Analysis
-
max time kernel
46s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 03:43
Static task
static1
Behavioral task
behavioral1
Sample
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe
Resource
win10v2004-20220901-en
General
-
Target
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe
-
Size
4.6MB
-
MD5
82785805b50a6fdae1a07c7d15987180
-
SHA1
4847916e5782f741535d98177f83fc767ca74652
-
SHA256
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa
-
SHA512
06744ac273fe99a7bea0ef3709afef074eaf376c1758f37f6059478a1e3e004da1fd1e6e6388e32607499b448599114325fd0049b8085ceb9c11822fd0b7a2bc
-
SSDEEP
98304:kcNYTQWN2AY10jOcT/4Akx+YmZW9f+WcZV:DY4XAkxOPV
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\3oBuOyuk7ePrKD.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exeregsvr32.exeregsvr32.exepid process 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe 1680 regsvr32.exe 268 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ = "YoutubeAdBlocke" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a}\NoExplorer = "1" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ = "YoutubeAdBlocke" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c9dc00c8-3dc3-4872-8690-78160bab793a} regsvr32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exedescription ioc process File created C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dll 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dll 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File created C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.dll 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.dll 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File created C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.tlb 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.tlb 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File created C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.dat 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe File opened for modification C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.dat 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe -
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exeregsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{c9dc00c8-3dc3-4872-8690-78160bab793a} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C9DC00C8-3DC3-4872-8690-78160BAB793A} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C9DC00C8-3DC3-4872-8690-78160BAB793A} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{c9dc00c8-3dc3-4872-8690-78160bab793a} regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
regsvr32.exe262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9DC00C8-3DC3-4872-8690-78160BAB793A}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ProgID 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9DC00C8-3DC3-4872-8690-78160BAB793A} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ = "YoutubeAdBlocke" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ProgID\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C9DC00C8-3DC3-4872-8690-78160BAB793A}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\VersionIndependentProgID 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C9DC00C8-3DC3-4872-8690-78160BAB793A} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\3oBuOyuk7ePrKD.dll" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C9DC00C8-3DC3-4872-8690-78160BAB793A}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{c9dc00c8-3dc3-4872-8690-78160bab793a}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ProgID\ = ".9" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\VersionIndependentProgID 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\Programmable 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ = "YoutubeAdBlocke" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "YoutubeAdBlocke" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\VersionIndependentProgID\ 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\3oBuOyuk7ePrKD.tlb" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdBlocke\\3oBuOyuk7ePrKD.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{c9dc00c8-3dc3-4872-8690-78160bab793a}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\InprocServer32\ThreadingModel = "Apartment" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{c9dc00c8-3dc3-4872-8690-78160bab793a}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "YoutubeAdBlocke" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a}\ProgID regsvr32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exeregsvr32.exedescription pid process target process PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1204 wrote to memory of 1680 1204 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe PID 1680 wrote to memory of 268 1680 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{c9dc00c8-3dc3-4872-8690-78160bab793a} = "1" 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe"C:\Users\Admin\AppData\Local\Temp\262df9260b5bd63d6862efdead6a56bb89476ab9730233525d705e02d5a064aa.exe"1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.datFilesize
4KB
MD56a10793ef7abfe4c8d7d01c3b25754a3
SHA1c2eb6dd4ffca2bebfbc090ad87226116797d1017
SHA256b732657b3cbee7ca5209e68482c9f2df1137fc2d7caeb8726ad9f5f452725b8f
SHA512decb1d7bd0e2503ca1d40a5b02495dff9eff074e111a9b15648a31f01cbb6dee9d7e0b691805658533a41147f96aa6f4ff9ccb5d4ec3b2000519d542a7964a13
-
C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.tlbFilesize
3KB
MD5b826030b97202e2efa7f7a60493c61a7
SHA18145289ac846d579df907dc43fa79fa5866f2930
SHA256df318425290a57dbdaffd19be838eb1317d38d00be224272168375251cb2f83f
SHA512246becba94b93fa2e79e9938efe94fd325e18ecd1ce93f642e184ba89d230a5cdf5596272e6ace3a7e9440e5aa9eb153bb8bc5ab6f3bc518fca9b790d4f8d6db
-
C:\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dllFilesize
879KB
MD50b282547d65c4597ac0f2c5cc09c3b37
SHA143a626f01c7ead04cee4b8523b02ee7248271051
SHA256c8dbfff7b084eb5ff31be01fbd03f392b4c7cb192e904810c7a9e60b985be846
SHA512541a816d8981656a697f96a89daad2a2d84c9f4a0769175babf8a2785ad6580c2fc3180575a8feeab39f5956176ef4ed4c80f433b557775c359ca3659219da30
-
\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.dllFilesize
741KB
MD50f2db92a7d763af605b6273a4aa18382
SHA1c9e6e9eb3c2050c86afa1b79e437ea8c8252573f
SHA256ebdf480f55d619da9a5f23810ef174f5e789d81899bf4f63371cfd95e402658a
SHA512824230a31cd7e7410c369dae190c1a3bec7498f52740b484e5d09c76265dbd71fb989f5ce889ca8a4f1ae28eb740e39d020b9581aa0496ae394d6ff3874038e5
-
\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dllFilesize
879KB
MD50b282547d65c4597ac0f2c5cc09c3b37
SHA143a626f01c7ead04cee4b8523b02ee7248271051
SHA256c8dbfff7b084eb5ff31be01fbd03f392b4c7cb192e904810c7a9e60b985be846
SHA512541a816d8981656a697f96a89daad2a2d84c9f4a0769175babf8a2785ad6580c2fc3180575a8feeab39f5956176ef4ed4c80f433b557775c359ca3659219da30
-
\Program Files (x86)\YoutubeAdBlocke\3oBuOyuk7ePrKD.x64.dllFilesize
879KB
MD50b282547d65c4597ac0f2c5cc09c3b37
SHA143a626f01c7ead04cee4b8523b02ee7248271051
SHA256c8dbfff7b084eb5ff31be01fbd03f392b4c7cb192e904810c7a9e60b985be846
SHA512541a816d8981656a697f96a89daad2a2d84c9f4a0769175babf8a2785ad6580c2fc3180575a8feeab39f5956176ef4ed4c80f433b557775c359ca3659219da30
-
memory/268-65-0x0000000000000000-mapping.dmp
-
memory/268-66-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1204-55-0x00000000008A0000-0x0000000000967000-memory.dmpFilesize
796KB
-
memory/1680-61-0x0000000000000000-mapping.dmp