e790.exe
2444	514032ab7e790.exe
2444	514032ab7e790.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\mgllpppjdjbildeeojdlcomgkhcgopma\1\manifest.json	514032ab7e790.exe

Installs/modifies Browser Helper Object 2 TTPs 3 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\ = "PieckNsavvEoIt"	514032ab7e790.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\NoExplorer = "1"	514032ab7e790.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/2444-79-0x0000000074B20000-0x0000000074B2A000-memory.dmp	upx
behavioral1/files/0x00070000000242ae-74.dat	upx

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	514032ab7e790.exe

NSIS installer 4 IoCs

installer

resource	yara_rule
behavioral1/files/0x0007000000024295-31.dat	nsis_installer_1
behavioral1/files/0x0007000000024295-31.dat	nsis_installer_2
behavioral1/files/0x00070000000242b2-103.dat	nsis_installer_1
behavioral1/files/0x00070000000242b2-103.dat	nsis_installer_2

Modifies registry class 45 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\InProcServer32\ThreadingModel = "Apartment"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\ProgID\ = "PieckNsavvEoIt.1"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\ProgramData\\PieckNsavvEoIt\\514032ab7e7ca.tlb"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\ProgramData\\PieckNsavvEoIt"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\ = "PieckNsavvEoIt"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\ProgID	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\Software\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\InProcServer32	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B}\InProcServer32\ = "C:\\ProgramData\\PieckNsavvEoIt\\514032ab7e7ca.dll"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	514032ab7e790.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	514032ab7e790.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 2444	208	JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe	89
PID 208 wrote to memory of 2444	208	JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe	89
PID 208 wrote to memory of 2444	208	JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	514032ab7e790.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{95ED55CA-FC4A-1ED7-EE31-E3E770F5C89B} = "1"	514032ab7e790.exe

C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe
"C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_9a5c38e4816242f194c1052d2f72ce31.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:208
- C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\514032ab7e790.exe
  .\514032ab7e790.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\PieckNsavvEoIt\uninstall.exe

Filesize
48KB

MD5
f3c79bda3fdf7c5dd24d60400a57cadb

SHA1
1adb606aaeedb246a371c8877c737f0f8c798625

SHA256
a76272ed3bbf23308782a308d428ee805ec77fbb622a830af26cb0ddbbf7377b

SHA512
c43cb957bdea357bd016fe03a8004a48d8117a12106f62876394feba05ad01a321ff6017ffb7b926cc77712f5ab63ea2e4b169a419c444c8f62aa4933f289935

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\514032ab7e790.exe

Filesize
71KB

MD5
b78633fae8aaf5f7e99e9c736f44f9c5

SHA1
26fc60e29c459891ac0909470ac6c61a1eca1544

SHA256
d205693516dbaf34cfbd216e825190de4de1412e861bc9cb30ce863907b30d22

SHA512
3885b609269b26918ccfcd9069181168c12f4271b6bdfcc51afe176b2dd242d4c0953ac1a4ddaf25abcfaf28a0b694a6269d96ae39bb7b2db2f0140d2d60cd43

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\514032ab7e7ca.dll

Filesize
115KB

MD5
00ce3831a16a62c6d7ea4b21049e4b22

SHA1
3e48c8d25b196d67722ed20cd36bf3448a4c9136

SHA256
d4bb7937b36973cbf3b12c9500c25ed34103944a69bad9162f3b98f39474529c

SHA512
7633071b26d802aae1250111baa40e5158fb1a1639d76098f2ecd6263adf0e6371d5e9a70d9005b267cb907da84235f4e361f8c8a75b8adbd19a049ab1227619

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\514032ab7e7ca.tlb

Filesize
18KB

MD5
d5980ff8eb0ef4276fad96fba8fc5018

SHA1
2cb05f8b43aa3ae2f5492f590997eec6ff808fe2

SHA256
ac3a1daa32b1c489f9c2f4413ab35c4fc90b54a52ede0fb53276666e6eeef16f

SHA512
30404f467dd727a7de132fb08cd3c88abf5fb2e7ef18f24af5371b63fd106d6d5757061ec55c7b54daf9844100280670bf2b22a71c89b160048552b5eec12d0c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\[email protected]\bootstrap.js

Filesize
2KB

MD5
59bb4753fe8fe1d91ba6207030ed72b2

SHA1
ff40c20e5d246260146618650cb7a4b8d5863d93

SHA256
45a8ec13d1a071075d64209c5d83e521c77c19f155a4f8e7860786bae27b854e

SHA512
47b5e00e4d3ab32b22ebbd9804ba99c89b9d261b148768d7823ad0c388a1341712923362e636ed2698e44fff0fcb640e57964bcdcddccc1ebaccba2f3e9f50f4

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\[email protected]\chrome.manifest

Filesize
116B

MD5
4ec9c3ed75d5366a35c5d41bedffe23e

SHA1
ddebf2ea805f5fa4ef29b26f833db2509f6d2e7e

SHA256
094d4ee5e11aaaf094485eae9f3e06fc94f4a12037c392c3b59edb2660ebb7f9

SHA512
f21fa6c8d6aea0f7e6ebdfd084a2a6df80b345dd05dc47d6cef1133bd6e3da0dc489f033f762178e29af10d24034896dd58feb1c67e2e40da10a7b7d33f671f0

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\[email protected]\content\bg.js

Filesize
8KB

MD5
262ad5bc814dfd15c1b71f3e1a39b776

SHA1
f6a2f7685012e489cbf7f91f9f73a48a7f6cb428

SHA256
679ccf7c5ef0fb561c0dfbc28fcbb7467a5f2a2721c2c0bec42d21a1fb1e6f39

SHA512
5b9ecd64564c2dd8d70d488f948d56e89a2284b5265e9318d7278cb673f7a1e028187184bf80922a1fa454967484d9fc8d293c18cd849219c3474bc828045633

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\[email protected]\content\zy.xul

Filesize
225B

MD5
65b0328431b145a11ab580be4a25bd2f

SHA1
46d2f7b24157937df7104f555bc99a2432cafddb

SHA256
830133d4e5343b9d2982d0b49f36ba0b1447121ebc9d3a01428841f137209163

SHA512
a00234e3da8841b7b18c83a04ba36115e6657d27a882b4dfa9684b52de7dfeb76d8b297b46aa20ebaa4b31a92eac975af5ab7a4c1309f6f7cf55324edf120dbe

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\[email protected]\install.rdf

Filesize
607B

MD5
e7fef9e7697d78429b47583f0b2d206b

SHA1
15b99cecb6d6702f2d8e188f7a43fe946aa4d351

SHA256
3079aba7ac753a9472d9aee7e0018dc33945cc63819cb59b969022ea3b32561b

SHA512
d67722fdf6b1418553e9c7155d8c33c4e79d262d4303f176b587739aa907e30078f6bb1ef73c5c36d8a5b72afad35eba283789b187c82d35b02257c0c72e9f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\514032ab7e5c52.58883430.js

Filesize
4KB

MD5
74259133cd6151d31b4e8e951c840e85

SHA1
2b24df0bf03f3b497e48eb253e2eb88048a55345

SHA256
670e8240fad4456dfea5eb3ab67c8320a59d1f8eeedb5730b681d5fb910e95b7

SHA512
6b261c9f0f727d723cd48995a28562367cd389081969068427313289fae3dadcc3886fbe3e1d89ee474b3ff84b57e7188c242c32a84231ec1e7f97c397049897

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\background.html

Filesize
161B

MD5
41563be932675c06bf321ca1e970a8f0

SHA1
6594ba097a14f71c1a2a62d3c8dc7deeb2fdd93d

SHA256
9ae592110982828ab9dfe40e64a0a043074c8feda992f860fe50fe6d62c76345

SHA512
7d14a13181eb53442ffe815ab37ca19ee8fbd0d65ee70f6dc001a1fe50b86a6228db1ed61219bf23969f05436abf6709d38ccd1ecb74d5f6976dae784cb7140a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\content.js

Filesize
197B

MD5
5f9891607f65f433b0690bae7088b2c1

SHA1
b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de

SHA256
fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b

SHA512
76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\lsdb.js

Filesize
559B

MD5
209b7ae0b6d8c3f9687c979d03b08089

SHA1
6449f8bff917115eef4e7488fae61942a869200f

SHA256
e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704

SHA512
1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\manifest.json

Filesize
507B

MD5
8bac29bb0f0a379d2ec5d419e7afa2f5

SHA1
b544f5065bfde79576703b0beb3f9cac87b02c12

SHA256
72391fb4b8d6344c9e683a2f80527998c3fe869ba07747163b472cad66ce7a69

SHA512
f6f2a7caf9127505e49b909cf94b47718581d6a4c0cd6f031e3b79623945284aa110c3a81116de2b94ded7cd7cc7ae834dafb1976855a9ef4bcf59a221a7cf5a

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\mgllpppjdjbildeeojdlcomgkhcgopma\sqlite.js

Filesize
1KB

MD5
3247cb75475ab045bf374f4422447855

SHA1
64e24037bc4e93993b9efd010983cde8a6beecca

SHA256
46822adc310adc47b28b7f695789e0d3d4bc2366ef94f8f41dd7b4585bfbd058

SHA512
8213e059f0ab5c8ba7ea351ac04fbf10e488aca1198bd0859787963ef053d904b15a0c5e67772e9b3442b640a473b714a51ce883c634f681d07f75bd4d78a37f

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS589F.tmp\settings.ini

Filesize
6KB

MD5
16135b081bdbf6ee0a2e4d1ad564b9af

SHA1
a04c773cfeb88870d0fea3d3c40c570737c05f14

SHA256
702c467d86ef10ff73f6f5363e5ac1b32d40f7533d9e973d5af6341a5d983e41

SHA512
84313bce8933609e1d8fad5e0686ccc4ff0772ac6bb57abcb4f78fb42ef669ef482b56bff7c6bcf8607244dd4711d8b318b45f7200aa0bd291c8dd57fb7e7eb0

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc597B.tmp\UserInfo.dll

Filesize
4KB

MD5
7579ade7ae1747a31960a228ce02e666

SHA1
8ec8571a296737e819dcf86353a43fcf8ec63351

SHA256
564c80dec62d76c53497c40094db360ff8a36e0dc1bda8383d0f9583138997f5

SHA512
a88bc56e938374c333b0e33cb72951635b5d5a98b9cb2d6785073cbcad23bf4c0f9f69d3b7e87b46c76eb03ced9bb786844ce87656a9e3df4ca24acf43d7a05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsc597B.tmp\nsJSON.dll

Filesize
7KB

MD5
b9cd1b0fd3af89892348e5cc3108dce7

SHA1
f7bc59bf631303facfc970c0da67a73568e1dca6

SHA256
49b173504eb9cd07e42a3c4deb84c2cd3f3b49c7fb0858aee43ddfc64660e384

SHA512
fdcbdd21b831a92ca686aab5b240f073a89a08588e42439564747cad9160d79cfa8e3c103b6b4f2917684c1a591880203b4303418b85bc040f9f00b6658b0c90

Download Submit
memory/2444-79-0x0000000074B20000-0x0000000074B2A000-memory.dmp

Filesize
40KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads