Analysis
-
max time kernel
112s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 13:25
Static task
static1
Behavioral task
behavioral1
Sample
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe
Resource
win10v2004-20220812-en
General
-
Target
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe
-
Size
2.1MB
-
MD5
68e7d3edcb9d655d94d58a3db8253550
-
SHA1
7e0b525d5895fb13e064ccd3aa57b9d542b34f3f
-
SHA256
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f
-
SHA512
39d69512b5b2172400dd346e7990ee6b8aeb2e3d132faf62ed8f451b074ff891eebd9d3b055192b4949d33e65f124f7410f19e2c121bab29456ba783fe04c357
-
SSDEEP
49152:XkWY694CQwU+gZQLAwHyLTU9QGY9Mg8pmuZisW5IqYu5MTyoP:nY6JQX5QLAwHOIQGYmwIqYEKyoP
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32\ = "C:\\Program Files (x86)\\YooutubeAddBloacckee\\1SbnOcTsIiGSv7.x64.dll" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exeregsvr32.exeregsvr32.exepid process 1264 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe 5080 regsvr32.exe 5060 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ = "YooutubeAddBloacckee" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\NoExplorer = "1" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ = "YooutubeAddBloacckee" regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exedescription ioc process File opened for modification C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dll ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File created C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.dll ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File opened for modification C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.dll ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File created C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.tlb ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File opened for modification C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.tlb ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File created C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.dat ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File opened for modification C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.dat ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe File created C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dll ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe -
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exeregsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe -
Modifies registry class 64 IoCs
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32\ = "C:\\Program Files (x86)\\YooutubeAddBloacckee\\1SbnOcTsIiGSv7.x64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\VersionIndependentProgID ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "YooutubeAddBloacckee" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ProgID ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\VersionIndependentProgID\ ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\Programmable ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ = "YooutubeAddBloacckee" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32\ = "C:\\Program Files (x86)\\YooutubeAddBloacckee\\1SbnOcTsIiGSv7.dll" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\VersionIndependentProgID\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\YooutubeAddBloacckee" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ = "YooutubeAddBloacckee" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132DCB1-35E9-48C5-9C24-D791BB5B0C50} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "YooutubeAddBloacckee" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\InprocServer32 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50}\ProgID ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YooutubeAddBloacckee\\1SbnOcTsIiGSv7.tlb" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exeregsvr32.exedescription pid process target process PID 1264 wrote to memory of 5080 1264 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe regsvr32.exe PID 1264 wrote to memory of 5080 1264 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe regsvr32.exe PID 1264 wrote to memory of 5080 1264 ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe regsvr32.exe PID 5080 wrote to memory of 5060 5080 regsvr32.exe regsvr32.exe PID 5080 wrote to memory of 5060 5080 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9132dcb1-35e9-48c5-9c24-d791bb5b0c50} = "1" ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe"C:\Users\Admin\AppData\Local\Temp\ab5d3c89a2777b13df311069ff6c0420ed7575b6fae5d8c062cdccaa96894d3f.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1264 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:5080 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:5060
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.datFilesize
3KB
MD5688356f54e13abe0ab4790eb86e045b2
SHA193edac9de9ae5594efd01bb9ccdc3d2ac024f989
SHA256ff21d4c513b1ef118bae61a9e7c990ac8cbd44be4db7e838fded7a583a14a447
SHA512c002e58e9d7e6bbfc86fc306e2560845b2cd2bed62e87500fd68665458c2cf3f2dd5cc85e45b740fb15d53a6fc92555fd16e663ed682b7551fea71f2a2aec33f
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.dllFilesize
614KB
MD59b667841fa6680b733d5b79bc9bd4cb4
SHA1c476a5e8c8ab32927862184a274a1fa9524ab9c7
SHA256bef8ef321da36b6230869d492cc4223bc4e921cbe8e2e0d286ab41ed6ebf4e5b
SHA512b94ab8efb79d791769e394a9fded3dfffc50d57cb865f63f1a873948f400b4cc9313befae2d2059e0b2ea810eac2c554bd34aa694452a168e7ceff9e7d42e7ab
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.tlbFilesize
3KB
MD5f13b83dd097c20e5158af7317cd82a94
SHA12d3d4473e92358b3fec12cff3789fae2ed9bcd51
SHA2560a1142fdfd7b7c92852ecc676455ef9c100b7c4150f5f7c4a690aca2115a1920
SHA51271e8cb120266803119228ee25ce650a97adf6e9a03a4ec033a6a3b6b743baae3286fa91e04cb7c3c4573ec6807ed30e2329b6a81e1474a09234265316473f0ee
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dllFilesize
690KB
MD57f4e5aed48ad9c75a88177e0b3e1ef71
SHA16840657f75e173d9024b32f52080505800d181b8
SHA256e51368f1382e9a00d9059728c1e23914b3ecfc50cbbe927370adf009cd08aac1
SHA512fb41c9e758909d0546dd554230eb04812e708f069b423db587b37c4f8c5745399c959c1bfd850ec474f918217314bb64604ad8ab04780730040e732959b7f671
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dllFilesize
690KB
MD57f4e5aed48ad9c75a88177e0b3e1ef71
SHA16840657f75e173d9024b32f52080505800d181b8
SHA256e51368f1382e9a00d9059728c1e23914b3ecfc50cbbe927370adf009cd08aac1
SHA512fb41c9e758909d0546dd554230eb04812e708f069b423db587b37c4f8c5745399c959c1bfd850ec474f918217314bb64604ad8ab04780730040e732959b7f671
-
C:\Program Files (x86)\YooutubeAddBloacckee\1SbnOcTsIiGSv7.x64.dllFilesize
690KB
MD57f4e5aed48ad9c75a88177e0b3e1ef71
SHA16840657f75e173d9024b32f52080505800d181b8
SHA256e51368f1382e9a00d9059728c1e23914b3ecfc50cbbe927370adf009cd08aac1
SHA512fb41c9e758909d0546dd554230eb04812e708f069b423db587b37c4f8c5745399c959c1bfd850ec474f918217314bb64604ad8ab04780730040e732959b7f671
-
memory/1264-146-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-149-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-144-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-145-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-132-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/1264-148-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-147-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-143-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-142-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-137-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-141-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-140-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-138-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/1264-139-0x00000000013E0000-0x00000000013E3000-memory.dmpFilesize
12KB
-
memory/5060-154-0x0000000000000000-mapping.dmp
-
memory/5080-151-0x0000000000000000-mapping.dmp