eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519

General

Target

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Size

3.7MB
MD5

7c0c3b9ad0ddc47ac5124fd28f4c8487
SHA1

ba7c97a1e5fd68ff4972552feb129287f8151ca2
SHA256

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519
SHA512

161b7fc7e7f6d61509485c842f8fa25ac9f0c57a3963a1d20710d3728e8a881c880e66c0c70b271b71957ae34bd61f28e9254a3a507ed2f0599416e95b27ffe8
SSDEEP

98304:PkmQL/ZEg0HBI08J6FHdobEJPlSWqfX3rJ:smQL/ZR0hI0VH6oJPlQ3l

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\k1Zlq8joaA7Rj7.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exeregsvr32.exeregsvr32.exe

pid process

1052 eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
4052 regsvr32.exe
4028 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1052	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
4052	regsvr32.exe
4028	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeeef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\ = "YoutubeAdBlocke"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\ = "YoutubeAdBlocke"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\NoExplorer = "1"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

Drops file in Program Files directory 8 IoCs

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dll	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dll	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.tlb	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.tlb	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dat	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dat	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
File created	C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{007EECEA-CFBE-4EFA-B493-7EFB9DA5F4BB}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{007EECEA-CFBE-4EFA-B493-7EFB9DA5F4BB}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

Modifies registry class 64 IoCs

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\VersionIndependentProgID	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{007eecea-cfbe-4efa-b493-7efb9da5f4bb}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "YoutubeAdBlocke"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{007eecea-cfbe-4efa-b493-7efb9da5f4bb}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{007eecea-cfbe-4efa-b493-7efb9da5f4bb}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007EECEA-CFBE-4EFA-B493-7EFB9DA5F4BB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\VersionIndependentProgID\	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32\ThreadingModel = "Apartment"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\ = "YoutubeAdBlocke"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\VersionIndependentProgID\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\VersionIndependentProgID	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007EECEA-CFBE-4EFA-B493-7EFB9DA5F4BB}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\ProgID	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\Programmable	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\Programmable	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{007eecea-cfbe-4efa-b493-7efb9da5f4bb}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\k1Zlq8joaA7Rj7.dll"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{007EECEA-CFBE-4EFA-B493-7EFB9DA5F4BB}	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exeregsvr32.exe

description	pid	process	target process
PID 1052 wrote to memory of 4052	1052	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe	regsvr32.exe
PID 1052 wrote to memory of 4052	1052	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe	regsvr32.exe
PID 1052 wrote to memory of 4052	1052	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe	regsvr32.exe
PID 4052 wrote to memory of 4028	4052	regsvr32.exe	regsvr32.exe
PID 4052 wrote to memory of 4028	4052	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{007eecea-cfbe-4efa-b493-7efb9da5f4bb} = "1"	eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe

C:\Users\Admin\AppData\Local\Temp\eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe
"C:\Users\Admin\AppData\Local\Temp\eef03acc35301da1fa2268e7f2b1dc666888e57d4f3a9fe9e20bd37f3b8ef519.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1052

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4052

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dat

Filesize
4KB

MD5
ae88815543ebb0f3579d9a06686a7751

SHA1
aeab5a842592e974bd2ca614689db084c36dc6c6

SHA256
6d6500673c0e5ea4d4f9f07408afb82ec6d322297e5aeadc6209e827e222dde9

SHA512
3d6eda06155ca7069096130deff3e7d096c9d3c0a1c88294fb34754cc25cf4fa74e6ac38eb914df8740997ca9458753adbf017b59e6667678e7f0e9adb078a92

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.dll

Filesize
622KB

MD5
733493d92a8ff53c5414023b03f6b094

SHA1
d5cfdb6bf17b8e95ccc4805243c56332568c1f7a

SHA256
bf08cd1d3cb7584d8a653585a6373592e371c98e6b7ee891d3117091e691c38f

SHA512
9756a869a0827285b2b0da54cb301019b42d613cee96824102ff29889167ef5af6733f64349b899f709f0a65174d3c007a734583fdaf8e5b2ffc05932ccd9223

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.tlb

Filesize
3KB

MD5
f4bfdd20776e64da22031e447736a610

SHA1
e0518d3c5490a409037591ebb6bedbc3c57fc910

SHA256
b2b75536edc0f3877fc5ead10cb0ac1092d7a098fa88e442de17ea5c946c1b01

SHA512
ff82dfd9442057f0d5bc8177b68f21834f2114d5d0732bfd302727f9266f8ca6f452dca178e1ea0ea23319d06c9dbd8a5c69e1ad49d3c4e942c6c5e4602b8b9f

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll

Filesize
700KB

MD5
7c634b61487e3b58a66ec0245962bd6e

SHA1
82e1cf6382230eec4b4038c3937272378ecc822c

SHA256
fbd75f73878650e4317d7480cf16febf32d83d543a3d4be7f413936ca224da7b

SHA512
1c635b0682a9f48cc8c927e9170a7cef0839167f30625a778a1f6fdc05fe00add8a1f966dc8bc658773f544225559e52a70e69f691864179a5a74b86e2cf39d4

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll

Filesize
700KB

MD5
7c634b61487e3b58a66ec0245962bd6e

SHA1
82e1cf6382230eec4b4038c3937272378ecc822c

SHA256
fbd75f73878650e4317d7480cf16febf32d83d543a3d4be7f413936ca224da7b

SHA512
1c635b0682a9f48cc8c927e9170a7cef0839167f30625a778a1f6fdc05fe00add8a1f966dc8bc658773f544225559e52a70e69f691864179a5a74b86e2cf39d4

Download Submit
C:\Program Files (x86)\YoutubeAdBlocke\k1Zlq8joaA7Rj7.x64.dll

Filesize
700KB

MD5
7c634b61487e3b58a66ec0245962bd6e

SHA1
82e1cf6382230eec4b4038c3937272378ecc822c

SHA256
fbd75f73878650e4317d7480cf16febf32d83d543a3d4be7f413936ca224da7b

SHA512
1c635b0682a9f48cc8c927e9170a7cef0839167f30625a778a1f6fdc05fe00add8a1f966dc8bc658773f544225559e52a70e69f691864179a5a74b86e2cf39d4

Download Submit
memory/1052-132-0x0000000003AA0000-0x0000000003B45000-memory.dmp

Filesize
660KB

Download
memory/4028-141-0x0000000000000000-mapping.dmp

Download
memory/4052-138-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads