Analysis
-
max time kernel
134s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:49
Static task
static1
Behavioral task
behavioral1
Sample
839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe
Resource
win10v2004-20220812-en
General
-
Target
839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe
-
Size
2.1MB
-
MD5
3c6edead083c6350dc4f91cc7502e878
-
SHA1
108c45ee18227cf4ae979b304851677268d58543
-
SHA256
839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2
-
SHA512
dc5f6ad0e6c393c32e0618299738736b9be6b2792ceafa447e79dd20ad08ff4d62d1f1e28f7e84233fae5812f4f787f7215700834830e7a5f66b5962ce0a2e92
-
SSDEEP
49152:ak3CTgWIdEzM+B5tWTdObKEajA6sAVi3wbpl2gV:IgW60MQtW6KEBzAV8wbpQgV
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
zZxNKlENvi1.exepid process 4068 zZxNKlENvi1.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\SFL0aWhY3m.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
zZxNKlENvi1.exeregsvr32.exeregsvr32.exepid process 4068 zZxNKlENvi1.exe 3408 regsvr32.exe 4492 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
zZxNKlENvi1.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hikcjgoabingefihaglbbjgolblkkomf\2.1\manifest.json zZxNKlENvi1.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hikcjgoabingefihaglbbjgolblkkomf\2.1\manifest.json zZxNKlENvi1.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hikcjgoabingefihaglbbjgolblkkomf\2.1\manifest.json zZxNKlENvi1.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\hikcjgoabingefihaglbbjgolblkkomf\2.1\manifest.json zZxNKlENvi1.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hikcjgoabingefihaglbbjgolblkkomf\2.1\manifest.json zZxNKlENvi1.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exezZxNKlENvi1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ = "SaveClicker" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ = "SaveClicker" zZxNKlENvi1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\NoExplorer = "1" zZxNKlENvi1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
zZxNKlENvi1.exedescription ioc process File opened for modification C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.tlb zZxNKlENvi1.exe File created C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.dat zZxNKlENvi1.exe File opened for modification C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.dat zZxNKlENvi1.exe File created C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dll zZxNKlENvi1.exe File opened for modification C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dll zZxNKlENvi1.exe File created C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.dll zZxNKlENvi1.exe File opened for modification C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.dll zZxNKlENvi1.exe File created C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.tlb zZxNKlENvi1.exe -
Processes:
zZxNKlENvi1.exeregsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration zZxNKlENvi1.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration zZxNKlENvi1.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exezZxNKlENvi1.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ProgID\ = "SaveClicker.2.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32 zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32\ThreadingModel = "Apartment" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SaveClicker" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\ = "SaveClicker" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID\ = "{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SaveClicker\\SFL0aWhY3m.tlb" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ = "SaveClicker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\SFL0aWhY3m.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\SFL0aWhY3m.dll" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ProgID\ = "SaveClicker.2.1" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\VersionIndependentProgID\ = "SaveClicker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker" zZxNKlENvi1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1 zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID\ = "{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}" zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Implemented Categories zZxNKlENvi1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker zZxNKlENvi1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6}\ = "SaveClicker" zZxNKlENvi1.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
zZxNKlENvi1.exepid process 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe 4068 zZxNKlENvi1.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
zZxNKlENvi1.exedescription pid process Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe Token: SeDebugPrivilege 4068 zZxNKlENvi1.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exezZxNKlENvi1.exeregsvr32.exedescription pid process target process PID 4040 wrote to memory of 4068 4040 839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe zZxNKlENvi1.exe PID 4040 wrote to memory of 4068 4040 839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe zZxNKlENvi1.exe PID 4040 wrote to memory of 4068 4040 839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe zZxNKlENvi1.exe PID 4068 wrote to memory of 3408 4068 zZxNKlENvi1.exe regsvr32.exe PID 4068 wrote to memory of 3408 4068 zZxNKlENvi1.exe regsvr32.exe PID 4068 wrote to memory of 3408 4068 zZxNKlENvi1.exe regsvr32.exe PID 3408 wrote to memory of 4492 3408 regsvr32.exe regsvr32.exe PID 3408 wrote to memory of 4492 3408 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
zZxNKlENvi1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{C2068334-6DBC-1FE8-3448-88CFF7E32AA6} = "1" zZxNKlENvi1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe"C:\Users\Admin\AppData\Local\Temp\839c52e3cb1ad133a26366ea58c07a7f1908114e0a5172b76b90e68d60b175c2.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\zZxNKlENvi1.exe"C:\Users\Admin\AppData\Local\Temp/4a7f0895/zZxNKlENvi1.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dll"4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.datFilesize
3KB
MD5779b1161209bfaf3121e722fe5d16a86
SHA1d4ce63a63b2bc5e1e15d34b266daeedb9d79e687
SHA256fe73dbac74ebec4a3bc93febc9eb1b449137db27161e37e06936581184dbb3d6
SHA5124479e97b061cd7a4c9e0c3a22453629011f584551cd11196aefa5058b5cbc1af4a1819b178561221d31ff2dda6d19d0c91a8d6674f123738c175d147cb535aa6
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.dllFilesize
615KB
MD53d843c74531ca1c2083155de6e23b896
SHA1238c955b8cdfc8d1f9a61b9362abe1a9c539121c
SHA256f3034c1203be28d276a6b2aaed96b3eaa191057a8071f5e55b61094447d3f6e7
SHA5121346d1348c422163895cfdb5696504cb2dd7e33ae75c7f360a1b53cf90afe3d96a48df80614531f24f7ed45da6b0dcec2ddb690f51de8eb2f09b2ceb1310767f
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.tlbFilesize
3KB
MD5c755885d4929a76676d9c2958885888d
SHA1013754938e74a2a15701341a56a31e47a7e6251c
SHA256bdcec9b50154a0195f454f2e98fc8d3579f0390004d17b341397163bb68bebf3
SHA512b4f4dd7d185cb9e66dda97ed465c59994d45e192b4b731193f67461532ca883f73fb9cf4185ef63e8953ab2400af50d2682b39f60157ea9af2418e3d5f8efd17
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dllFilesize
688KB
MD5baf3dccca0c5c2cbd9b47734bef3f8b8
SHA148e7319932be8c031558e07ba51663c1420aeab9
SHA2567ab39876890bee8ee9330d1a3e22fef25c1300a8f36f6855fb02486b9f59ff27
SHA512f42befef2029546ea8ff9930f60ce8215479c205241b7896e7b3b204d170640cb397f1f17789eeec3acf8f8e1517921ee86d619be86b64fe2a77b1a91cab0b4b
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dllFilesize
688KB
MD5baf3dccca0c5c2cbd9b47734bef3f8b8
SHA148e7319932be8c031558e07ba51663c1420aeab9
SHA2567ab39876890bee8ee9330d1a3e22fef25c1300a8f36f6855fb02486b9f59ff27
SHA512f42befef2029546ea8ff9930f60ce8215479c205241b7896e7b3b204d170640cb397f1f17789eeec3acf8f8e1517921ee86d619be86b64fe2a77b1a91cab0b4b
-
C:\Program Files (x86)\SaveClicker\SFL0aWhY3m.x64.dllFilesize
688KB
MD5baf3dccca0c5c2cbd9b47734bef3f8b8
SHA148e7319932be8c031558e07ba51663c1420aeab9
SHA2567ab39876890bee8ee9330d1a3e22fef25c1300a8f36f6855fb02486b9f59ff27
SHA512f42befef2029546ea8ff9930f60ce8215479c205241b7896e7b3b204d170640cb397f1f17789eeec3acf8f8e1517921ee86d619be86b64fe2a77b1a91cab0b4b
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\[email protected]\chrome.manifestFilesize
31B
MD507292fb01318232f3999f6c9fdb53276
SHA1b91748460e20e981210ed865262d15ada14999ff
SHA256f3cd03e0d4272a2642721d96435d17fd2ef66fa090c95b806427a49f4f285b36
SHA51200e7ab3d1d48ef098758fd701503e86d5a72c379db47e5b44ccab6616cc14950df52a31678c4caa6011d785c97566dcf894c0cc9db84b87a0d8149bd8099004b
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\[email protected]\content\bg.jsFilesize
7KB
MD5efd2a67df10a3b58dc36bf45af843cab
SHA1be7e3e3bf1b88863d5c4ca72199ed000bfa9b6f2
SHA25650582fa63f9d5cb578ad30a31779192e0c4732c1e6ac6b4a38754c13a1cd7126
SHA5122e0a70d431d6591e320dfdf562c19db8bee6a3a14f8e364d064dcd403afd8e6f732317e4a8b4f9fd9c975c4ae65a6ab137c89ceba9399ed44bb5cbd8a002db53
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\[email protected]\install.rdfFilesize
607B
MD5176a077b20a5b30fd498fb241864685f
SHA16c9d56b70a76b4ab63b6484ba694e3d7f04827de
SHA256e95d667b77d1286dd95f0ee3ce6baa6c58aa21fe5d7a1af8360a5d761c9de7de
SHA512968845b43062d51b54d4b9ae4a7d936d284c085ec42304169fbeeb01f069cdd5c97453c1ecb1f826c7be83c57eebc141fdd6eb720844e0c366e721b8fadd2c18
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\SFL0aWhY3m.dllFilesize
615KB
MD53d843c74531ca1c2083155de6e23b896
SHA1238c955b8cdfc8d1f9a61b9362abe1a9c539121c
SHA256f3034c1203be28d276a6b2aaed96b3eaa191057a8071f5e55b61094447d3f6e7
SHA5121346d1348c422163895cfdb5696504cb2dd7e33ae75c7f360a1b53cf90afe3d96a48df80614531f24f7ed45da6b0dcec2ddb690f51de8eb2f09b2ceb1310767f
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\SFL0aWhY3m.tlbFilesize
3KB
MD5c755885d4929a76676d9c2958885888d
SHA1013754938e74a2a15701341a56a31e47a7e6251c
SHA256bdcec9b50154a0195f454f2e98fc8d3579f0390004d17b341397163bb68bebf3
SHA512b4f4dd7d185cb9e66dda97ed465c59994d45e192b4b731193f67461532ca883f73fb9cf4185ef63e8953ab2400af50d2682b39f60157ea9af2418e3d5f8efd17
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\SFL0aWhY3m.x64.dllFilesize
688KB
MD5baf3dccca0c5c2cbd9b47734bef3f8b8
SHA148e7319932be8c031558e07ba51663c1420aeab9
SHA2567ab39876890bee8ee9330d1a3e22fef25c1300a8f36f6855fb02486b9f59ff27
SHA512f42befef2029546ea8ff9930f60ce8215479c205241b7896e7b3b204d170640cb397f1f17789eeec3acf8f8e1517921ee86d619be86b64fe2a77b1a91cab0b4b
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\hikcjgoabingefihaglbbjgolblkkomf\background.htmlFilesize
142B
MD52cd5a6fd74ba82efe9f6987cbd12cb9e
SHA10240f1383b5cc5d24bec8d5248558a0a4e4ae53e
SHA256c75f6db94c435e67ce1a7a225cf179f8a84e82f724fb65c6ac0f8f05a7c1b3fc
SHA51215ca170d185f8dd1f7935915d633e59765deb2819d72cb5a2310e12f50c16c211f5c3ccdf0510f5edfda5475d62158a67b3dd16278b651cb6359db78930fe604
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\hikcjgoabingefihaglbbjgolblkkomf\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\hikcjgoabingefihaglbbjgolblkkomf\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\hikcjgoabingefihaglbbjgolblkkomf\manifest.jsonFilesize
503B
MD5aa6fc24e028b07a032fbc6f859819dca
SHA1166f2c578c4f164da313ece0e914e56e053418c2
SHA2562f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038
SHA5124f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\hikcjgoabingefihaglbbjgolblkkomf\sJpsM.jsFilesize
5KB
MD55b1a2221f793dcb72d18b9a481c47b56
SHA1639fbad7da5fad46e94229f87993672dbabe2459
SHA2562c973798efa5dd4a2570d320ba0b64816e238d914ab1b5d7fad7b146684a64d0
SHA512d5b7f7f3af512ca69534a41b9a7041eca9683829bc8bc4c076f7194abd6e30eeb632880f595bc216b677855e0d294f2f0f11707d94b5f52b5178a98b6ffdfe00
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\zZxNKlENvi1.datFilesize
3KB
MD5779b1161209bfaf3121e722fe5d16a86
SHA1d4ce63a63b2bc5e1e15d34b266daeedb9d79e687
SHA256fe73dbac74ebec4a3bc93febc9eb1b449137db27161e37e06936581184dbb3d6
SHA5124479e97b061cd7a4c9e0c3a22453629011f584551cd11196aefa5058b5cbc1af4a1819b178561221d31ff2dda6d19d0c91a8d6674f123738c175d147cb535aa6
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\zZxNKlENvi1.exeFilesize
649KB
MD5f9c9a33fb48dc9b0b0900ebd81bc5db9
SHA1d9f738d380a535411b32c5258f38729393a66724
SHA256bc395c0b068100974f71577b7af1e03af7171378911918f55f7f7f3dc0495820
SHA512848c84dc57751f67650ccb949957d2a9c8ddc18efd3c0a3f581cdcf10550f8cfbd9bf4b77e145c5fd0bc4340557bb78f2b77a8293a8812352f2cc06413a832d1
-
C:\Users\Admin\AppData\Local\Temp\4a7f0895\zZxNKlENvi1.exeFilesize
649KB
MD5f9c9a33fb48dc9b0b0900ebd81bc5db9
SHA1d9f738d380a535411b32c5258f38729393a66724
SHA256bc395c0b068100974f71577b7af1e03af7171378911918f55f7f7f3dc0495820
SHA512848c84dc57751f67650ccb949957d2a9c8ddc18efd3c0a3f581cdcf10550f8cfbd9bf4b77e145c5fd0bc4340557bb78f2b77a8293a8812352f2cc06413a832d1
-
memory/3408-149-0x0000000000000000-mapping.dmp
-
memory/4068-132-0x0000000000000000-mapping.dmp
-
memory/4492-152-0x0000000000000000-mapping.dmp