5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c

General

Target

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Size

3.5MB
MD5

1891fd26b6e7a71c7e20521645832348
SHA1

6830ed68176c916e272c1933bd1f62060bc7ade5
SHA256

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c
SHA512

2ddcbad0057c193afa6f58b0183a3f74085a8db348b37e49bd0c956d2f5e0a21322b622fd70fa9bd0fc25cd5b36c0b80a4c121a837f3615b5f962fd52feeecbf
SSDEEP

49152:fnRlx6HPIwOEZm37NkR6hnl9nkyb3BeZit0Q87sovWY5i8LnA/wlnrgwqy91MgcL:vvx6HGUeEit98YEWYdLnAKn0wkg

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ = "C:\\Program Files (x86)\\GoiSAvve\\ZqRbdJ0b.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exeregsvr32.exeregsvr32.exe

pid process

4908 5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
2096 regsvr32.exe
2328 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\adnlfeabjoipnhoandnflpomlbpldbnl\2.0\manifest.json	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\adnlfeabjoipnhoandnflpomlbpldbnl\2.0\manifest.json	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\adnlfeabjoipnhoandnflpomlbpldbnl\2.0\manifest.json	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\adnlfeabjoipnhoandnflpomlbpldbnl\2.0\manifest.json	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\adnlfeabjoipnhoandnflpomlbpldbnl\2.0\manifest.json	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ = "GoiSAvve"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\NoExplorer = "1"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ = "GoiSAvve"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Drops file in System32 directory 4 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Windows\System32\GroupPolicy	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Drops file in Program Files directory 8 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
File created	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.tlb	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.tlb	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dat	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dat	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File created	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dll	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
File opened for modification	C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dll	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CurVer\ = "GoSaive.2.0"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ = "GoiSAvve"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive.2.0\CLSID\ = "{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CLSID	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ThreadingModel = "Apartment"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ProgID	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\VersionIndependentProgID\ = "GoSaive"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\Implemented Categories	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CLSID\ = "{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ProgID	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\Programmable	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\VersionIndependentProgID\ = "GoSaive"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive.2.0\ = "GoiSAvve"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive.2.0	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CurVer	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\ = "GoiSAvve"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoiSAvve\\ZqRbdJ0b.tlb"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ = "C:\\Program Files (x86)\\GoiSAvve\\ZqRbdJ0b.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32\ = "C:\\Program Files (x86)\\GoiSAvve\\ZqRbdJ0b.dll"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\InprocServer32	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CLSID\ = "{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\ProgID\ = "GoSaive.2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GoSaive.GoSaive\CurVer\ = "GoSaive.2.0"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

pid	process
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exeregsvr32.exe

description	pid	process	target process
PID 4908 wrote to memory of 2096	4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe	regsvr32.exe
PID 4908 wrote to memory of 2096	4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe	regsvr32.exe
PID 4908 wrote to memory of 2096	4908	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe	regsvr32.exe
PID 2096 wrote to memory of 2328	2096	regsvr32.exe	regsvr32.exe
PID 2096 wrote to memory of 2328	2096	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{B52C904A-9D2D-4639-8049-4A8FE4F8F09B} = "1"	5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe

C:\Users\Admin\AppData\Local\Temp\5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe
"C:\Users\Admin\AppData\Local\Temp\5c69d7e04e1f32ddfa53e5a2d375f5598834de0aab4c188f51d330b39dea7c7c.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4908

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2096

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2328

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:5040

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dat

Filesize
4KB

MD5
9d1fa52762925de3cf934a6945f305cb

SHA1
49a427e3b446afb12d97d71889f58c9afcae1d04

SHA256
55b5b8d014b6d10d05a0d77dc1b1ef4512194dbb80c0cb071e6ee173ef6debe2

SHA512
7b13f653c90bfc950690cbb8ad11f3fc674eb20367ad106a768db78c006f1123ffcf3cff1674cf985365fb683965ced71b6bc542a930615d8c8dbdb48a955281

Download Submit
C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.dll

Filesize
623KB

MD5
2f700827f71ba8d02b87b1145bde267e

SHA1
a3264aa5c20eea8279b82283d98410f9c3491865

SHA256
1d5544b85315e47c0dfbf7bf6a037ed4c66f7f3ac192da07352d574526393b1f

SHA512
ff50314ff77b859688dad9c8a73de194d05fc56f11ed6b4996d61f85f3fa138d13270f8f0283f88642d5886e15fc7a2924f0c42da2d40b8f4b563a29ed15b181

Download Submit
C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.tlb

Filesize
3KB

MD5
69f83b6fbfb0b8bcd41fd7526c15f0f8

SHA1
6e77c6a9db881c687513fca345f7014a34581fbd

SHA256
138bbb7b27e2101e06fd2ee40807bf0cf5092c706b63f20275cb0acd5ca4ddd4

SHA512
e266fc64bd30a7e070089c2a0dca878a482c49b6069adf2fbe08e87584298d75960846845c1f207d2784a652e34908997aabcdacfd11956cca21df42bc13fcdd

Download Submit
C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll

Filesize
704KB

MD5
b006dc4fc0353a50f457e148a8783482

SHA1
df404fe8ca7df2a6cf389db2e64cbde87da702ea

SHA256
11f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116

SHA512
345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05

Download Submit
C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll

Filesize
704KB

MD5
b006dc4fc0353a50f457e148a8783482

SHA1
df404fe8ca7df2a6cf389db2e64cbde87da702ea

SHA256
11f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116

SHA512
345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05

Download Submit
C:\Program Files (x86)\GoiSAvve\ZqRbdJ0b.x64.dll

Filesize
704KB

MD5
b006dc4fc0353a50f457e148a8783482

SHA1
df404fe8ca7df2a6cf389db2e64cbde87da702ea

SHA256
11f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116

SHA512
345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05

Download Submit
memory/2096-138-0x0000000000000000-mapping.dmp

Download
memory/2328-141-0x0000000000000000-mapping.dmp

Download
memory/4908-132-0x0000000002D60000-0x0000000002E04000-memory.dmp

Filesize
656KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads