58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a

General

Target

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Size

2.9MB
MD5

c663241f02851ee36f4d6ea128a87ce0
SHA1

757523ffb0eead4e0383b34e99e07c566ca75fac
SHA256

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a
SHA512

406868869d2d7aedf6cae63e1bd431aca3478ba386112bafbf3c07a6d7d40cae984752dcafb5dc40a1df381dd099d049ef3a8314f4fe87c1bddc211934f16645
SSDEEP

49152:x8tm/sIjN4zidYqm6/GdffxMu2ow0DCodxFuaKplTpT/kg3AyayAD8Ah31O4XF1:xb0IGiy7VVLvFOpVpz8y3A13Oo

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\e6sPnou.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exeregsvr32.exeregsvr32.exe

pid process

1676 58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
552 regsvr32.exe
1828 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\onhnbipgabijbnejokhhlejipdhkilmf\2.1\manifest.json	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\onhnbipgabijbnejokhhlejipdhkilmf\2.1\manifest.json	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\onhnbipgabijbnejokhhlejipdhkilmf\2.1\manifest.json	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exeregsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\NoExplorer = "1"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ = "SaveClicker"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ = "SaveClicker"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Drops file in System32 directory 4 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File opened for modification	C:\Windows\System32\GroupPolicy	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Drops file in Program Files directory 8 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SaveClicker\e6sPnou.dll	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Program Files (x86)\SaveClicker\e6sPnou.tlb	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\e6sPnou.tlb	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Program Files (x86)\SaveClicker\e6sPnou.dat	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\e6sPnou.dat	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Program Files (x86)\SaveClicker\e6sPnou.x64.dll	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\e6sPnou.x64.dll	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
File created	C:\Program Files (x86)\SaveClicker\e6sPnou.dll	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ = "SaveClicker"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Programmable	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\VersionIndependentProgID\ = "SaveClicker"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ProgID\ = "SaveClicker.2.1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\VersionIndependentProgID\ = "SaveClicker"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\e6sPnou.dll"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Programmable	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\Implemented Categories	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ProgID	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32\ThreadingModel = "Apartment"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\InprocServer32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SaveClicker"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\ProgID	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\ = "SaveClicker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\ = "SaveClicker"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE}\VersionIndependentProgID	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

pid	process
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	pid	process
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Token: SeDebugPrivilege	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exeregsvr32.exe

description	pid	process	target process
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 1676 wrote to memory of 552	1676	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe
PID 552 wrote to memory of 1828	552	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{5D1C14ED-8D3A-FB21-0371-14B46BF029DE} = "1"	58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe

C:\Users\Admin\AppData\Local\Temp\58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe
"C:\Users\Admin\AppData\Local\Temp\58d9b85761346523094a5a0a989b550c481c756e9109ce2df9f2d522964e2a3a.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1676
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\SaveClicker\e6sPnou.x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:552
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\SaveClicker\e6sPnou.x64.dll"
    3⤵
    - Registers COM server for autorun
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1828

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SaveClicker\e6sPnou.dat

Filesize
4KB

MD5
e5a568095e4511ca6d5ce5df79ce1b50

SHA1
cdd473bab37a2a8e645d726c49f3a62349ef5ab2

SHA256
17cf19f058ac2178a1f230825dd91b686aba8e65839fa0d0641df5e84b754109

SHA512
235186bf99b5b55ecdb0d78d93030d840a63720701fa3b1aaddf54fdbf5306e55ec1aa29b1642f8c1d74036ae0e4018f9fbbd8baeb03ccef072498f10d6c67b9

Download Submit
C:\Program Files (x86)\SaveClicker\e6sPnou.tlb

Filesize
3KB

MD5
6bddd09534414b0c7543da0359e60c55

SHA1
0d91179dcad5a77c5541b838402ceb83be311035

SHA256
1a7271f53d6f491f9f0be1850d802b6c7cb4cdc9c0d0e6356ab2d12347a5ca1f

SHA512
8e9cffcb3a0b1d40902c20bb6b65e78410cb777c05e4556338f322cab6df8fc23e3a6861ec9b689d1fe074edb9646590badb3405f48635aa597305fb7a1dd6d8

Download Submit
C:\Program Files (x86)\SaveClicker\e6sPnou.x64.dll

Filesize
683KB

MD5
5da6a3ce8711a50e75f3ab29959dce11

SHA1
37c3856e6974223670889c8c33e6b8b8fbf3a3c1

SHA256
a921e228dbff3cfaa3e830813ec26e91fef47cdce0a3987fb38a0fffb40242e8

SHA512
d796df4194895382dc940ac47e3fd998344b4ba4f226b361c78317521b8513bddac0c0818eb2727dea4cc25571defda473d9e421c999cc07bdf5e4aa7b6bd61f

Download Submit
\Program Files (x86)\SaveClicker\e6sPnou.dll

Filesize
604KB

MD5
d8485f2cfe63ec47304bcdc6ccf6b8cc

SHA1
cf4c231896f2e831f2d74e21b2958aef00fb38e5

SHA256
e39b94093707e06617198920b18f27653ac4ffec8d8c947748e41a017266d928

SHA512
d1812b34db8ee0357fad166272c9fe2c45e97c4b1662b87098e56d3d583339e1738d8cdbb35d32891f9e286e46fdcff2e9f4365c785b5dd2628e4dcc22248b11

Download Submit
\Program Files (x86)\SaveClicker\e6sPnou.x64.dll

Filesize
683KB

MD5
5da6a3ce8711a50e75f3ab29959dce11

SHA1
37c3856e6974223670889c8c33e6b8b8fbf3a3c1

SHA256
a921e228dbff3cfaa3e830813ec26e91fef47cdce0a3987fb38a0fffb40242e8

SHA512
d796df4194895382dc940ac47e3fd998344b4ba4f226b361c78317521b8513bddac0c0818eb2727dea4cc25571defda473d9e421c999cc07bdf5e4aa7b6bd61f

Download Submit
\Program Files (x86)\SaveClicker\e6sPnou.x64.dll

Filesize
683KB

MD5
5da6a3ce8711a50e75f3ab29959dce11

SHA1
37c3856e6974223670889c8c33e6b8b8fbf3a3c1

SHA256
a921e228dbff3cfaa3e830813ec26e91fef47cdce0a3987fb38a0fffb40242e8

SHA512
d796df4194895382dc940ac47e3fd998344b4ba4f226b361c78317521b8513bddac0c0818eb2727dea4cc25571defda473d9e421c999cc07bdf5e4aa7b6bd61f

Download Submit
memory/552-80-0x0000000000000000-mapping.dmp

Download
memory/1676-67-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-77-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-64-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-68-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-69-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-71-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-70-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-72-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-73-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-74-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-75-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-65-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-76-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-78-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-54-0x0000000075A31000-0x0000000075A33000-memory.dmp

Filesize
8KB

Download
memory/1676-66-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-62-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-63-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-55-0x00000000026A0000-0x0000000002746000-memory.dmp

Filesize
664KB

Download
memory/1676-60-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1676-61-0x0000000000712000-0x0000000000716000-memory.dmp

Filesize
16KB

Download
memory/1828-85-0x000007FEFB641000-0x000007FEFB643000-memory.dmp

Filesize
8KB

Download
memory/1828-84-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads