Analysis
-
max time kernel
52s -
max time network
95s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:26
Static task
static1
Behavioral task
behavioral1
Sample
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe
Resource
win10v2004-20220901-en
General
-
Target
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe
-
Size
2.9MB
-
MD5
b1e4e7e6fdf755e525bcc29d46edc537
-
SHA1
0e4558febf1d9a0fa74a0c2688ef630180fb6cb5
-
SHA256
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03
-
SHA512
40e8b50a9e27a310ad29c7807bbee81c00c16fb5f45354752f08577589f194b01dbb83dd9463d7a57c21011c1fc365e65ca1830617afb36f3b4d7ac1836696f3
-
SSDEEP
49152:RfVNoP6jVxnK8EdiH9TLgpdRafWMC0GiOdkLQGdbcDBy0iUU:R3KbdytFfcdqoV/
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaave\\rc5dF2qcSBgrw3.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exeregsvr32.exeregsvr32.exepid process 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe 432 regsvr32.exe 1892 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnjpdeaighhebebnbgoklmppcidciak\2.0\manifest.json aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnjpdeaighhebebnbgoklmppcidciak\2.0\manifest.json aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\flnjpdeaighhebebnbgoklmppcidciak\2.0\manifest.json aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ = "GoSaave" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\NoExplorer = "1" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ = "GoSaave" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Drops file in System32 directory 4 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Windows\System32\GroupPolicy aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Drops file in Program Files directory 8 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exedescription ioc process File created C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dll aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dll aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File created C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.dll aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.dll aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File created C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.tlb aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.tlb aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File created C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.dat aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe File opened for modification C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.dat aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exeaa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSaave" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSaave\\rc5dF2qcSBgrw3.tlb" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ = "GoSaave" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaave\\rc5dF2qcSBgrw3.dll" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B}\Implemented Categories aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ThreadingModel = "Apartment" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\VersionIndependentProgID\ aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971C1-0D41-4A7C-82D0-2E2C3EBB9D8B} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\VersionIndependentProgID\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID\ = ".9" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\ProgID aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaave\\rc5dF2qcSBgrw3.x64.dll" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exepid process 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exeregsvr32.exedescription pid process target process PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 1520 wrote to memory of 432 1520 aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe PID 432 wrote to memory of 1892 432 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{271971c1-0d41-4a7c-82d0-2e2c3ebb9d8b} = "1" aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe"C:\Users\Admin\AppData\Local\Temp\aa07c5ff5180d16e12ded6b5466471b703c1ee5cdeb984b4e81accec7c89ae03.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1520 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.datFilesize
4KB
MD5ab7bf362cd61f9edc80c47054961df20
SHA19577c7d07dfba09298ed590b1f5aeccb23cf03cf
SHA2567c10b574c1b8510a4534abcbbcdc5526e9062547640a69b99e92dd3aa548d532
SHA5128a61417c85e2fbf19e5b92e200f5a00af4e35a7ad34fe77fd1dc4cc9e2b39c87b8d9187d5675b3fb8448e7cba03ffa65c3631f701781b9b8a7b915511772dc36
-
C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.tlbFilesize
3KB
MD5ea16e050c57b164fa84e8b82443a3439
SHA12b01b56bdb8a5986cd02cb510cac1a3918d11db9
SHA256295f4a7b9258487bd55889369a50d086e861b5889dc3cf8be0302ad000d12eff
SHA51229227cb3678e31072770d85910bc63584a3b291a6733cbb7d71e9ed86b8b2dff8bb4c74b126477af622a63dde3e7b30ee84ade54eff583711f1166e5c3ae568a
-
C:\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dllFilesize
688KB
MD577bc36cf62b98793a117eb936dc55624
SHA19e4163cd0ad341f2e0bc3c8c3ddd6c16b8172be2
SHA256cc3a5b6b87d7838938b1e348b9025928cfc813727a39738f9681828b66a7dde7
SHA512472cc986e07d9bc226117c7bf1ea18c4c5a30e161e861c11e74e59bddbd3ae5c89dc21f5a29a0e23613fad345d7e51a961079a3a57bb84928d87cada8befc089
-
\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.dllFilesize
608KB
MD50355269639d03f0c96b5c995a7fba557
SHA1cf31506688e2c1f6bde3ea2046b39fb3cd45b1d6
SHA2560e85dc783dd8d135e42e416497a6d85064af196fc4bdd208412c7d64ee5b5db6
SHA5121121d570556897ed2585ad21101077cf52c4a9fad69abae2842ef28d12ca8ddbebce9978cff083b891bcc0ea36042ea87939b0d2632530cb4973186157741038
-
\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dllFilesize
688KB
MD577bc36cf62b98793a117eb936dc55624
SHA19e4163cd0ad341f2e0bc3c8c3ddd6c16b8172be2
SHA256cc3a5b6b87d7838938b1e348b9025928cfc813727a39738f9681828b66a7dde7
SHA512472cc986e07d9bc226117c7bf1ea18c4c5a30e161e861c11e74e59bddbd3ae5c89dc21f5a29a0e23613fad345d7e51a961079a3a57bb84928d87cada8befc089
-
\Program Files (x86)\GoSaave\rc5dF2qcSBgrw3.x64.dllFilesize
688KB
MD577bc36cf62b98793a117eb936dc55624
SHA19e4163cd0ad341f2e0bc3c8c3ddd6c16b8172be2
SHA256cc3a5b6b87d7838938b1e348b9025928cfc813727a39738f9681828b66a7dde7
SHA512472cc986e07d9bc226117c7bf1ea18c4c5a30e161e861c11e74e59bddbd3ae5c89dc21f5a29a0e23613fad345d7e51a961079a3a57bb84928d87cada8befc089
-
memory/432-80-0x0000000000000000-mapping.dmp
-
memory/1520-68-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-66-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-70-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-76-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-77-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-78-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-74-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-73-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-75-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-72-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-71-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-69-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-65-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-63-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-54-0x0000000075001000-0x0000000075003000-memory.dmpFilesize
8KB
-
memory/1520-67-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-64-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-62-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-55-0x00000000007C0000-0x0000000000867000-memory.dmpFilesize
668KB
-
memory/1520-60-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1520-61-0x0000000000892000-0x0000000000896000-memory.dmpFilesize
16KB
-
memory/1892-85-0x000007FEFB531000-0x000007FEFB533000-memory.dmpFilesize
8KB
-
memory/1892-84-0x0000000000000000-mapping.dmp