Analysis
-
max time kernel
97s -
max time network
67s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:20
Static task
static1
Behavioral task
behavioral1
Sample
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe
Resource
win10v2004-20221111-en
General
-
Target
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe
-
Size
3.5MB
-
MD5
bf59f13e9a054a5ab9498e05d2d8a00e
-
SHA1
3ee2f7e75a0a177304608bbdd5631861d5af3b36
-
SHA256
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52
-
SHA512
ca7582edb1a07b1fb91fcba68745c8147b20fdf57ae52b6b958413680c7a4ed792b8cd42f624bcb92ab45a4c64001b2067b5de2fc441cb1b9a8520c19d5d33b3
-
SSDEEP
49152:IcRYRlGdLKeURmULP0Q6hnQ9nkyb3BeKiEdQY7tXyMB6KWY5i8LA0rIDS4vLrgwp:V6RlGWPeEiEqYJOKWYdLT8DBvL0w5g
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVe\\_Y2c0.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exeregsvr32.exeregsvr32.exepid process 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 580 regsvr32.exe 1656 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lphghaagapblnogcmbklfjjlaeienjgo\2.0\manifest.json 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lphghaagapblnogcmbklfjjlaeienjgo\2.0\manifest.json 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lphghaagapblnogcmbklfjjlaeienjgo\2.0\manifest.json 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ = "GoSaVe" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ = "GoSaVe" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\NoExplorer = "1" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Drops file in System32 directory 4 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Drops file in Program Files directory 8 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process File opened for modification C:\Program Files (x86)\GoSaVe\_Y2c0.x64.dll 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Program Files (x86)\GoSaVe\_Y2c0.dll 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File opened for modification C:\Program Files (x86)\GoSaVe\_Y2c0.dll 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Program Files (x86)\GoSaVe\_Y2c0.tlb 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File opened for modification C:\Program Files (x86)\GoSaVe\_Y2c0.tlb 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Program Files (x86)\GoSaVe\_Y2c0.dat 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File opened for modification C:\Program Files (x86)\GoSaVe\_Y2c0.dat 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe File created C:\Program Files (x86)\GoSaVe\_Y2c0.x64.dll 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Processes:
regsvr32.exe479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exe479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\CurVer\ = "GoSiavei.2.0" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\CurVer\ = "GoSiavei.2.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\ = "GoSaVe" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32\ThreadingModel = "Apartment" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ProgID\ = "GoSiavei.2.0" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\ = "GoSaVe" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ProgID\ = "GoSiavei.2.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei.2.0\ = "GoSaVe" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei.2.0\CLSID 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVe\\_Y2c0.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\VersionIndependentProgID 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaVe\\_Y2c0.dll" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\VersionIndependentProgID\ = "GoSiavei" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSaVe" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ = "GoSaVe" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\CLSID\ = "{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\VersionIndependentProgID 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSaVe\\_Y2c0.tlb" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\VersionIndependentProgID\ = "GoSiavei" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\GoSiavei.GoSiavei\CurVer 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exepid process 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription pid process Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Token: SeDebugPrivilege 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exeregsvr32.exedescription pid process target process PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 1320 wrote to memory of 580 1320 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe PID 580 wrote to memory of 1656 580 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{82A7D56F-8F95-8DFC-34D5-B08A95556E5D} = "1" 479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe"C:\Users\Admin\AppData\Local\Temp\479372fc1bf9dd58afdbf1adbe9d39287a173a3bbcf06cc67236c8f581bc8c52.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSaVe\_Y2c0.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSaVe\_Y2c0.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSaVe\_Y2c0.datFilesize
4KB
MD506bbc58791dd74ac4368bbf5ba4b4bcd
SHA1bf0a03b3d8a178eca5904157e3c86fa656156d63
SHA2567d15307034f0d6d22cfea5f7cf1942e47f7c61c4f25492ab9cb040d93939b313
SHA51226fa60a575bc48439be82857c5f9fb4925bc09431e0dd02da1207884c26872612bd681f0a60cf64435e957ae2c87d32008d728a132d8e4a9b4d4550dfa60ab00
-
C:\Program Files (x86)\GoSaVe\_Y2c0.tlbFilesize
3KB
MD569f83b6fbfb0b8bcd41fd7526c15f0f8
SHA16e77c6a9db881c687513fca345f7014a34581fbd
SHA256138bbb7b27e2101e06fd2ee40807bf0cf5092c706b63f20275cb0acd5ca4ddd4
SHA512e266fc64bd30a7e070089c2a0dca878a482c49b6069adf2fbe08e87584298d75960846845c1f207d2784a652e34908997aabcdacfd11956cca21df42bc13fcdd
-
C:\Program Files (x86)\GoSaVe\_Y2c0.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
\Program Files (x86)\GoSaVe\_Y2c0.dllFilesize
623KB
MD52f700827f71ba8d02b87b1145bde267e
SHA1a3264aa5c20eea8279b82283d98410f9c3491865
SHA2561d5544b85315e47c0dfbf7bf6a037ed4c66f7f3ac192da07352d574526393b1f
SHA512ff50314ff77b859688dad9c8a73de194d05fc56f11ed6b4996d61f85f3fa138d13270f8f0283f88642d5886e15fc7a2924f0c42da2d40b8f4b563a29ed15b181
-
\Program Files (x86)\GoSaVe\_Y2c0.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
\Program Files (x86)\GoSaVe\_Y2c0.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
memory/580-61-0x0000000000000000-mapping.dmp
-
memory/1320-54-0x0000000076301000-0x0000000076303000-memory.dmpFilesize
8KB
-
memory/1320-55-0x0000000000790000-0x0000000000834000-memory.dmpFilesize
656KB
-
memory/1656-65-0x0000000000000000-mapping.dmp
-
memory/1656-66-0x000007FEFBAD1000-0x000007FEFBAD3000-memory.dmpFilesize
8KB