b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66

Analysis

max time kernel
6s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe
Size

2.0MB
MD5

7397380f638e5fa93fab1beb880b1539
SHA1

30ad3f2aa3eaac8fed4d3bc987ebcdfd9059fbca
SHA256

b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66
SHA512

14246da63cf5344a39d312189bcf7bcb968fc5cc2dde8b9ab861dc322be3cb6f72f9d95e190c6532ec3e414c620a37da7b5eaeed10a1cbdf8f9f70cd36f3bbc9
SSDEEP

49152:kkRPQprvXrNu6/rXTmDg1FQrTD/omlgfGcRztQ3m:dUrDNu67a8P2PgW4G0zkm

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

aS2yv0y.exe

pid process

1368 aS2yv0y.exe

pid	process
1368	aS2yv0y.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\lWXIf4.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32	regsvr32.exe

Loads dropped DLL 4 IoCs

Processes:

b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exeaS2yv0y.exeregsvr32.exeregsvr32.exe

pid process

1712 b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe
1368 aS2yv0y.exe
1804 regsvr32.exe
784 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1712	b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe
1368	aS2yv0y.exe
1804	regsvr32.exe
784	regsvr32.exe

Drops Chrome extension 3 IoCs

Processes:

aS2yv0y.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhnpbkijohkhofliebfofffcjjoodknn\2.1\manifest.json	aS2yv0y.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhnpbkijohkhofliebfofffcjjoodknn\2.1\manifest.json	aS2yv0y.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nhnpbkijohkhofliebfofffcjjoodknn\2.1\manifest.json	aS2yv0y.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeaS2yv0y.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ = "SaveClicker"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ = "SaveClicker"	aS2yv0y.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\NoExplorer = "1"	aS2yv0y.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

aS2yv0y.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	aS2yv0y.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	aS2yv0y.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	aS2yv0y.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	aS2yv0y.exe

Drops file in Program Files directory 8 IoCs

Processes:

aS2yv0y.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SaveClicker\lWXIf4.tlb	aS2yv0y.exe
File created	C:\Program Files (x86)\SaveClicker\lWXIf4.dat	aS2yv0y.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\lWXIf4.dat	aS2yv0y.exe
File created	C:\Program Files (x86)\SaveClicker\lWXIf4.x64.dll	aS2yv0y.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\lWXIf4.x64.dll	aS2yv0y.exe
File created	C:\Program Files (x86)\SaveClicker\lWXIf4.dll	aS2yv0y.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\lWXIf4.dll	aS2yv0y.exe
File created	C:\Program Files (x86)\SaveClicker\lWXIf4.tlb	aS2yv0y.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

aS2yv0y.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	aS2yv0y.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aS2yv0y.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aS2yv0y.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	aS2yv0y.exe

Modifies registry class 64 IoCs

Processes:

aS2yv0y.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ProgID\ = "SaveClicker.2.1"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{BB2B8265-25A1-0D5D-7AAC-40730F19D179}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID\ = "{BB2B8265-25A1-0D5D-7AAC-40730F19D179}"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\VersionIndependentProgID\ = "SaveClicker"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ProgID	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	aS2yv0y.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\VersionIndependentProgID	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ProgID	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ = "SaveClicker"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\VersionIndependentProgID	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\VersionIndependentProgID\ = "SaveClicker"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\lWXIf4.dll"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\Programmable	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\Implemented Categories	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SaveClicker"	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\ProgID\ = "SaveClicker.2.1"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}\InprocServer32	aS2yv0y.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179}	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SaveClicker\\lWXIf4.tlb"	aS2yv0y.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	aS2yv0y.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

aS2yv0y.exe

pid process

1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe
1368 aS2yv0y.exe

pid	process
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe
1368	aS2yv0y.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

aS2yv0y.exe

description	pid	process
Token: SeDebugPrivilege	1368	aS2yv0y.exe
Token: SeDebugPrivilege	1368	aS2yv0y.exe
Token: SeDebugPrivilege	1368	aS2yv0y.exe
Token: SeDebugPrivilege	1368	aS2yv0y.exe
Token: SeDebugPrivilege	1368	aS2yv0y.exe
Token: SeDebugPrivilege	1368	aS2yv0y.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exeaS2yv0y.exeregsvr32.exe

description	pid	process	target process
PID 1712 wrote to memory of 1368	1712	b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe	aS2yv0y.exe
PID 1712 wrote to memory of 1368	1712	b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe	aS2yv0y.exe
PID 1712 wrote to memory of 1368	1712	b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe	aS2yv0y.exe
PID 1712 wrote to memory of 1368	1712	b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe	aS2yv0y.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1368 wrote to memory of 1804	1368	aS2yv0y.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe
PID 1804 wrote to memory of 784	1804	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

aS2yv0y.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	aS2yv0y.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{BB2B8265-25A1-0D5D-7AAC-40730F19D179} = "1"	aS2yv0y.exe

C:\Users\Admin\AppData\Local\Temp\b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe
"C:\Users\Admin\AppData\Local\Temp\b35c53410a9c7b20a706754290f53950f2a606912ab129a9698cebb639236b66.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Users\Admin\AppData\Local\Temp\77670393\aS2yv0y.exe
  "C:\Users\Admin\AppData\Local\Temp/77670393/aS2yv0y.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in System32 directory
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1368
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\SaveClicker\lWXIf4.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1804
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\SaveClicker\lWXIf4.x64.dll"
      4⤵
      Registers COM server for autorun
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:784

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SaveClicker\lWXIf4.dat

Filesize
4KB

MD5
3efa01bdf741d93854f8df399107c805

SHA1
af39b9518677df3083c003b4f183ebcd0796bd84

SHA256
cd33ead4ee14873fe38906e0ddcc72f709d3923b9ba70adaeaad8c6d1ce7d35e

SHA512
80bfb02a29618c9b01cfface1b752aa9c8fd2e08e5806fc62e53800bb41266e79551b1b9b07b7ffd018c565008498e0147c61e8b4bd3f36b68cbdf4232b5f072

Download Submit
C:\Program Files (x86)\SaveClicker\lWXIf4.tlb

Filesize
3KB

MD5
dc5d6fda3919aab8b02955a31e80c95d

SHA1
8c91e1f889ff8d974ab09b59bcc0e7ef3487a41a

SHA256
2c9d6ea10cdc95e53f031fed3056d8239a75b14134707ac33be069998459e8a0

SHA512
158fb66f4ca4696ec8e8f9a7754d381960a335be15f9abcd4a14fd3f732189f61f23431fa1f5f99a8a34754eecd9d7c30af5b6d10e3137b475322e445cac44ea

Download Submit
C:\Program Files (x86)\SaveClicker\lWXIf4.x64.dll

Filesize
674KB

MD5
1851db73fadde4ee1200b13d38b273c7

SHA1
f9181369a820556b7e6df9c17d0d70a6bc358d52

SHA256
cb4d883c041d11272e44d006e9aa955027d6af54228055dcb01cea3b73d2dd5a

SHA512
100afe857c6691bf98e1fe0191dba69464531f7465e477c491e6c24ce15f203dab07739af77c01ab516d9a9e1e38b4d5c68d78a323643e74dc17a012e0a93e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\aS2yv0y.dat

Filesize
4KB

MD5
3efa01bdf741d93854f8df399107c805

SHA1
af39b9518677df3083c003b4f183ebcd0796bd84

SHA256
cd33ead4ee14873fe38906e0ddcc72f709d3923b9ba70adaeaad8c6d1ce7d35e

SHA512
80bfb02a29618c9b01cfface1b752aa9c8fd2e08e5806fc62e53800bb41266e79551b1b9b07b7ffd018c565008498e0147c61e8b4bd3f36b68cbdf4232b5f072

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\aS2yv0y.exe

Filesize
628KB

MD5
335866524cea345ad4d3faac81e5ccae

SHA1
ccbb81287516efe02d019492d0ffed20da5f4ca5

SHA256
df83c79b26feb1cd12fcff4d47f5fbecf2b9771d065a1b5f34dc65bb6acb81db

SHA512
c37d6abfd4372e454ed636c288148843e5120555a290e256968d995bfb6027d7b04a7bcaa518b9a65ed79bc1365e1327b0e761dc664bc41c630261970267486f

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\aS2yv0y.exe

Filesize
628KB

MD5
335866524cea345ad4d3faac81e5ccae

SHA1
ccbb81287516efe02d019492d0ffed20da5f4ca5

SHA256
df83c79b26feb1cd12fcff4d47f5fbecf2b9771d065a1b5f34dc65bb6acb81db

SHA512
c37d6abfd4372e454ed636c288148843e5120555a290e256968d995bfb6027d7b04a7bcaa518b9a65ed79bc1365e1327b0e761dc664bc41c630261970267486f

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\[email protected]\bootstrap.js

Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\[email protected]\chrome.manifest

Filesize
27B

MD5
b499dcb90f7dc63d330f9040528a6b11

SHA1
d5d51fdf4f41f68d72f082a83f8f2ae09f077b26

SHA256
d6dfa8dd41ede73aa98a8970b453bbd76990677d2bab2a6d5b5d9f7533904f33

SHA512
28bd534fafa0bc455829c0ce16954e93bc689f9f1ef580e8949356ae118c1680f46d38b173ff4fdd1a543b3a8c0836b0a71902d382fd71d51cce39fbe8345aea

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\[email protected]\content\bg.js

Filesize
7KB

MD5
2346a3dd44aba04f3e9e6d8d50be492c

SHA1
e124c4200b67688239dd85610a77ed8a5410aaa4

SHA256
45798a8659b5bd44fd4a7dc30ec1972c864811ba198991fe9cb47ba614eda482

SHA512
29ea4dbc94a3846711a8b4d6269775ae1565e5b0aeff0bdd73391e02f4c2ed7f84c7a5fbf56454cc13dcd03ab58f56d5cce1701974f1908f7525e5996b807492

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\[email protected]\install.rdf

Filesize
603B

MD5
f50183870f36fa1fb7acced2665fe324

SHA1
058f064efe1f53b32c7d317618b3a7c8157afdc1

SHA256
9f440c536b1903df0dc651e7d53345bb5ee6fdd9c44b040f49a0c5ba938c6250

SHA512
f8dbcae9c01a358a085310e86e581b442e404fdb31514c7aaf839371aa5227941ea50c4c62eb5462f502fcd6d2b5e7fd46d907c1af7c08c634755f2048641233

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\lWXIf4.dll

Filesize
597KB

MD5
5ae3ad5ed6cba0c101c4ca2839fdef9c

SHA1
7c9c32b1d4387caf683d061b5d986974aa621940

SHA256
ad1b1895c5bb032a7498f36887323d0e1d125c41c1671f5bcc5f9d3f688d0ade

SHA512
f25301e1d3da2f161b212624b3cfac3098d573eaa660706201f2ef74a6a0c8297a8ccc29197ff80125403eddec846d31ea3447d57e1e311623f8cb709e7894c5

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\lWXIf4.tlb

Filesize
3KB

MD5
dc5d6fda3919aab8b02955a31e80c95d

SHA1
8c91e1f889ff8d974ab09b59bcc0e7ef3487a41a

SHA256
2c9d6ea10cdc95e53f031fed3056d8239a75b14134707ac33be069998459e8a0

SHA512
158fb66f4ca4696ec8e8f9a7754d381960a335be15f9abcd4a14fd3f732189f61f23431fa1f5f99a8a34754eecd9d7c30af5b6d10e3137b475322e445cac44ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\lWXIf4.x64.dll

Filesize
674KB

MD5
1851db73fadde4ee1200b13d38b273c7

SHA1
f9181369a820556b7e6df9c17d0d70a6bc358d52

SHA256
cb4d883c041d11272e44d006e9aa955027d6af54228055dcb01cea3b73d2dd5a

SHA512
100afe857c6691bf98e1fe0191dba69464531f7465e477c491e6c24ce15f203dab07739af77c01ab516d9a9e1e38b4d5c68d78a323643e74dc17a012e0a93e76

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\nhnpbkijohkhofliebfofffcjjoodknn\background.html

Filesize
141B

MD5
0173deab5994430b43abd7033d997584

SHA1
ac95d17d2ce9a71bd6ab02660855e97b673de9c8

SHA256
81cb01ae4c93d64ca60137538e127116bc126fc6745f76a22e8e2cbcde84c636

SHA512
9e151f99174e47946062e062a8b80fca6437375db89a4458a6882631b1235c7d8a3d553e768e9dc40c5d28ec8eb650a9c0bc9130f7f10c497aae66bf90fccf17

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\nhnpbkijohkhofliebfofffcjjoodknn\content.js

Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\nhnpbkijohkhofliebfofffcjjoodknn\lsdb.js

Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\nhnpbkijohkhofliebfofffcjjoodknn\manifest.json

Filesize
503B

MD5
aa6fc24e028b07a032fbc6f859819dca

SHA1
166f2c578c4f164da313ece0e914e56e053418c2

SHA256
2f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038

SHA512
4f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701

Download Submit
C:\Users\Admin\AppData\Local\Temp\77670393\nhnpbkijohkhofliebfofffcjjoodknn\sdrP.js

Filesize
5KB

MD5
caa6fb12b65276bef54c5e3313caa073

SHA1
fcea8d62cf4fc7e9b7a432c105466be50c28bed6

SHA256
ef8d3c7e54356afaf5e1979f556ea9217cbc5540afffe5fd1d98f7df8c3fa358

SHA512
d5de12b52d471e667a7b19c340ef59c7342fac6a1243903264cf06787acee28ddc90573f3be748cf85f2caf886632617b9086fe1cb6e46a7299d089e6cb516cb

Download Submit
\Program Files (x86)\SaveClicker\lWXIf4.dll

Filesize
597KB

MD5
5ae3ad5ed6cba0c101c4ca2839fdef9c

SHA1
7c9c32b1d4387caf683d061b5d986974aa621940

SHA256
ad1b1895c5bb032a7498f36887323d0e1d125c41c1671f5bcc5f9d3f688d0ade

SHA512
f25301e1d3da2f161b212624b3cfac3098d573eaa660706201f2ef74a6a0c8297a8ccc29197ff80125403eddec846d31ea3447d57e1e311623f8cb709e7894c5

Download Submit
\Program Files (x86)\SaveClicker\lWXIf4.x64.dll

Filesize
674KB

MD5
1851db73fadde4ee1200b13d38b273c7

SHA1
f9181369a820556b7e6df9c17d0d70a6bc358d52

SHA256
cb4d883c041d11272e44d006e9aa955027d6af54228055dcb01cea3b73d2dd5a

SHA512
100afe857c6691bf98e1fe0191dba69464531f7465e477c491e6c24ce15f203dab07739af77c01ab516d9a9e1e38b4d5c68d78a323643e74dc17a012e0a93e76

Download Submit
\Program Files (x86)\SaveClicker\lWXIf4.x64.dll

Filesize
674KB

MD5
1851db73fadde4ee1200b13d38b273c7

SHA1
f9181369a820556b7e6df9c17d0d70a6bc358d52

SHA256
cb4d883c041d11272e44d006e9aa955027d6af54228055dcb01cea3b73d2dd5a

SHA512
100afe857c6691bf98e1fe0191dba69464531f7465e477c491e6c24ce15f203dab07739af77c01ab516d9a9e1e38b4d5c68d78a323643e74dc17a012e0a93e76

Download Submit
\Users\Admin\AppData\Local\Temp\77670393\aS2yv0y.exe

Filesize
628KB

MD5
335866524cea345ad4d3faac81e5ccae

SHA1
ccbb81287516efe02d019492d0ffed20da5f4ca5

SHA256
df83c79b26feb1cd12fcff4d47f5fbecf2b9771d065a1b5f34dc65bb6acb81db

SHA512
c37d6abfd4372e454ed636c288148843e5120555a290e256968d995bfb6027d7b04a7bcaa518b9a65ed79bc1365e1327b0e761dc664bc41c630261970267486f

Download Submit
memory/784-77-0x0000000000000000-mapping.dmp

Download
memory/784-78-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmp

Filesize
8KB

Download
memory/1368-56-0x0000000000000000-mapping.dmp

Download
memory/1712-54-0x0000000075771000-0x0000000075773000-memory.dmp

Filesize
8KB

Download
memory/1804-73-0x0000000000000000-mapping.dmp

Download