2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4

General

Target

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Size

4.5MB
MD5

ec313f6381c56c5958760032a48769c4
SHA1

a78a120ef41750f1b4db5e4117f855c2b6a2c8bb
SHA256

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4
SHA512

31706bf0ff8b9537da77077574fe0d73963a1f00d84058329a09d0d65c382509b0fa2dc2dc490c7083de01a58cf887240ead3308925108f4376d23d9ff0bd1f9
SSDEEP

98304:BoyDpi4TTjfi8QzCvNir97CLabGg4q/zES8HvND4S76fPit/Rfyb9YDXeCOzfdnT:NXUrTbGg4q/z+t74L

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32\ = "C:\\Program Files (x86)\\GoSave\\YZTZk0MdD2M7ad.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exeregsvr32.exeregsvr32.exe

pid process

848 2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
820 regsvr32.exe
2028 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\efjpdimgjncobfkfefebbkpofampnikn\2.0\manifest.json	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\efjpdimgjncobfkfefebbkpofampnikn\2.0\manifest.json	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\efjpdimgjncobfkfefebbkpofampnikn\2.0\manifest.json	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ = "GoSave"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\NoExplorer = "1"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ = "GoSave"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Drops file in Program Files directory 8 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

description	ioc	process
File created	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dat	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dat	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dll	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dll	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File created	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.tlb	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
File opened for modification	C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.tlb	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Modifies registry class 64 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ = "GoSave"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ProgID\ = ".9"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}\Implemented Categories	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{28e8763c-b6ae-4ee1-b77f-69849d8d9831}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSave"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ProgID\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28E8763C-B6AE-4EE1-B77F-69849D8D9831}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ProgID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\Programmable	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32\ = "C:\\Program Files (x86)\\GoSave\\YZTZk0MdD2M7ad.dll"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\VersionIndependentProgID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ = "GoSave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSave\\YZTZk0MdD2M7ad.tlb"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSave"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{28e8763c-b6ae-4ee1-b77f-69849d8d9831}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\InprocServer32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\ProgID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831}\VersionIndependentProgID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

pid	process
848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exeregsvr32.exe

description	pid	process	target process
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 848 wrote to memory of 820	848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe
PID 820 wrote to memory of 2028	820	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{28e8763c-b6ae-4ee1-b77f-69849d8d9831} = "1"	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe

C:\Users\Admin\AppData\Local\Temp\2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
"C:\Users\Admin\AppData\Local\Temp\2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:848

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:820

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2028

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dat
Filesize
4KB

MD5
ddb8d340f6bbcaee23c29321f556b1fb

SHA1
3d4b90815381708fad0a0ef72f5e9f9893f9871e

SHA256
f363dfb651920177c7e4c6e5b85ad79d56f9ad9236c74ef900f0faf10a1d284b

SHA512
9cd7ba7fbc38f756f9746cee2b5b72c35b0f9c140a6e56a4935d7dd7c384546a5ebcbb3c96d67100f89896c59770d3114d99ce17ca81fb64eafd123d22053dbb

Download Submit
C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.tlb
Filesize
3KB

MD5
7602225625cdd47f748f0656ea2bbfde

SHA1
686147caee96271092cd882c341fa3a37a5ebc70

SHA256
7191c986561d571c37d74ede50fc158c7cb037e9d50aa7056eb65ae264e63465

SHA512
5dda72246676c852cfd83fe71a9f08a1388714fd39e7d618b75dfb2de848b2104c2040e544cc8ad4db0055960b0dfb8dd333b2d279784414955ee2aafc4a0bc5

Download Submit
C:\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll
Filesize
701KB

MD5
90c1f871f4890f39667e7b149f297b2b

SHA1
e99fe2ffb087bf78272d0d5fe4f5501f42504c05

SHA256
e8a6bfc67352fa598e9ee363bd099b3d51191dc6bd536dbb096ed43986edec46

SHA512
fc3230c5f406313d89c36d5119f2db178ca2cf3d209c26df80571b084fe156d4e9c69f71a5ff7183d0fddfc2a42b3af9b97c6803f312598bc3a90b4d89868d44

Download Submit
\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.dll
Filesize
622KB

MD5
76deb7dec4a615399ba9a1262e674bb3

SHA1
e7ff08fdae617738fd2517f4056ef1075fa9a336

SHA256
2faa672dee58c448d2dbe85c9a785b4791047964b297697847f3711f9c1a90d6

SHA512
6e51859656add39b720ff7ea44f7b16b73f80d73740897e198a657d6ce88a1615ea1405920a5f8dba6c3f0c130ae26e95d9de83171bed9781184cf5a0a101a09

Download Submit
\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll
Filesize
701KB

MD5
90c1f871f4890f39667e7b149f297b2b

SHA1
e99fe2ffb087bf78272d0d5fe4f5501f42504c05

SHA256
e8a6bfc67352fa598e9ee363bd099b3d51191dc6bd536dbb096ed43986edec46

SHA512
fc3230c5f406313d89c36d5119f2db178ca2cf3d209c26df80571b084fe156d4e9c69f71a5ff7183d0fddfc2a42b3af9b97c6803f312598bc3a90b4d89868d44

Download Submit
\Program Files (x86)\GoSave\YZTZk0MdD2M7ad.x64.dll
Filesize
701KB

MD5
90c1f871f4890f39667e7b149f297b2b

SHA1
e99fe2ffb087bf78272d0d5fe4f5501f42504c05

SHA256
e8a6bfc67352fa598e9ee363bd099b3d51191dc6bd536dbb096ed43986edec46

SHA512
fc3230c5f406313d89c36d5119f2db178ca2cf3d209c26df80571b084fe156d4e9c69f71a5ff7183d0fddfc2a42b3af9b97c6803f312598bc3a90b4d89868d44

Download Submit
memory/820-62-0x0000000000000000-mapping.dmp

Download
memory/848-54-0x0000000074C91000-0x0000000074C93000-memory.dmp

Filesize
8KB

Download
memory/848-55-0x00000000003D0000-0x0000000000477000-memory.dmp

Filesize
668KB

Download
memory/2028-66-0x0000000000000000-mapping.dmp

Download
memory/2028-67-0x000007FEFB761000-0x000007FEFB763000-memory.dmp

Filesize
8KB

Download

pid	process
848	2d922b499bb7a3fa25511796adbbd6850a679d3ba5639f77d20ad78cffb75fd4.exe
820	regsvr32.exe
2028	regsvr32.exe

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads