62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958

General

Target

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Size

3.7MB
MD5

05bcb822a0b54a38e4cb0c27a27da4eb
SHA1

63527c84bd32c61f616a37cd520a87cbbd28d565
SHA256

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958
SHA512

d85e473de8d7cff0b6d186516c524cae9e32c2b88c4d3d29399996b34683ae71108044b7878c84171c2dcea62daa0a13c1cf86bf030f033322f4e40190541777
SSDEEP

49152:iZ2ySgxhTuiICa6oypppAC7G53wJnLj+oThmV1v7ViFQ2P85PCJBNsW6CA:WhlICfmC7G8nLioT4nzT2kIDN

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ = "C:\\Program Files (x86)\\YOuutubeeAAdBluockee\\lo6HSDS74MJ5No.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exeregsvr32.exeregsvr32.exe

pid process

1264 62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
1772 regsvr32.exe
1960 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
1772	regsvr32.exe
1960	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}\ = "YOuutubeeAAdBluockee"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}\NoExplorer = "1"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}\ = "YOuutubeeAAdBluockee"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8549cd06-f381-495c-bb89-a7337e196441}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dll	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File created	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.tlb	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File opened for modification	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.tlb	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File created	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dat	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File opened for modification	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dat	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File created	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File opened for modification	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
File created	C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dll	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8549CD06-F381-495C-BB89-A7337E196441}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8549cd06-f381-495c-bb89-a7337e196441}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8549cd06-f381-495c-bb89-a7337e196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8549CD06-F381-495C-BB89-A7337E196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

Modifies registry class 64 IoCs

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{8549cd06-f381-495c-bb89-a7337e196441}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\YOuutubeeAAdBluockee"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ = "C:\\Program Files (x86)\\YOuutubeeAAdBluockee\\lo6HSDS74MJ5No.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549CD06-F381-495C-BB89-A7337E196441}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\Programmable	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{8549cd06-f381-495c-bb89-a7337e196441}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ = "C:\\Program Files (x86)\\YOuutubeeAAdBluockee\\lo6HSDS74MJ5No.dll"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\InprocServer32\ThreadingModel = "Apartment"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\VersionIndependentProgID	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YOuutubeeAAdBluockee\\lo6HSDS74MJ5No.tlb"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "YOuutubeeAAdBluockee"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8549CD06-F381-495C-BB89-A7337E196441}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\ = "YOuutubeeAAdBluockee"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549CD06-F381-495C-BB89-A7337E196441}\Implemented Categories	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\ProgID	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549CD06-F381-495C-BB89-A7337E196441}	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{8549cd06-f381-495c-bb89-a7337e196441}\VersionIndependentProgID	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exeregsvr32.exe

description	pid	process	target process
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1264 wrote to memory of 1772	1264	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe
PID 1772 wrote to memory of 1960	1772	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{8549cd06-f381-495c-bb89-a7337e196441} = "1"	62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe

C:\Users\Admin\AppData\Local\Temp\62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe
"C:\Users\Admin\AppData\Local\Temp\62028da11b3c31dff4ab47e5a0b0b16327e7ddaabb2bf0d63f5ff7391d134958.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1264
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1772
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll"
    3⤵
    - Registers COM server for autorun
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1960

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dat

Filesize
4KB

MD5
b7e0d69e1168c3054fb27a2d9b4024d0

SHA1
4c52cf6b2ffec3bc5eff98e1e1d7367a88721c94

SHA256
45e083ecde3c3dc9576fba29a3aa034c2e9ab56db5a545206325c7675bb4c959

SHA512
a98c25633e50d9903dc312be4e80f29f906cdc3d9aaafaffac75f9865988054a5a0569588d2050ecd037f91f5b3ca6a26e613670d8390d2f177f43c4f24d6747

Download Submit
C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.tlb

Filesize
3KB

MD5
e1ccf2e2dc93dd6a8927a6a4c375cbf3

SHA1
6bb9a0affe3c3b578a9260203e27cf075f0c1e97

SHA256
bf1bebb0095af9e438bc56a22b44e8afc85be11c724101bb9ec5c73086cfd411

SHA512
4a63951366c5cfbb05168bb3c232f5b4ca88e1104fc417fcace08479b11e171928379b2eace384e471f0a96e39aa9c22b8153683c43c961830d2f74c1eae23de

Download Submit
C:\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll

Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.dll

Filesize
619KB

MD5
5e35cea39dca842e67bac26c3fdd9d1c

SHA1
df707169ba389d66f018c6c91b44fed189bf90f7

SHA256
2ffd483b8f32d93802a44acf46c920ba91a7dcaee0e6bf8b7fd22cecdc27fa3f

SHA512
9ba60c200a22712b86d20407bf98e70e8a9a3a104d0dd5be6a1fb4a547a77d28c1fd824a5af8c6201ff3a98ee451c1ee4fd7902ee79c01e82221e149100e0665

Download Submit
\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll

Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\YOuutubeeAAdBluockee\lo6HSDS74MJ5No.x64.dll

Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
memory/1264-54-0x0000000075601000-0x0000000075603000-memory.dmp

Filesize
8KB

Download
memory/1264-55-0x00000000007C0000-0x0000000000862000-memory.dmp

Filesize
648KB

Download
memory/1772-61-0x0000000000000000-mapping.dmp

Download
memory/1960-65-0x0000000000000000-mapping.dmp

Download
memory/1960-66-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads