Analysis
-
max time kernel
174s -
max time network
185s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 18:56
Static task
static1
Behavioral task
behavioral1
Sample
cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe
Resource
win10v2004-20220812-en
General
-
Target
cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe
-
Size
1.4MB
-
MD5
f0c25fed7e5e2daaed69863ac7892ce4
-
SHA1
2462299d2c1619c098831776aa631676edc0b40f
-
SHA256
cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6
-
SHA512
821ec108f54a766d723a765b964e1a5a12ac9d46d641d6e1fac58f3cf1078ba419bba5805a1f12a46f44465e825e861f9737e808508fea67e5c672fa61155617
-
SSDEEP
24576:tS6fJHL4InjKF9JWkioht3BxfN+kOQc4qAgHxJqzn6j6YitfuEq0438XKotZZ9:t74QKF9EoPfNfOQc4lgHPqr6j6FOsbT
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
9OsR3.exepid process 5052 9OsR3.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\wXCP.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
9OsR3.exeregsvr32.exeregsvr32.exepid process 5052 9OsR3.exe 2024 regsvr32.exe 1304 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
9OsR3.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dicolcmbpmkdcaakdfhakdnhodklmbhe\2.1\manifest.json 9OsR3.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dicolcmbpmkdcaakdfhakdnhodklmbhe\2.1\manifest.json 9OsR3.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dicolcmbpmkdcaakdfhakdnhodklmbhe\2.1\manifest.json 9OsR3.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dicolcmbpmkdcaakdfhakdnhodklmbhe\2.1\manifest.json 9OsR3.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\dicolcmbpmkdcaakdfhakdnhodklmbhe\2.1\manifest.json 9OsR3.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
9OsR3.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8} 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ = "SaveClicker" 9OsR3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\NoExplorer = "1" 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8} 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ = "SaveClicker" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{50F5790A-D8C5-09E2-E4C8-2329629447E8} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
9OsR3.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 9OsR3.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 9OsR3.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 9OsR3.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 9OsR3.exe -
Drops file in Program Files directory 8 IoCs
Processes:
9OsR3.exedescription ioc process File opened for modification C:\Program Files (x86)\SaveClicker\wXCP.dll 9OsR3.exe File created C:\Program Files (x86)\SaveClicker\wXCP.tlb 9OsR3.exe File opened for modification C:\Program Files (x86)\SaveClicker\wXCP.tlb 9OsR3.exe File created C:\Program Files (x86)\SaveClicker\wXCP.dat 9OsR3.exe File opened for modification C:\Program Files (x86)\SaveClicker\wXCP.dat 9OsR3.exe File created C:\Program Files (x86)\SaveClicker\wXCP.x64.dll 9OsR3.exe File opened for modification C:\Program Files (x86)\SaveClicker\wXCP.x64.dll 9OsR3.exe File created C:\Program Files (x86)\SaveClicker\wXCP.dll 9OsR3.exe -
Processes:
9OsR3.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration 9OsR3.exe Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{50F5790A-D8C5-09E2-E4C8-2329629447E8} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{50F5790A-D8C5-09E2-E4C8-2329629447E8} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration 9OsR3.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{50F5790A-D8C5-09E2-E4C8-2329629447E8} 9OsR3.exe Key deleted \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{50F5790A-D8C5-09E2-E4C8-2329629447E8} 9OsR3.exe -
Modifies registry class 64 IoCs
Processes:
9OsR3.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{50F5790A-D8C5-09E2-E4C8-2329629447E8}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\ = "SaveClicker" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8} 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SaveClicker\\wXCP.tlb" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ProgID\ = "SaveClicker.2.1" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ProgID 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\VersionIndependentProgID 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Programmable 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{50F5790A-D8C5-09E2-E4C8-2329629447E8}" 9OsR3.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\VersionIndependentProgID 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\wXCP.dll" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SaveClicker" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\wXCP.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ProgID 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\VersionIndependentProgID\ = "SaveClicker" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 9OsR3.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8}\ = "SaveClicker" 9OsR3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 9OsR3.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
9OsR3.exepid process 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe 5052 9OsR3.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
9OsR3.exedescription pid process Token: SeDebugPrivilege 5052 9OsR3.exe Token: SeDebugPrivilege 5052 9OsR3.exe Token: SeDebugPrivilege 5052 9OsR3.exe Token: SeDebugPrivilege 5052 9OsR3.exe Token: SeDebugPrivilege 5052 9OsR3.exe Token: SeDebugPrivilege 5052 9OsR3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe9OsR3.exeregsvr32.exedescription pid process target process PID 2052 wrote to memory of 5052 2052 cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe 9OsR3.exe PID 2052 wrote to memory of 5052 2052 cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe 9OsR3.exe PID 2052 wrote to memory of 5052 2052 cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe 9OsR3.exe PID 5052 wrote to memory of 2024 5052 9OsR3.exe regsvr32.exe PID 5052 wrote to memory of 2024 5052 9OsR3.exe regsvr32.exe PID 5052 wrote to memory of 2024 5052 9OsR3.exe regsvr32.exe PID 2024 wrote to memory of 1304 2024 regsvr32.exe regsvr32.exe PID 2024 wrote to memory of 1304 2024 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
9OsR3.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{50F5790A-D8C5-09E2-E4C8-2329629447E8} = "1" 9OsR3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe"C:\Users\Admin\AppData\Local\Temp\cffd8c5d75a79ac6c6e08c5e35a0d0437b5abafd29fa39edd4493ad70eb970c6.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2052 -
C:\Users\Admin\AppData\Local\Temp\17325d53\9OsR3.exe"C:\Users\Admin\AppData\Local\Temp/17325d53/9OsR3.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:5052 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SaveClicker\wXCP.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SaveClicker\wXCP.x64.dll"4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1304
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:420
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3624
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5558ec4bc163a2779f932df6d72243e40
SHA13e7d2b3839e9b1980d5ae31d6831cb7ea92314df
SHA256e6b77447ad9a55d9551fed335d5a9e28655a47291752668f9fe826eb46b50704
SHA5128dc7d4d453ca8e1a6e1c0f980a3d87689d4e899654b588b554851c150f562e71f42d2af3240b96db1b435b07ce76cc556435a89e54108ce1d1ace7d4076fc901
-
Filesize
325KB
MD5d316153e6feea98b96650c4f05e2f31a
SHA121ef422afe7f9bcbd86f0381b296a8f2d2f66fe4
SHA256c22e935a2b45bf48d94ee2f268b163d73b1b0c6c10f5ef6737591ec3da7c1578
SHA5129a9752d3cb544c3cbad053aa93e44e95892094099181a15b40b8dcf200180eb72eadd4fb1cd6792434d20e60d9ae433370a47ed19753317078e51e616438514c
-
Filesize
3KB
MD5736f8e927a2bc98863a50a76ac7a0973
SHA1fe78f86dc43442192b9f4e56dfdb35e36d23cfbb
SHA256b7fb683bbb4c444b7121ad4cb00a4b8f247ea32ee367a4d0bc6ea05e6803c45f
SHA512321e777413ee96dd05b3c412fd90b0e78ea8a9550a8d7af27d7a1530302833c97eb7e41b018e7bb89e82c8987e2527094b88ac94b74a3b5cc4b8bea1a0ef287e
-
Filesize
389KB
MD57cd46176b71eda0ecb89413ed185e606
SHA158f24d30eb5251a553ec7dac81f3fc2398e3e63e
SHA256b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7
SHA512217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd
-
Filesize
389KB
MD57cd46176b71eda0ecb89413ed185e606
SHA158f24d30eb5251a553ec7dac81f3fc2398e3e63e
SHA256b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7
SHA512217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd
-
Filesize
389KB
MD57cd46176b71eda0ecb89413ed185e606
SHA158f24d30eb5251a553ec7dac81f3fc2398e3e63e
SHA256b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7
SHA512217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd
-
Filesize
4KB
MD5558ec4bc163a2779f932df6d72243e40
SHA13e7d2b3839e9b1980d5ae31d6831cb7ea92314df
SHA256e6b77447ad9a55d9551fed335d5a9e28655a47291752668f9fe826eb46b50704
SHA5128dc7d4d453ca8e1a6e1c0f980a3d87689d4e899654b588b554851c150f562e71f42d2af3240b96db1b435b07ce76cc556435a89e54108ce1d1ace7d4076fc901
-
Filesize
564KB
MD50e40283546a07f8655a29d2dd0eb47b2
SHA1708483119bf61e380a38df9b3d951ed9fef578d5
SHA256175bc9c1241f15ae0a43f6b12fdc01337cb824c9b5ce6a51fdcbea7c4c98e323
SHA51256adfd58ee0314b77d8351b6ec266ade8f0f59ccf6ac48f6641531733cc9b2b836f18a0ec2952d7e6a30bd18a320c3d1d796f6619e93ae449c6ccf3195514926
-
Filesize
564KB
MD50e40283546a07f8655a29d2dd0eb47b2
SHA1708483119bf61e380a38df9b3d951ed9fef578d5
SHA256175bc9c1241f15ae0a43f6b12fdc01337cb824c9b5ce6a51fdcbea7c4c98e323
SHA51256adfd58ee0314b77d8351b6ec266ade8f0f59ccf6ac48f6641531733cc9b2b836f18a0ec2952d7e6a30bd18a320c3d1d796f6619e93ae449c6ccf3195514926
-
Filesize
146B
MD525c8ac01b346e43e6a5d26ea60b11618
SHA19da4ae63114e484f713bfe6624560bc050775c79
SHA2567357ddba4b884cce725bbf079c703be32e42dab4f14c4c42d3f4ec1e0dc53082
SHA512778cacb9e2f757b321687b65e947ecb2cea3984322ab60fa7ceeb6e26486b15837ea08c24da630a97ae40291310c05a8948b0c72223c26a1330566ed0eb4a582
-
Filesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
Filesize
5KB
MD5e95d4e3cb620f4db30624df516801e36
SHA1def0519a0f53dcea49f6a33d208d8f8eb6b824aa
SHA256e94251bc68b616c5e41ffb09beeec7fa88a8716435b69778373929507166285a
SHA5121a3c58029abf117e7fcc3ca69f0d074e4afd2d9dfe0fe9304bc3fe45e36478a9c50085aea76a9e8501c8875eee45bf8ad029390dd5d436356362ed12ccf8ae56
-
Filesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
Filesize
503B
MD5aa6fc24e028b07a032fbc6f859819dca
SHA1166f2c578c4f164da313ece0e914e56e053418c2
SHA2562f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038
SHA5124f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701
-
C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\bootstrap.js
Filesize2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\chrome.manifest
Filesize25B
MD5bf4e6c4808fb406d28937a29e4d24d85
SHA180f4eb9f3f27f0d790a95911043181c36c09fa88
SHA25648b4922bf9e4d278bb5ff08a9894fd45866b232f4c035d69c3d124f43d4e4420
SHA512a562815fa516f45fc60dbb4b4adad60b754d1cd97fac3a746a84e0ed8e162e6eb627b20fc6bafbad6aa7d432217151c9bf051b03a11ddc44d53a9f5ca6bdc9cd
-
C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\content\bg.js
Filesize7KB
MD5b5637bc8cf8f5e7ec8aa3482f52857c3
SHA1a38bf0bf115fa28498ce4cad14d461ba44112e2d
SHA25628f68aaa8f49c4d54e9ff7a0e0b20d68b2fca96b1ba646c1857c684e677ea9d3
SHA512470db88ebf5cc2cf13fc57e4be65892e25f9a6c20a09e12c5ff951066db1f56184738a1d8f51527142aeb4d37eb3adc114a218df327aefa45c5009f7a9500d44
-
C:\Users\Admin\AppData\Local\Temp\17325d53\[email protected]\install.rdf
Filesize607B
MD5b0a362e7cea1b548bf555e363de1f1ef
SHA19508c12fb8cb6cec4edb5d50ae91ec3dd25cd780
SHA256a3769a54c2cbe4faf88f681c2bfba894c565fe145ad2663a2cda7a7257d68a1f
SHA512a18267d42da37cacaed7537df82965739dccb83279a7edf76bace34cc967296ef3e0d8c9336779b143bb5cd6586c0ce75f23e9f6b482a6cb400bda551e1ae370
-
Filesize
325KB
MD5d316153e6feea98b96650c4f05e2f31a
SHA121ef422afe7f9bcbd86f0381b296a8f2d2f66fe4
SHA256c22e935a2b45bf48d94ee2f268b163d73b1b0c6c10f5ef6737591ec3da7c1578
SHA5129a9752d3cb544c3cbad053aa93e44e95892094099181a15b40b8dcf200180eb72eadd4fb1cd6792434d20e60d9ae433370a47ed19753317078e51e616438514c
-
Filesize
3KB
MD5736f8e927a2bc98863a50a76ac7a0973
SHA1fe78f86dc43442192b9f4e56dfdb35e36d23cfbb
SHA256b7fb683bbb4c444b7121ad4cb00a4b8f247ea32ee367a4d0bc6ea05e6803c45f
SHA512321e777413ee96dd05b3c412fd90b0e78ea8a9550a8d7af27d7a1530302833c97eb7e41b018e7bb89e82c8987e2527094b88ac94b74a3b5cc4b8bea1a0ef287e
-
Filesize
389KB
MD57cd46176b71eda0ecb89413ed185e606
SHA158f24d30eb5251a553ec7dac81f3fc2398e3e63e
SHA256b959f8550304467338e0b2975acf36b6c530e575d3cc6847f82fa7576fb86bb7
SHA512217eee22ebf8ca536e49378a6c831f71e0bdf6ef637d14395e8e765a9f2e1b98bbda0a9bf273592dc9665d9e63f72aa58fd9dbd66ede56f8855ee500c67becdd