c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad

General

Target

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Size

4.3MB
MD5

b5353e70b290d8367234836bbd0a059d
SHA1

51ac2489a6b83380c90b93965fe13e3b89e19f1c
SHA256

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad
SHA512

666ce8863ed18de526270a4944c332714041a9eaf77635b81ba7bd4d6b5076ae80e272ab5bc801e78f6f1560688d1a7d500c128be5cd29acc72c6fe209b40ffc
SSDEEP

98304:Ek25ebO53eJdc1FMh6ZBrdHFAuPdC7hnq54q60AO41S44NEWFGva3Y/5h5HQDdx+:EbOwsdcHrdRXP+U33Bg3

Score

8^/10

adware discovery persistence stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVE\\GS901T.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exeregsvr32.exeregsvr32.exe

pid process

2012 c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
1500 regsvr32.exe
912 regsvr32.exe
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
1500	regsvr32.exe
912	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exec2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ = "GoSaVE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\NoExplorer = "1"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ = "GoSaVE"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\NoExplorer = "1"	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

description	ioc	process
File created	C:\Program Files (x86)\GoSaVE\GS901T.tlb	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File opened for modification	C:\Program Files (x86)\GoSaVE\GS901T.tlb	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File created	C:\Program Files (x86)\GoSaVE\GS901T.dat	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File opened for modification	C:\Program Files (x86)\GoSaVE\GS901T.dat	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File created	C:\Program Files (x86)\GoSaVE\GS901T.x64.dll	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File opened for modification	C:\Program Files (x86)\GoSaVE\GS901T.x64.dll	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File created	C:\Program Files (x86)\GoSaVE\GS901T.dll	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
File opened for modification	C:\Program Files (x86)\GoSaVE\GS901T.dll	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

Modifies registry class 64 IoCs

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE.2.0\ = "GoSaVE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\ = "GoSaVE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVE\\GS901T.dll"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE.2.0\CLSID\ = "{202DA693-59D5-6A8F-1DF2-E1F7C757875E}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\CurVer\ = "GoSavE.2.0"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ProgID	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\CLSID	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSaVE\\GS901T.tlb"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\ = "GoSaVE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE.2.0	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ = "GoSaVE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\Programmable	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\VersionIndependentProgID	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\CurVer	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\VersionIndependentProgID\ = "GoSavE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ = "GoSaVE"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\VersionIndependentProgID\ = "GoSavE"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVE\\GS901T.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ProgID	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\Programmable	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE\CurVer\ = "GoSavE.2.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\ProgID\ = "GoSavE.2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSaVE"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE.2.0\ = "GoSaVE"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE.2.0\CLSID\ = "{202DA693-59D5-6A8F-1DF2-E1F7C757875E}"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSavE.GoSavE	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exeregsvr32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 2012 wrote to memory of 1500	2012	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe
PID 1500 wrote to memory of 912	1500	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{202DA693-59D5-6A8F-1DF2-E1F7C757875E} = "1"	c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe

C:\Users\Admin\AppData\Local\Temp\c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe
"C:\Users\Admin\AppData\Local\Temp\c2eaba771a3068479afba2a80235d5bf1abc1d7da002538ab4387219ef7c92ad.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSaVE\GS901T.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1500

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSaVE\GS901T.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:912

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSaVE\GS901T.dat
Filesize
4KB

MD5
db0f45ff5623aef30345875b31110926

SHA1
b81493648947437f4af16762db1359fb303ebfc1

SHA256
5623394a60b4944fc514a0496d940b65ddd1daadf248f910d3a77517e7dce544

SHA512
a488833b61ac683ab043d41dc3c61fd371f77c964eed031cd3cb6c973324b97c8e592d8c4b37de53dc5b01fd9450ba6c26e445c03ca4e2b7ee8209ffb6a9b53a

Download Submit
C:\Program Files (x86)\GoSaVE\GS901T.tlb
Filesize
3KB

MD5
fb73184b9c1bfaa44e6cbdb593fd2909

SHA1
4585af18986a5e24c544fcecd9e02e3006f440d1

SHA256
c89fa0e13aa5c8930b6f28648653b815d4a93cd13e8d7d0f1bf8bf1a49920edb

SHA512
2e130f61d2211b7d2799905937b78d5119c3b22580c467dcfe757d8ac5b1e86c33fb69e3c67a6267f4db0a2730dc7cc399b8020d077b30d77428f54ec03523ed

Download Submit
C:\Program Files (x86)\GoSaVE\GS901T.x64.dll
Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
\Program Files (x86)\GoSaVE\GS901T.dll
Filesize
619KB

MD5
d87bbe9d29b88e94ba03b16567033ddf

SHA1
19102742808244a23ca403d983dfd9f7088fffe3

SHA256
fdbce4dd2b45ac64620fc875bd12d8706a197bc3def75cdc33b9984f039da5b5

SHA512
24ea28c1104ee07604124842a99e359a53644e7693515dcf1b9a4dc7c8258c9d1bdc8b78b7018582521b6d41aebb96a1a38b6994fe83a12e29418bb011c69d03

Download Submit
\Program Files (x86)\GoSaVE\GS901T.x64.dll
Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
\Program Files (x86)\GoSaVE\GS901T.x64.dll
Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
memory/912-65-0x0000000000000000-mapping.dmp

Download
memory/912-66-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmp

Filesize
8KB

Download
memory/1500-61-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x0000000075E81000-0x0000000075E83000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x0000000000880000-0x0000000000924000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads