2317496c5bf3f5efc722949e7fd198f4929f038d7d9cdc0ab4a0484ce876808b

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/10/2026, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Size 313KB
Sample261014-eks8csx1ht
SHA256 2317496c5bf3f5efc722949e7fd198f4929f038d7d9cdc0ab4a0484ce876808b
MD5 26833c0cff03dfd4b08e46cf2d84d659
SHA1 0d80ec04fcfc726eac37ba92e58f4551caa380ea
SHA512 6fdeeb8909eb0628b823ab8a9b662f9c0fdd16f6030707674763f89f768653871acc8c18802141312c487ecb74ae7a4af11ea814d20c9b5bdcd690520db4c90e
SSDEEP 6144:91OgDPdkBAFZWjadD4st0n9Cx6Oqo4MTqHnkC1NB3vO9:91OgLdajMsgNuHn79vK
TLSH
T1CA64E12139E2C8F6D2520432CE687FE5F6FAD7140F31887323DA4A1D6E7D685C12B65A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery installer spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4160	setup.exe

Loads dropped DLL 1 IoCs

pid	Process
4160	setup.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 4 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55680CD4-27F9-63B6-2066-F27755710433}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55680CD4-27F9-63B6-2066-F27755710433}\ = "ADDICT-THING"	setup.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55680CD4-27F9-63B6-2066-F27755710433}\NoExplorer = "1"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{55680CD4-27F9-63B6-2066-F27755710433}	setup.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

NSIS installer 2 IoCs

installer

resource	yara_rule
behavioral2/files/0x000d00000001c50b-32.dat	nsis_installer_1
behavioral2/files/0x000d00000001c50b-32.dat	nsis_installer_2

Modifies registry class 63 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\VersionIndependentProgID\ = "bhoclass.bho"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\Programmable	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\ = "ADDICT-THING Class"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\InprocServer32\ThreadingModel = "Apartment"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID\ = "{55680CD4-27F9-63B6-2066-F27755710433}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\ProgID\ = "bhoclass.bho.1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\Programmable	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\ = "Injector 1.0 Type Library"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS\ = "0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\CLSID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ = "ILocalStorage"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0\ = "ADDICT-THING"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\InprocServer32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\Version = "1.0"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\InprocServer32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\ = "IInjectorBHO"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\TypeLib	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho.1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\ = "ADDICT-THING"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\ProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\0\win32\ = "C:\\ProgramData\\ADDICT-THING\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\HELPDIR\ = "C:\\ProgramData\\ADDICT-THING"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CLSID\ = "{55680CD4-27F9-63B6-2066-F27755710433}"	setup.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\VersionIndependentProgID	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}\1.0\FLAGS	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}\ProxyStubClsid32	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{D2F39980-399F-492E-8D88-5FF7CCB3B47F}	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\bhoclass.bho.bhoclass.bho\CurVer\ = "bhoclass.bho.1.0"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\VersionIndependentProgID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}\InprocServer32\ = "C:\\ProgramData\\ADDICT-THING\\bhoclass.dll"	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{BBA74401-6D6F-4BBD-9F65-E8623814F3BB}\TypeLib\ = "{C2CF0D01-7657-48AA-98C9-AE5E64757FCC}"	setup.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{55680CD4-27F9-63B6-2066-F27755710433}	setup.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 4160	4656	jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe	89

System policy modification 1 TTPs 2 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	setup.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{55680CD4-27F9-63B6-2066-F27755710433} = "1"	setup.exe

C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe
"C:\Users\Admin\AppData\Local\Temp\jaffacakes118_not-a-virus.HEUR.AdWare.Script.Generic.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\setup.exe
  .\setup.exe /s
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Installs/modifies Browser Helper Object
  - System Location Discovery: System Language Discovery
  - Modifies registry class
  - System policy modification
  PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\chrome.manifest
Size 114B
SHA256 bee41dc2711d73e8b10db92e68dd895c3f3cb0f9e9000a594799980a867bd5ea
MD5 ccf58c1d792f65b273c74078d6b30454
SHA1 3713502d092939e1a36bfef18fa9b4dbad7354ed
SHA512 df706f95a55fcbe1619c4c55dd4030857dce180091168779939bf2dcbe62fc3ac5b2d43b539cf5619185e5ab50cf8fc68c5937014b134227a25861173f2d82a4
TLSH
T137B09233474F80BA27A9C886118334123A708D8680CC906570B600CC82E0342CBCCB75
MD5 SHA1 SHA512 TLSH

Submit Download

indexeddb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\indexeddb.js
Size 1KB
SHA256 ece4816739c6d6041dd16a8a955a9d7d23c20b1c4da185c883a1350ea3909451
MD5 d320b42fad012d09a251ebc4f755a2be
SHA1 011a66274d5507202805e488ea13a3ce13b88d6f
SHA512 f25115ba84bda09a38303e2d19102672cab58f38be87cc12e7de24e769644f41fc7d6fe596208419c62bf9314c2092f0abe491c41e4d1236e4c374bb219eed58
TLSH
T1D121A259B78EB43A943E712B146F7644302BD0508D1C8831EDF4D6E60E7441F9B0E5BC
MD5 SHA1 SHA512 TLSH

Submit Download

jquery.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\jquery.js
Size 91KB
SHA256 3739b485ac39b157caa066b883e4d9d3f74c50beff0b86cd8a24ce407b179a23
MD5 4bab8348a52d17428f684ad1ec3a427e
SHA1 56c912a8c8561070aee7b9808c5f3b2abec40063
SHA512 a693069c66d8316d73a3c01ed9e6a4553c9b92d98b294f0e170cc9f9f5502c814255f5f92b93aeb07e0d6fe4613f9a1d511e1bfd965634f04e6cf18f191a7480
SSDEEP 1536:k5RKUpVgklsdruLP/l+0fGzA8gmtasgx/c9Rzzi4yff8qeLvHHEjam7rSnmBn9gn:Ee8bbGzA81+xRRi1Z3
TLSH
T18193E7D9B2D6716387B731BC50AF510BB13698AA784C8C50F068D8E4BE74A48907BF7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsext.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\jsext.js
Size 6KB
SHA256 6d6868b0d6ec25f7c9342c3a24736156cba92b5f00feeae3bfe976d85444981e
MD5 6d5dece710c1198ecdec8b69ac096364
SHA1 046cb1d0685d3d8c3f7fd83d1008d056f2cd9547
SHA512 ffb155b2d4e730914b9fd253f2c17ddcee65a578b736848c0fbb1a8662db6df91cb75a2a50c61549e4a01f378a7d472176ce4dca19a73aafa395465bccd6a745
SSDEEP 96:pGOMrDvuvU7Gm1SVqN6PtQh6KMWEv9/WYM4iwHFxg/g0Sdjv133zPCoal4c0dm6:pGEvU7GSSVqN6VQhBMzZ7vbhp3g4c4X
TLSH
T14ED18449EF8EA0454171EB22946E0386E0BEB2E35CCD8C57ACBC576D4820B93584DFBD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\lsdb.js
Size 1KB
SHA256 db01f4cabdc4389e5f9ed2051bc3dbde7e319ec1f0b7ed7fa739cb0b546978c8
MD5 b8c8ea605eeba81474cdc0731ad55999
SHA1 5c812468f0d2614647f2b07eec7e514e2ee4cf9b
SHA512 e880bd4cb066610256fbb11883204d22723da5a5d0fea5af01eaa8c7e81a94009f856fb6ade65f910359408c6f045602035adf5702246f8d7af7826cecb006c0
TLSH
T1D241F21EE60F90310473EB37097E11E6349FD4538E8E8D9A8DF29352415063B5B91EBD
MD5 SHA1 SHA512 TLSH

Submit Download

prfdb.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\prfdb.js
Size 1KB
SHA256 e42766390d22909636611e932a2d119932b1477197d91781f9c56c2be8e91cdf
MD5 67b70f62d42ed3ff75d983df7542deba
SHA1 921ef8df363d587cef0e7fe236018867dff99327
SHA512 c349696c9b0b9dcce5d455d51a31a8bb08b421840abe44558b1f801115d59eae96e563381a3d888a143b9e4d4c2d4be6e09788f0e4e6720ac4d92cea32d8079b
TLSH
T124319916D50B94711436E33788AB118AE52FE4B3ED5FAC5A5DF59352002873B44C2D3D
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\sqlite.js
Size 1KB
SHA256 a27fe5076f1558cbaa8dc7079721c326f0afeee68a0f173e142b8daebcb81dbe
MD5 c00bef3b4976a0b94e6ff4b56b374912
SHA1 39f951f220b631aceed4bfcaf6ce92a4de9ca02b
SHA512 3052c10439dabe9400020256e577f1525644d03e8e2c6bb1f21598189639686beeb18cefd7226fd612981a09c650cc1a5161410ca54c79c7e3f74b6e2c49ec6e
TLSH
T13E31AC12E70F5531623B633B4D3D1281B85EED93CD4B9D863DF953624829E399049DBC
MD5 SHA1 SHA512 TLSH

Submit Download

wx.xul

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\content\wx.xul
Size 228B
SHA256 80291b384218c8576a4bc284dfb00bdc4155bc9a976b95d57e9ce325e185c900
MD5 39e92c4547dc5cfb6a94c3e0ab5ceb38
SHA1 5bf2a8b96fc31b9dc2d09e18da552199bb03a822
SHA512 f2eacb1a5b5be48ac68a36d451cbcb508ab5eac8768d9380ccbcc342b8c625c382455e2582a45f20db030b77e977d2e2d6d3632d80c5c8752b81433bb8663f13
TLSH
T189D097862A0BC4B20E42DCB821B7C001B32262064290A005B1CC02872350B8C4138B74
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\[email protected]\install.rdf
Size 677B
SHA256 9aa9d5ba3c06c7f4206d8d8c40f667d529bbebec22fdef3a901d90cbf8f2642e
MD5 7c49a3785712c57f08b64aa26a4d5ad9
SHA1 a9392970ec18f836657dc55549ba1e2093f0370a
SHA512 eccfbaa793e70e750607561c7b52919541fc3490b0ab4c5cd4b256eea5dc16f6714bdccb5e76bad5e7467b7fbe0d1f65c6f629df2a7f6901480678c8874996e0
TLSH
T140019E468942BE68E2A3CB223DB15048F2741BBE81069088FD8F1D034B5C2DD42A7753
MD5 SHA1 SHA512 TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\background.html
Size 5KB
SHA256 baa7134ea10be2a0dce27e32e3cfa865530300ed68d152695afc4a46de231288
MD5 84cae952061bda4dac1ea80e57ddf406
SHA1 049c19d2c7b9c8d57e9924ecfd11bdbddaa668a7
SHA512 ea83ddf8ed8cc4a9d757e3c05c65f6e23d88b9982b1126b9d5b9e253d13e98fbc0a0ecabf363794c50171b19f7b7b9be938314a310331cb35aaa63b4ef2b72e2
SSDEEP 96:XGm1SVqN6PtQhZiKMWXKrwlEM+tAAQXcqiwwZxxeH6DJAT6Gv133zGCoel4g:XGSSVqN6VQhZZMEKrJqHi66DJAT6M3zV
TLSH
T14CB19509FE4FA00580B0DB19946D4346E03D76A35DC8CC77AC957ABD1864F972C4AEEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bhoclass.dll

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\bhoclass.dll
Size 137KB
SHA256 7bf09b5c2a9b6348227199c1b3951b57907ca6a5c215a04ad8d5e43232f5b562
MD5 ac13c733379328f86568f6e514c2f7f8
SHA1 338901240fedcef4e3892fd4c723c89154f4de05
SHA512 35f69a82694a2ea4268a3dde7940af6bd1c87a32d93a72723464f90e4e818805be9e80872469d1cc29150a9aac872fc78613a584baa1327dfa8478c2de5672c4
SSDEEP 3072:7GcXFR07Alejy/1zn9hpgYmliR+x1edhBobHV59eDMt:6cVRkjYnOYmliMLedhBqwD
TLSH
T122D36C1232D0C032D2AA103E8926D2A25BBF7D71DCB59A4B7F8837AD5F71791DE25306
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\content.js
Size 387B
SHA256 d0f0316834ded79bf541ae636b1243ef08053fae7acfa7818462c6526d4020b4
MD5 a5e34df42f95af0e43bb9faf155503cc
SHA1 2116d5fa332bfdb192020e6ff038287d88a65de4
SHA512 88bb2ebccd4f57a48232896e47df1e3c17f9e8de1f8fb16b7d5e0bb0028321378c8577fc0efd8377027f88ee85e1ea4c7a12e11b432155e01bd657a67473e98e
TLSH
T1F1E0D8DB3ED1D43943EA8ACEF5BAF724E5A214199C04F016C4C4DC1C6524FED44AAE8D
MD5 SHA1 SHA512 TLSH

Submit Download

lbgleooebacinejllmempmkolmegefhp.crx

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\lbgleooebacinejllmempmkolmegefhp.crx
Size 37KB
SHA256 7abc76a20cf352d9a7fa4a9bba302e3afb9ca3c681ee80ea7c3bc19b96f4921b
MD5 5dfe3cc10ed620f87aea93db52a5250b
SHA1 1c4c22ff9b71dd8f944e446137fb4eb9947e755b
SHA512 03d2fdbacb7b042f7ea53dd671a8b44cdaa237374afc89f95fdb3492cdcf6ada563ca3d475c8e8bfb409197ef079606ff16787efdfdc3e40c299612d88aedc18
SSDEEP 768:vYw6oIjdrXZ+CAXsoNZoQ9cOJ5S27nGZ1mTbTM:gw6oC9oXsokQ9cOJ5MZ1A4
TLSH
T1E403F1D98B3F40EDEDC3E53A418361E3A47F2269E905B62698CB487D5D7739053019CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.ini

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\settings.ini
Size 610B
SHA256 00bacf931c9730a5643ac8c2038d27978d20c00483f9cdd2439a1d821e1de2e1
MD5 555f6bfeeda7f7377c6579cc3396e0f2
SHA1 f8042bca00c55f20503b4f86e6f4f00d1d6f5d00
SHA512 26509047bf0b7e3cca47b6ce66a62aade6f0be418add7a2fb01d14f48f3e559cea173cec281af53e68fec6af7865acca3fd9e665209313b506a8269beabfbe16
TLSH
T169F0028A2CD5697C14C9D98278D900C3BDA141B28F9C146394EA308C4591A5C2765634
MD5 SHA1 SHA512 TLSH

Submit Download

setup.exe

Path C:\Users\Admin\AppData\Local\Temp\7zSA2BE.tmp\setup.exe
Size 61KB
SHA256 15c0e4fd6091cda70fa308ea5ee956996f6eb23d24e44700bd5c74bf111cf2aa
MD5 201d2311011ffdf6c762fd46cdeb52ab
SHA1 65c474ca42a337745e288be0e21f43ceaafd5efe
SHA512 235d70114f391d9e7a319d94bdfc49665d147723379de7487ef76cfc968f7faa3191153b32ba1ab466caeeeeef4852381529a168c3acca9a8d5a26dfe0436f6b
SSDEEP 1536:ELXB65939tY6HBg4sXJ94Romu/l46+mrCj/LnV8G+:ELk395hYXJ945w46+LnOl
TLSH
T11053D02A32C0D8BBDAA7063099B7A779E3BBDB001320536717645F6F1E35093CD266D6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads