2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb

Analysis

max time kernel
37s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
25-11-2022 03:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe
Size

2.0MB
MD5

db50908c54a6e2a38262c9e34f92aeff
SHA1

d0121b3055c644aaa52bab0d361f55c6f940a735
SHA256

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb
SHA512

30960dbc9d33369ae1d25a431e2374e29bed275fed5c5c8b31452000cb7ae09cb8755cfa906d683b86b92def86dbbdf52a32bee5b7d34f7e516a8961cb81f598
SSDEEP

49152:PWkg+8k0yn5E28REVPVxSCy2zRPOHQ/UZ8YROO19dJLkWoubXX2:PK+6M5R1V9K2BOHQ/i8m193oWoKXX2

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

Processes:

wlf.exe

pid process

1688 wlf.exe

pid	process
1688	wlf.exe

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\qG.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32	regsvr32.exe

Loads dropped DLL 4 IoCs

Processes:

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exewlf.exeregsvr32.exeregsvr32.exe

pid process

1920 2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe
1688 wlf.exe
1888 regsvr32.exe
1032 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
1920	2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe
1688	wlf.exe
1888	regsvr32.exe
1032	regsvr32.exe

Drops Chrome extension 3 IoCs

Processes:

wlf.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\cplfgpgifnooacjgepncmgnepadjcdfa\2.1\manifest.json	wlf.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\cplfgpgifnooacjgepncmgnepadjcdfa\2.1\manifest.json	wlf.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\cplfgpgifnooacjgepncmgnepadjcdfa\2.1\manifest.json	wlf.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exewlf.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ = "SaveClicker"	wlf.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\NoExplorer = "1"	wlf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ = "SaveClicker"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\NoExplorer = "1"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

wlf.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	wlf.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	wlf.exe
File opened for modification	C:\Windows\System32\GroupPolicy	wlf.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	wlf.exe

Drops file in Program Files directory 8 IoCs

Processes:

wlf.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SaveClicker\qG.dat	wlf.exe
File created	C:\Program Files (x86)\SaveClicker\qG.x64.dll	wlf.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\qG.x64.dll	wlf.exe
File created	C:\Program Files (x86)\SaveClicker\qG.dll	wlf.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\qG.dll	wlf.exe
File created	C:\Program Files (x86)\SaveClicker\qG.tlb	wlf.exe
File opened for modification	C:\Program Files (x86)\SaveClicker\qG.tlb	wlf.exe
File created	C:\Program Files (x86)\SaveClicker\qG.dat	wlf.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exewlf.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	wlf.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	wlf.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exewlf.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\CLSID\ = "{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}"	wlf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ProgID	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ = "SaveClicker"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\Programmable	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ProgID\ = "SaveClicker.2.1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32\ = "C:\\Program Files (x86)\\SaveClicker\\qG.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID\ = "{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker.2.1\ = "SaveClicker"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer\ = "SaveClicker.2.1"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SaveClicker\\qG.tlb"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	wlf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CLSID	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\CurVer	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\Implemented Categories	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SaveClicker.SaveClicker\ = "SaveClicker"	wlf.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\VersionIndependentProgID	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\ = "SaveClicker"	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32\ThreadingModel = "Apartment"	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32}\InprocServer32	wlf.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	wlf.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

wlf.exe

pid process

1688 wlf.exe
1688 wlf.exe
1688 wlf.exe
1688 wlf.exe
1688 wlf.exe
1688 wlf.exe
1688 wlf.exe
1688 wlf.exe

pid	process
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe
1688	wlf.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

wlf.exe

description	pid	process
Token: SeDebugPrivilege	1688	wlf.exe
Token: SeDebugPrivilege	1688	wlf.exe
Token: SeDebugPrivilege	1688	wlf.exe
Token: SeDebugPrivilege	1688	wlf.exe
Token: SeDebugPrivilege	1688	wlf.exe
Token: SeDebugPrivilege	1688	wlf.exe

Suspicious use of WriteProcessMemory 18 IoCs

Processes:

2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exewlf.exeregsvr32.exe

description	pid	process	target process
PID 1920 wrote to memory of 1688	1920	2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe	wlf.exe
PID 1920 wrote to memory of 1688	1920	2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe	wlf.exe
PID 1920 wrote to memory of 1688	1920	2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe	wlf.exe
PID 1920 wrote to memory of 1688	1920	2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe	wlf.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1688 wrote to memory of 1888	1688	wlf.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe
PID 1888 wrote to memory of 1032	1888	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

wlf.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	wlf.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{A7686564-1BC1-09E4-3ED5-F64F58EDAD32} = "1"	wlf.exe

C:\Users\Admin\AppData\Local\Temp\2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe
"C:\Users\Admin\AppData\Local\Temp\2c2377ea2c47f57214f5c40a7f91678fcf513574f53b69379e855cef1a29befb.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920

C:\Users\Admin\AppData\Local\Temp\561c54c9\wlf.exe
"C:\Users\Admin\AppData\Local\Temp/561c54c9/wlf.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1688

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SaveClicker\qG.x64.dll"
3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SaveClicker\qG.x64.dll"
4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1032

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SaveClicker\qG.dat
Filesize
4KB

MD5
404e3e4c41fceabff7e43b565088c214

SHA1
5de02592c56e92e9bedda4b7bd6608c424260bf2

SHA256
11b31eb0c207a1d70ffbb6760ed232b99b5af5d06aa5f840a3698558c95e6cb6

SHA512
c3979e55e6aa5b13bb87b4e40512c1a7481e30e1f3c77c8b0600e9b43225a181ee5553ea9b39749a559abd6ac2d4e12365ed3abf903be6035806c4398cb270ae

Download Submit
C:\Program Files (x86)\SaveClicker\qG.tlb
Filesize
3KB

MD5
4b46ab33bd63a977a2d192237d1316ba

SHA1
aa8c0a2e463518e9e8fe586d77246a82bd466388

SHA256
f09edcd79b72676ecea862f6885bfafec198301a511c617637824269373f7d96

SHA512
6076742823cf74786d2eb8176e570281fc5ad440b1a6ddfdbe7ab64ab3c3f13451b251e23eb48a532fdfed711b1e8e2393873bca53cbb36c14326b70c68a8620

Download Submit
C:\Program Files (x86)\SaveClicker\qG.x64.dll
Filesize
677KB

MD5
8b1b16e0effe08141cce8b13907baf88

SHA1
030dae3d6044d4d3da5b6135768b4b2ea07d717b

SHA256
3c20da8399e21c1ca0a8e4783f4f3229fabaa818a64e538d9677a79cd2b01067

SHA512
c8040726155baf354783ea984a538ef4763a5939a4a8a443585c6c65b88c66896d98c3fb13a70607c583edc11f2690010c0a5712ad7fe253993b3d5263ef32d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\cplfgpgifnooacjgepncmgnepadjcdfa\background.html
Filesize
142B

MD5
e9a973e9f483f79bd2c59fd7a115f4ce

SHA1
5540a1537cae92a2bf52bfb48e3ce6723899cd8d

SHA256
a73a02397e5a0416c1ce4113845cf28efc694bf4f8ec87f444e381aa36e0fb58

SHA512
37e419b56f5ecc9e6da738f2b8167d95f8c87ae1e755ef530c9acdb78ea78db08a660b7678883075f810640b6bc74db8a7f0d79c3635c92f3731df242f616486

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\cplfgpgifnooacjgepncmgnepadjcdfa\content.js
Filesize
144B

MD5
fca19198fd8af21016a8b1dec7980002

SHA1
fd01a47d14004e17a625efe66cc46a06c786cf40

SHA256
332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a

SHA512
60f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\cplfgpgifnooacjgepncmgnepadjcdfa\lsdb.js
Filesize
531B

MD5
36d98318ab2b3b2585a30984db328afb

SHA1
f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5

SHA256
ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7

SHA512
6f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\cplfgpgifnooacjgepncmgnepadjcdfa\manifest.json
Filesize
503B

MD5
aa6fc24e028b07a032fbc6f859819dca

SHA1
166f2c578c4f164da313ece0e914e56e053418c2

SHA256
2f026100e6faf41a63ea0c5d289914bfceba28094b32c9a3566a4932b7c71038

SHA512
4f5328b27ace6ec4d786e7369b8a071fedf46f30e0b1d223d8fa9332d1df60914f22b84725e3055c894f027f79f05dd91d47ae5c22bebaad34c0af440f634701

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\cplfgpgifnooacjgepncmgnepadjcdfa\vyAE2.js
Filesize
5KB

MD5
9929598cdbfc4f8a7f24132faef480af

SHA1
a95415b371d12dd6b38c22b0645285531b8061a2

SHA256
24e62e94d7b7e5be717748603652a4aac8cf3ccb6e1f8460ece6909fb355b308

SHA512
7e9a76345a946c9dd29554ed8d0e77e682f15933449291f0b6738b338d6158e5ebc7f0b1317cebefb7e9634475188f34ae78300b0f05ee4515bf132b66b1af2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\qG.dll
Filesize
600KB

MD5
2653f6fc68416efdb6d53e9f41cbf257

SHA1
3c6ca5ada45733c2c3445259c5a3194b62085878

SHA256
02fd6fc2d95705d77e0646b5b6f7e949774b2ad6b01827087d762888477c7a28

SHA512
41bdb7df2d312e4c9248b55fea3bcfa1c292a7340347041c8757413d63e218abc54c9de49323420b2bc01d7a39585989cd1b9f57177eade7ecaab7cd14326b1d

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\qG.tlb
Filesize
3KB

MD5
4b46ab33bd63a977a2d192237d1316ba

SHA1
aa8c0a2e463518e9e8fe586d77246a82bd466388

SHA256
f09edcd79b72676ecea862f6885bfafec198301a511c617637824269373f7d96

SHA512
6076742823cf74786d2eb8176e570281fc5ad440b1a6ddfdbe7ab64ab3c3f13451b251e23eb48a532fdfed711b1e8e2393873bca53cbb36c14326b70c68a8620

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\qG.x64.dll
Filesize
677KB

MD5
8b1b16e0effe08141cce8b13907baf88

SHA1
030dae3d6044d4d3da5b6135768b4b2ea07d717b

SHA256
3c20da8399e21c1ca0a8e4783f4f3229fabaa818a64e538d9677a79cd2b01067

SHA512
c8040726155baf354783ea984a538ef4763a5939a4a8a443585c6c65b88c66896d98c3fb13a70607c583edc11f2690010c0a5712ad7fe253993b3d5263ef32d2

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\wlf.dat
Filesize
4KB

MD5
404e3e4c41fceabff7e43b565088c214

SHA1
5de02592c56e92e9bedda4b7bd6608c424260bf2

SHA256
11b31eb0c207a1d70ffbb6760ed232b99b5af5d06aa5f840a3698558c95e6cb6

SHA512
c3979e55e6aa5b13bb87b4e40512c1a7481e30e1f3c77c8b0600e9b43225a181ee5553ea9b39749a559abd6ac2d4e12365ed3abf903be6035806c4398cb270ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\wlf.exe
Filesize
621KB

MD5
b32b392575b6dc7780f8782b188bb72f

SHA1
b11ab76d07606745fab8c9a6d812257501f49441

SHA256
acc4549abff20e2fb0f4a9a978ed4a68ce3fa39dbd07b4b49f34c852c8c12646

SHA512
73bcad58db6b75535665b3626defbf01c2a67778e9167f99867449c2601f224b77924559ddac1f1215186b9694d99da1ba8a6e4ccf5457ba3d951d28ba584359

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\wlf.exe
Filesize
621KB

MD5
b32b392575b6dc7780f8782b188bb72f

SHA1
b11ab76d07606745fab8c9a6d812257501f49441

SHA256
acc4549abff20e2fb0f4a9a978ed4a68ce3fa39dbd07b4b49f34c852c8c12646

SHA512
73bcad58db6b75535665b3626defbf01c2a67778e9167f99867449c2601f224b77924559ddac1f1215186b9694d99da1ba8a6e4ccf5457ba3d951d28ba584359

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\[email protected]\bootstrap.js
Filesize
2KB

MD5
df13f711e20e9c80171846d4f2f7ae06

SHA1
56d29cda58427efe0e21d3880d39eb1b0ef60bee

SHA256
6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4

SHA512
6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\[email protected]\chrome.manifest
Filesize
23B

MD5
3bd37a69c91a8a4d5c335d390070456e

SHA1
31ffc131deea8f747ac939f57524e8dca63c3bb9

SHA256
ba0b0a1ac75513825d4e40ea5aafe1f5bdb37ed0f6c6f7bcf3e433c88348fb13

SHA512
706dbd8aa64160d1d26b84eb8b4eb695be43f679bdc67963f570b88130bf1b43141a129f566ac91b80f2eb337a17bfd25139f06b676ba0f1642ea2f14104138b

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\[email protected]\content\bg.js
Filesize
7KB

MD5
9176f8c8bbc8752f69c17c71d2d355f0

SHA1
7ca670b346f8c8af83b4343b5a251ab7e94865e5

SHA256
5a4d3f2637d2c3acf279149af0f302ea2007e3cfb44880f8467d11b9df8043f4

SHA512
500a5b33aceb8c90acef93e263398f9277383c8f022bdcc031897bd24843a974619c24aa72f0471679011a6190017fcc5a28c6fd12286c69ad1db69a725d8fdb

Download Submit
C:\Users\Admin\AppData\Local\Temp\561c54c9\[email protected]\install.rdf
Filesize
602B

MD5
e37e8de9272e76a891606327faef4467

SHA1
6eed476ba7db6b8c8818bad2f410f7c63840165c

SHA256
ad079dc7baba7f8aeb24bf58e6a63dade70027ece566dee132469f4fad3aaf50

SHA512
6642a2dbe3134224e8e258dfaa33251be4ea0015c503fed2c0899a6d073d87066173aba5588a1de0f11bc4cc3a75df55e7faa5c6972d1f411eeb75a8a8734532

Download Submit
\Program Files (x86)\SaveClicker\qG.dll
Filesize
600KB

MD5
2653f6fc68416efdb6d53e9f41cbf257

SHA1
3c6ca5ada45733c2c3445259c5a3194b62085878

SHA256
02fd6fc2d95705d77e0646b5b6f7e949774b2ad6b01827087d762888477c7a28

SHA512
41bdb7df2d312e4c9248b55fea3bcfa1c292a7340347041c8757413d63e218abc54c9de49323420b2bc01d7a39585989cd1b9f57177eade7ecaab7cd14326b1d

Download Submit
\Program Files (x86)\SaveClicker\qG.x64.dll
Filesize
677KB

MD5
8b1b16e0effe08141cce8b13907baf88

SHA1
030dae3d6044d4d3da5b6135768b4b2ea07d717b

SHA256
3c20da8399e21c1ca0a8e4783f4f3229fabaa818a64e538d9677a79cd2b01067

SHA512
c8040726155baf354783ea984a538ef4763a5939a4a8a443585c6c65b88c66896d98c3fb13a70607c583edc11f2690010c0a5712ad7fe253993b3d5263ef32d2

Download Submit
\Program Files (x86)\SaveClicker\qG.x64.dll
Filesize
677KB

MD5
8b1b16e0effe08141cce8b13907baf88

SHA1
030dae3d6044d4d3da5b6135768b4b2ea07d717b

SHA256
3c20da8399e21c1ca0a8e4783f4f3229fabaa818a64e538d9677a79cd2b01067

SHA512
c8040726155baf354783ea984a538ef4763a5939a4a8a443585c6c65b88c66896d98c3fb13a70607c583edc11f2690010c0a5712ad7fe253993b3d5263ef32d2

Download Submit
\Users\Admin\AppData\Local\Temp\561c54c9\wlf.exe
Filesize
621KB

MD5
b32b392575b6dc7780f8782b188bb72f

SHA1
b11ab76d07606745fab8c9a6d812257501f49441

SHA256
acc4549abff20e2fb0f4a9a978ed4a68ce3fa39dbd07b4b49f34c852c8c12646

SHA512
73bcad58db6b75535665b3626defbf01c2a67778e9167f99867449c2601f224b77924559ddac1f1215186b9694d99da1ba8a6e4ccf5457ba3d951d28ba584359

Download Submit
memory/1032-77-0x0000000000000000-mapping.dmp

Download
memory/1032-78-0x000007FEFC1F1000-0x000007FEFC1F3000-memory.dmp

Filesize
8KB

Download
memory/1688-56-0x0000000000000000-mapping.dmp

Download
memory/1888-73-0x0000000000000000-mapping.dmp

Download
memory/1920-54-0x00000000763F1000-0x00000000763F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads