Analysis
- max time kernel
91s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
21/11/2022, 11:22
Static task
static1
Behavioral task
behavioral1
Sample
c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
Resource
win7-20221111-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
- Size 1.5MB
- Sample221121-ngrd2agc99
- SHA256 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31
- MD5 0a9b435e956bfdde213943ece43e96e0
- SHA1 6103632e4984d40d37fb663fd813275afbd62871
- SHA512 25a192a992b2d81f10ae8349dd6abd8fbc6ce88ef95f813fbb8309ef68e1a47412ac6f3b192a29f910756210358084e50dbebf0912c04b8eee2392c685ecd534
- SSDEEP 24576:x0fTYgB8JTFhrylf/gv/iqWL6xTuH84z+i7vzCTogVbPmcC:x0fTxB8JTFhIgv/isxTuHJCTog1mcC
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Windows\\svchost.com \"%1\" %*" c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe - Neshta
Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.
- Executes dropped EXE 2 IoCs
pid Process 2028 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 2232 GoogleToolbarNotifier.exe - Registers COM server for autorun 1 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ = "C:\\Program Files\\Google\\GoogleToolbarNotifier\\5.12.11510.1228\\swg64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32 regsvr32.exe - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe - Loads dropped DLL 3 IoCs
pid Process 2232 GoogleToolbarNotifier.exe 2232 GoogleToolbarNotifier.exe 4540 regsvr32.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jucheck.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\VSTO\10.0\VSTOIN~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~2.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\BHO\IE_TO_~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~2.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpshare.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\plug_ins\PI_BRO~1\32BITM~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\AdobeARM.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~2.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\msedge.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MOZILL~1\MAINTE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WINDOW~3\ACCESS~1\wordpad.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File created C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADOBEC~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\WOW_HE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\Adobe\ARM\1.0\ADOBEA~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jusched.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~3.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MIA062~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\PACKAG~1\{33D1F~1\VCREDI~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\COOKIE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROBR~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ADelRCP.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\arh.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\ELEVAT~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WINDOW~4\setup_wm.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File created C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\Readme.url c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\Readme.url c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroRd32.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\MICROS~1\MSInfo\msinfo32.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\INTERN~1\ielowutil.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\INTERN~1\iexplore.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\MSEDGE~3.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WINDOW~4\wmpconfig.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Eula.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOOGLE~4.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\INTERN~1\ieinstal.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\MSEDGE~2.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Google\Update\1336~1.71\GOF5E2~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\INSTAL~1\setup.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MOZILL~1\UNINST~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WI8A19~1\ImagingDevices.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\Adobe\Setup\{AC76B~1\setup.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\PACKAG~1\{57A73~1\VC_RED~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\PACKAG~1\{CA675~1\VCREDI~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\Browser\WCCHRO~1\WCCHRO~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\INSTAL~1\setup.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\MSEDGE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\PACKAG~1\{EF6B0~1\VCREDI~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File created C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\AcroCEF\RdrCEF.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\LOGTRA~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\COMMON~1\Java\JAVAUP~1\jaureg.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\ELEVAT~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\Edge\APPLIC~1\920902~1.67\IDENTI~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EdgeCore\104012~1.47\IDENTI~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\MICROS~1\EDGEUP~1\13165~1.21\MICROS~4.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\WINDOW~2\wabmig.exe c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~3\PACKAG~1\{4D8DC~1\VC_RED~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\ACROTE~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe File opened for modification C:\PROGRA~2\Adobe\ACROBA~1\Reader\READER~1.EXE c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\svchost.com c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier" GoogleToolbarNotifier.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5} GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppPath = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier" GoogleToolbarNotifier.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\Policy = "3" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5} GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{80B84A0A-EDA4-47fd-8BE1-6B49F4197EE5}\AppName = "GoogleToolbarNotifier.exe" GoogleToolbarNotifier.exe - Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1}\ProxyStubClsid32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost.1\CLSID\ = "{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ProxyStubClsid32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID\ = "ProtectorExe.ProtectorHost" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\ProtectorExe.EXE GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib\Version = "1a.0" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ = "IProtector8" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{5D358B5C-3415-42BB-A606-E1089B674F41}\ProxyStubClsid32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\TypeLib\Version = "1a.0" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib\Version = "1a.0" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ProtectorExe.ProtectorHost\CurVer\ = "ProtectorExe.ProtectorHost.1" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6C110376-C248-47F6-9DB2-CFCDEADB6A3E} GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\ = "IProtector11" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9D932020-700E-4F0D-8446-2872ABD8B4FA}\ProxyStubClsid32 GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\ProxyStubClsid32 GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1F7328B7-E25A-4527-B24B-D9173401BB89}\TypeLib\Version = "1a.0" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{17484B9D-89FA-484F-912E-017D06C41FE0}\ = "IProtectorLib7" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610}\ProxyStubClsid32 GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{F1A383D4-0364-4092-82E0-C39DAE5D801D}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\protector_dll.DLL\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.Protector\CurVer\ = "protector_dll.Protector.1" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32\ = "\"C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\GoogleToolbarNotifier.exe\"" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A0CF48B9-DB91-49A5-BEE7-2FB45BA2F610} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1} GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{A97CA128-6998-4F8E-807E-8ED05FADAFB0}\RunAs = "Interactive User" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\InprocServer32\ThreadingModel = "Apartment" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{315A0BBF-D55B-4FCE-833E-8BAA5B6344F6}\TypeLib GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2212951C-1623-4095-906B-AC50B8F91016}\ProxyStubClsid32 GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{235317AD-6EF4-4209-9354-F88869E1A3BB}\ProxyStubClsid32 GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9891812B-5820-4A77-827E-772B200239E1} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{277FD1E8-9884-4E0A-9392-7CFF83F067B2} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ProxyStubClsid32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\protector_dll.ProtectorLib\CurVer\ = "protector_dll.ProtectorLib.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{91F39C2A-95E7-497A-A539-0AC715DC66D2} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\ProgID GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40}\1a.0\HELPDIR\ = "C:\\Program Files (x86)\\Google\\GoogleToolbarNotifier\\5.12.11510.1228" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{6EACF525-5F81-4381-9E46-DC316C39E0D2}\TypeLib GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{FBA44040-BD27-4A09-ACC8-C08B7C723DCD}\LocalServer32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ = "IProtectorLib8" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{AF606610-3627-4DF2-A6D5-32C6A355ACD1}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6134CEA9-DD6E-495C-A0D1-4F232027D7D7}\AppID = "{96FBC13C-8214-4100-88E0-FF74D7A1CB4D}" GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{2351B346-00E8-4EAC-9B75-B138B465D659}\ = "IProtector" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A45CDEEB-65F5-49AE-AA3E-9376F4806075}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DA69D3CC-7676-4A65-889F-C052977F1AA9}\TypeLib GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{BACAB2F3-7213-4865-96E9-B6B06BF49192}\ProxyStubClsid32 GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\ = "IProtectorLib4" GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{84798B8E-69F8-4846-9516-373C2996E2F7}\TypeLib GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{C7CB459A-7261-4AE6-A87A-17041EE98A40} GoogleToolbarNotifier.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9891812B-5820-4A77-827E-772B200239E1}\TypeLib GoogleToolbarNotifier.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{DD65ABB2-2628-425B-86F5-825E4A3D3AD9}\TypeLib\ = "{C7CB459A-7261-4AE6-A87A-17041EE98A40}" GoogleToolbarNotifier.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 4788 wrote to memory of 2028 4788 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 81 PID 4788 wrote to memory of 2028 4788 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 81 PID 4788 wrote to memory of 2028 4788 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 81 PID 2028 wrote to memory of 2232 2028 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 82 PID 2028 wrote to memory of 2232 2028 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 82 PID 2028 wrote to memory of 2232 2028 c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe 82 PID 2232 wrote to memory of 4540 2232 GoogleToolbarNotifier.exe 83 PID 2232 wrote to memory of 4540 2232 GoogleToolbarNotifier.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"C:\Users\Admin\AppData\Local\Temp\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"1⤵
- Modifies system executable filetype association
- Checks computer location settings
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4788 -
C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" /RegServer "/dll=C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll" "/swg64=C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\system32\regsvr32.exeC:\Windows\system32\regsvr32.exe -s "C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll"4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Modifies registry class
PID:4540
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll
- Size 140KB
- SHA256 91cb858f2a30cc23e25138d094a743206d765613c70b9a42e511caf32e8761a5
- MD5 a2a751f1f440046769828c8f27f1885d
- SHA1 c6594b688ea1cacf9ec867f5ad58c419e7440b9e
- SHA512 1250e5d378f4766bf60463f81f7a732b66d94d45d613bac2825a985837a221fd54b6fe57344aeac74f4df9221c9f28a963d8d7c54e5442b3190841e1ff28523b
- SSDEEP 3072:HiIlct9u0pRItXeqM6B2R3mSY61TBf9UXLyh+Xj4:C0cXRYeQB2R3mSj1TBaXLyh6k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\gtn.dll
- Size 140KB
- SHA256 91cb858f2a30cc23e25138d094a743206d765613c70b9a42e511caf32e8761a5
- MD5 a2a751f1f440046769828c8f27f1885d
- SHA1 c6594b688ea1cacf9ec867f5ad58c419e7440b9e
- SHA512 1250e5d378f4766bf60463f81f7a732b66d94d45d613bac2825a985837a221fd54b6fe57344aeac74f4df9221c9f28a963d8d7c54e5442b3190841e1ff28523b
- SSDEEP 3072:HiIlct9u0pRItXeqM6B2R3mSY61TBf9UXLyh+Xj4:C0cXRYeQB2R3mSj1TBaXLyh6k
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll
- Size 914KB
- SHA256 c7f7d193f353462e4a544538591d9c41bc9262e57d6a77d4b2c134fac8134614
- MD5 d0c4c5ba3a95ee1a03ab1584d3bd4583
- SHA1 a5864868ecb704a1202454dd9d2421a31a891fa1
- SHA512 f28189950afc12e60b526ff4b1528d3ab7a190564fea350e69475dd08114aabe38abc580568a26c867328c274fd3974a3b280a9b38067457bdb69f0e1fde973e
- SSDEEP 12288:8WxSDBlfvnuVv/iqfxId3L6xTnulrOIT84z+i6:Bylf/gv/iqWL6xTuH84z+i6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.12.11510.1228\swg.dll
- Size 914KB
- SHA256 c7f7d193f353462e4a544538591d9c41bc9262e57d6a77d4b2c134fac8134614
- MD5 d0c4c5ba3a95ee1a03ab1584d3bd4583
- SHA1 a5864868ecb704a1202454dd9d2421a31a891fa1
- SHA512 f28189950afc12e60b526ff4b1528d3ab7a190564fea350e69475dd08114aabe38abc580568a26c867328c274fd3974a3b280a9b38067457bdb69f0e1fde973e
- SSDEEP 12288:8WxSDBlfvnuVv/iqfxId3L6xTnulrOIT84z+i6:Bylf/gv/iqWL6xTuH84z+i6
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
- Size 38KB
- SHA256 d32cc7b31a6f98c60abc313abc7d1143681f72de2bb2604711a0ba20710caaae
- MD5 5d61be7db55b026a5d61a3eed09d0ead
- SHA1 215950ce5d40907b041346f22b4e404ee591581d
- SHA512 b1dbb67867cbb36c322bd774bf01267f56e398e364ebce4bd6f67c225c330b0b1843b06397e55f7f04dcc8d75b039083ccf08313b0ed03ecff7eb00033b0a598
- SSDEEP 384:KVnkdeF68JMVqpmXE2ljKdx1DDz8z1wBKByKoBaVAXxvhwzfYJLWEbx7:KVkd+8hOKBJqxvHLVbl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
- Size 38KB
- SHA256 d32cc7b31a6f98c60abc313abc7d1143681f72de2bb2604711a0ba20710caaae
- MD5 5d61be7db55b026a5d61a3eed09d0ead
- SHA1 215950ce5d40907b041346f22b4e404ee591581d
- SHA512 b1dbb67867cbb36c322bd774bf01267f56e398e364ebce4bd6f67c225c330b0b1843b06397e55f7f04dcc8d75b039083ccf08313b0ed03ecff7eb00033b0a598
- SSDEEP 384:KVnkdeF68JMVqpmXE2ljKdx1DDz8z1wBKByKoBaVAXxvhwzfYJLWEbx7:KVkd+8hOKBJqxvHLVbl
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll
- Size 245KB
- SHA256 40ec2b0fe7b98182d572fb5a031a1c77f5620e269fbab86d2a5afcb4499915f7
- MD5 8790afb502a5638af9769ebc0f93868a
- SHA1 465bacf4cfff60bd5de57743ce3c106716d45b04
- SHA512 80ca30c91d0d4a93830881623d72c24908551457551be9d5782ed8f6624e54d71eaa61de8dae23c627dd361eb3d038c0258bbd739b5be70bc026f27ac380ee9d
- SSDEEP 6144:LiTYaBFqqhtu/loO7WgDPDTlkNCTBgYKOkf:haBMqhtbzCToXf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Program Files\Google\GoogleToolbarNotifier\5.12.11510.1228\swg64.dll
- Size 245KB
- SHA256 40ec2b0fe7b98182d572fb5a031a1c77f5620e269fbab86d2a5afcb4499915f7
- MD5 8790afb502a5638af9769ebc0f93868a
- SHA1 465bacf4cfff60bd5de57743ce3c106716d45b04
- SHA512 80ca30c91d0d4a93830881623d72c24908551457551be9d5782ed8f6624e54d71eaa61de8dae23c627dd361eb3d038c0258bbd739b5be70bc026f27ac380ee9d
- SSDEEP 6144:LiTYaBFqqhtu/loO7WgDPDTlkNCTBgYKOkf:haBMqhtbzCToXf
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
- Size 1.5MB
- SHA256 99f24e71da17715d2d9aefec8f3a35b545918bc483c3a1e998940c562f53c830
- MD5 0ceed1d533cae0741d56d83ab5cb004f
- SHA1 f3a812a68f40a7c4d0b2135c011f86126d337d4e
- SHA512 a63e3f837dd57d7cf40cf3dd54b5ecccd27624052d3e0850110dff01d22b649a7d475d651e6501bb83043370d349defabc9f28694e41b4ab19a741a995103149
- SSDEEP 24576:3VbPmch0fTYgB8JTFhrylf/gv/iqWL6xTuH84z+i7vzCToN:31mch0fTxB8JTFhIgv/isxTuHJCToN
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\3582-490\c30f1695fec5a70fa7137cb8b9883bc5b486edd2bb58267a2646d6ea8b22ef31.exe
- Size 1.5MB
- SHA256 99f24e71da17715d2d9aefec8f3a35b545918bc483c3a1e998940c562f53c830
- MD5 0ceed1d533cae0741d56d83ab5cb004f
- SHA1 f3a812a68f40a7c4d0b2135c011f86126d337d4e
- SHA512 a63e3f837dd57d7cf40cf3dd54b5ecccd27624052d3e0850110dff01d22b649a7d475d651e6501bb83043370d349defabc9f28694e41b4ab19a741a995103149
- SSDEEP 24576:3VbPmch0fTYgB8JTFhrylf/gv/iqWL6xTuH84z+i7vzCToN:31mch0fTxB8JTFhIgv/isxTuHJCToN
- MD5 SHA1 SHA512 SSDEEP