Analysis
-
max time kernel
204s -
max time network
245s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 04:04
Static task
static1
Behavioral task
behavioral1
Sample
1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe
Resource
win10v2004-20221111-en
General
-
Target
1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe
-
Size
2.7MB
-
MD5
75978bda1f9d57c316358ed7f87e6172
-
SHA1
2f3386e5ff8282aa2e27e88d3c0de37770059195
-
SHA256
1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235
-
SHA512
82504407a77222382de918a58ad59cd5c60ef85b2819f9adf552384dc761e959b53dbee271bfa9212bde3fe7ad0d114422588f9b656349ace047a13f73add812
-
SSDEEP
49152:6zfLl4rZeNXUVv9PnbhQFWBHxtRYrM7dbsCXTh:C4rZPveyTarM7dD
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
i1TIlN664GIHYHH.exepid process 4864 i1TIlN664GIHYHH.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32\ = "C:\\Program Files (x86)\\GoSave\\B5Stow7AE55FBF.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
i1TIlN664GIHYHH.exeregsvr32.exeregsvr32.exepid process 4864 i1TIlN664GIHYHH.exe 3256 regsvr32.exe 1284 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
i1TIlN664GIHYHH.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecjmjncpphdmblffigkcfmnenehkmkbi\2.0\manifest.json i1TIlN664GIHYHH.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecjmjncpphdmblffigkcfmnenehkmkbi\2.0\manifest.json i1TIlN664GIHYHH.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecjmjncpphdmblffigkcfmnenehkmkbi\2.0\manifest.json i1TIlN664GIHYHH.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecjmjncpphdmblffigkcfmnenehkmkbi\2.0\manifest.json i1TIlN664GIHYHH.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ecjmjncpphdmblffigkcfmnenehkmkbi\2.0\manifest.json i1TIlN664GIHYHH.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exei1TIlN664GIHYHH.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ = "GoSave" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ = "GoSave" i1TIlN664GIHYHH.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\NoExplorer = "1" i1TIlN664GIHYHH.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
i1TIlN664GIHYHH.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy i1TIlN664GIHYHH.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini i1TIlN664GIHYHH.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol i1TIlN664GIHYHH.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI i1TIlN664GIHYHH.exe -
Drops file in Program Files directory 8 IoCs
Processes:
i1TIlN664GIHYHH.exedescription ioc process File created C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.dat i1TIlN664GIHYHH.exe File opened for modification C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.dat i1TIlN664GIHYHH.exe File created C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dll i1TIlN664GIHYHH.exe File opened for modification C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dll i1TIlN664GIHYHH.exe File created C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.dll i1TIlN664GIHYHH.exe File opened for modification C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.dll i1TIlN664GIHYHH.exe File created C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.tlb i1TIlN664GIHYHH.exe File opened for modification C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.tlb i1TIlN664GIHYHH.exe -
Processes:
i1TIlN664GIHYHH.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697} i1TIlN664GIHYHH.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration i1TIlN664GIHYHH.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration i1TIlN664GIHYHH.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} i1TIlN664GIHYHH.exe -
Modifies registry class 64 IoCs
Processes:
i1TIlN664GIHYHH.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\VersionIndependentProgID i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697}\Implemented Categories i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSave" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ = "GoSave" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\VersionIndependentProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\Programmable i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697} i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ = "GoSave" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{cc3cdf24-a18a-4213-8ece-5e55d20fb697}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "GoSave" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID i1TIlN664GIHYHH.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSave" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CC3CDF24-A18A-4213-8ECE-5E55D20FB697} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{cc3cdf24-a18a-4213-8ece-5e55d20fb697}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32\ = "C:\\Program Files (x86)\\GoSave\\B5Stow7AE55FBF.x64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\ProgID i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\VersionIndependentProgID\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSave" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID i1TIlN664GIHYHH.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697}\InprocServer32 i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" i1TIlN664GIHYHH.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 i1TIlN664GIHYHH.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{cc3cdf24-a18a-4213-8ece-5e55d20fb697}" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
i1TIlN664GIHYHH.exepid process 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe 4864 i1TIlN664GIHYHH.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
i1TIlN664GIHYHH.exedescription pid process Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe Token: SeDebugPrivilege 4864 i1TIlN664GIHYHH.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exei1TIlN664GIHYHH.exeregsvr32.exedescription pid process target process PID 956 wrote to memory of 4864 956 1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe i1TIlN664GIHYHH.exe PID 956 wrote to memory of 4864 956 1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe i1TIlN664GIHYHH.exe PID 956 wrote to memory of 4864 956 1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe i1TIlN664GIHYHH.exe PID 4864 wrote to memory of 3256 4864 i1TIlN664GIHYHH.exe regsvr32.exe PID 4864 wrote to memory of 3256 4864 i1TIlN664GIHYHH.exe regsvr32.exe PID 4864 wrote to memory of 3256 4864 i1TIlN664GIHYHH.exe regsvr32.exe PID 3256 wrote to memory of 1284 3256 regsvr32.exe regsvr32.exe PID 3256 wrote to memory of 1284 3256 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
i1TIlN664GIHYHH.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{cc3cdf24-a18a-4213-8ece-5e55d20fb697} = "1" i1TIlN664GIHYHH.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe"C:\Users\Admin\AppData\Local\Temp\1f9e7de02978388d46014a7be0446d29e3f06d2a1fa01cbfe90beb6c2e412235.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\i1TIlN664GIHYHH.exe"C:\Users\Admin\AppData\Local\Temp/3d5e48f1/i1TIlN664GIHYHH.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4864 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dll"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dll"4⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1284
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3904
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4492
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.datFilesize
4KB
MD599d4926f1868a0aa78fc94b8c36be766
SHA10cb3685ad5221411039af3de722128201ff3314b
SHA25603b8ee6fb575802a12ea928fea57222787a7a0112e865ca4d3a6d5ddff6766d9
SHA5127832858a3cb8ddeba31e8178fc9ddeeadb24a6e08f14ca0b11ecf7250508ca929594b25ff9d93816ceb3a6f0338adb693f36d31808f97444f82cbf7d502a18ff
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.dllFilesize
746KB
MD58a167580cd1dd37bd496c810951e265c
SHA164dd7babc6b7a2614306cc68929d38cc5b6ae0b2
SHA25673cdc61ec4b161fbc4017ef7b8ed73e593439875608c336d57098bac796912ec
SHA51228fd5a1e3554976eddeace6772236b22996448207bab74bcdf6acca2e7880293893f4ecfa5ea3ef54fd073fb226de1de1e6c708e5acd3a51d3878b1fe54ba27f
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.tlbFilesize
3KB
MD56913bf1ba01b10787f0b5b1d8788071a
SHA19a1fe110cd29b99508385b1b1e5cb83e6e2b10ec
SHA25640b0d7a3f86ad964a12d142c9544d015e252e98e2ebab0895ee9df6f3946110c
SHA512c0410368dd71668a1e34bc81536bc2e8a1b19f6c51455f87205f6f2bf0c9ec04a8994c39c4edbd137c04fd1871b5dc19f7c82a9c83a814c17e4a2dd160cb1b1d
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dllFilesize
878KB
MD5ec4e3ee93c7c6caf8e77b2f2b910c82e
SHA1b8c90bd001c371fadd683a9106b692a0dc6706c8
SHA256ac086b67b1485da29052d256365a25dc9de3082bce7f55b64582152c00aac942
SHA512a3ca51f000cd9092213c5e263f5f23be8deba913ad4f77a8a9b9239fe9807ef10224e26e16437a5862de4ccabda17d37e81d181882ba2ba5bb2515970d36a6c9
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dllFilesize
878KB
MD5ec4e3ee93c7c6caf8e77b2f2b910c82e
SHA1b8c90bd001c371fadd683a9106b692a0dc6706c8
SHA256ac086b67b1485da29052d256365a25dc9de3082bce7f55b64582152c00aac942
SHA512a3ca51f000cd9092213c5e263f5f23be8deba913ad4f77a8a9b9239fe9807ef10224e26e16437a5862de4ccabda17d37e81d181882ba2ba5bb2515970d36a6c9
-
C:\Program Files (x86)\GoSave\B5Stow7AE55FBF.x64.dllFilesize
878KB
MD5ec4e3ee93c7c6caf8e77b2f2b910c82e
SHA1b8c90bd001c371fadd683a9106b692a0dc6706c8
SHA256ac086b67b1485da29052d256365a25dc9de3082bce7f55b64582152c00aac942
SHA512a3ca51f000cd9092213c5e263f5f23be8deba913ad4f77a8a9b9239fe9807ef10224e26e16437a5862de4ccabda17d37e81d181882ba2ba5bb2515970d36a6c9
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\B5Stow7AE55FBF.dllFilesize
746KB
MD58a167580cd1dd37bd496c810951e265c
SHA164dd7babc6b7a2614306cc68929d38cc5b6ae0b2
SHA25673cdc61ec4b161fbc4017ef7b8ed73e593439875608c336d57098bac796912ec
SHA51228fd5a1e3554976eddeace6772236b22996448207bab74bcdf6acca2e7880293893f4ecfa5ea3ef54fd073fb226de1de1e6c708e5acd3a51d3878b1fe54ba27f
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\B5Stow7AE55FBF.tlbFilesize
3KB
MD56913bf1ba01b10787f0b5b1d8788071a
SHA19a1fe110cd29b99508385b1b1e5cb83e6e2b10ec
SHA25640b0d7a3f86ad964a12d142c9544d015e252e98e2ebab0895ee9df6f3946110c
SHA512c0410368dd71668a1e34bc81536bc2e8a1b19f6c51455f87205f6f2bf0c9ec04a8994c39c4edbd137c04fd1871b5dc19f7c82a9c83a814c17e4a2dd160cb1b1d
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\B5Stow7AE55FBF.x64.dllFilesize
878KB
MD5ec4e3ee93c7c6caf8e77b2f2b910c82e
SHA1b8c90bd001c371fadd683a9106b692a0dc6706c8
SHA256ac086b67b1485da29052d256365a25dc9de3082bce7f55b64582152c00aac942
SHA512a3ca51f000cd9092213c5e263f5f23be8deba913ad4f77a8a9b9239fe9807ef10224e26e16437a5862de4ccabda17d37e81d181882ba2ba5bb2515970d36a6c9
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\ecjmjncpphdmblffigkcfmnenehkmkbi\H79A.jsFilesize
6KB
MD5c7105a0d3e2f577f2795535c7da3bc67
SHA136ae7fe69ef7c379e5e5a4179927da76a1c2a0b5
SHA256c66d0c1ad8e87271799591ccce5de1cc5ff7abbcf08b9e42af409e1bb705e30f
SHA5129487d55eb6bf9f338fc022569473932585a3caa5d5984a638b011a226ee66d80f2b0800a7b7bbedd49142a1a30b8be874f9fcb4f72e64a620f788ad86c16e575
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\ecjmjncpphdmblffigkcfmnenehkmkbi\background.htmlFilesize
141B
MD5f5596a7ce4342abc78d74487cb2d23fd
SHA1d394261add04a606e207449f2833a3561afe8d3e
SHA256009635db877dbc3944eb3d4057253980c9449635f00896de8618f30cb4838145
SHA5121de40011c65ec612406f9465984b97a84faed166d85adc8ebebcafbd734a513ffa640a4cb8504f146a41ef9e4d2973b38437f43e40f2365868a4e657d0185bf1
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\ecjmjncpphdmblffigkcfmnenehkmkbi\content.jsFilesize
144B
MD5fca19198fd8af21016a8b1dec7980002
SHA1fd01a47d14004e17a625efe66cc46a06c786cf40
SHA256332b00395bc23d4cb0bf6506b0fbb7e17d690ed41f91cf9b5d1c481cb1d3e82a
SHA51260f4286b3818f996fab50c09b191fbc82ed1c73b2b98d00b088b5afbbc0368c01819bd3868bd3c6bcb2cd083b719e29c28209317c7411213a25f923cfc1f0e47
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\ecjmjncpphdmblffigkcfmnenehkmkbi\lsdb.jsFilesize
531B
MD536d98318ab2b3b2585a30984db328afb
SHA1f30b85fbe08e1d569ad49dfeafaf7cb2da6585a5
SHA256ea2caf61817c6f7781ee049217e51c1083c8fc4f1e08e07792052dfdfa529ae7
SHA5126f61ccda2eba18369409850b2c91c9817fc741755e29a1579646e3816e0deab80e34a5adb9ff865c773793d32ac338163a224dbf363b46420d6ea42a7bbb2b3a
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\ecjmjncpphdmblffigkcfmnenehkmkbi\manifest.jsonFilesize
498B
MD5640199ea4621e34510de919f6a54436f
SHA1dc65dbfad02bd2688030bd56ca1cab85917a9937
SHA256e4aa7c089e32d14ddf584e9de6d007ec16581cd30c248ff7284bc0eb7757d4af
SHA512d64bc524d6df7c4c21a5ddfb0e6636317482ef4dc28006bd0a38d5e26c2db75626f216143026bf8acf3baa11d86c278e902c78afad4f806ca36f9e54bc75ff0a
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\i1TIlN664GIHYHH.datFilesize
4KB
MD599d4926f1868a0aa78fc94b8c36be766
SHA10cb3685ad5221411039af3de722128201ff3314b
SHA25603b8ee6fb575802a12ea928fea57222787a7a0112e865ca4d3a6d5ddff6766d9
SHA5127832858a3cb8ddeba31e8178fc9ddeeadb24a6e08f14ca0b11ecf7250508ca929594b25ff9d93816ceb3a6f0338adb693f36d31808f97444f82cbf7d502a18ff
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\i1TIlN664GIHYHH.exeFilesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\i1TIlN664GIHYHH.exeFilesize
765KB
MD521c7e6ab35acdb8d15ac0590900c5206
SHA1bd696ab0d1806c5492b4444d96fe272f217f4058
SHA256314c44ac357c692c66516271e02fe280e9fc6d030a7172f2379c81fa383d44ec
SHA512775636d7ec02398e32463ceaa7e1b18fe20689ed75d9c731b37b83f4c3ce828d2d2274d2f75d4f2c25133775969864467eff69b5fbf40e286fbfca6bdee1d3dd
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\[email protected]\bootstrap.jsFilesize
2KB
MD5df13f711e20e9c80171846d4f2f7ae06
SHA156d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA2566c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
SHA5126c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\[email protected]\chrome.manifestFilesize
35B
MD59b45f75518cb0675cff199977c0d7e12
SHA14e9fa46284159e8f3737e137a0e3cc3467325ab4
SHA256d5b2fd14e74bf4039db71d54e2f413f428b908f915e479bbf7895f9977edd6f9
SHA512ca8060b6b4850dfb3caca7a64ec8f0c3e45e252a1e3172cb430b6774b6d615f2d243a1689a3add69b84e8e9478c19fb373b765e52a68b406e163a783d8d5684c
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\[email protected]\content\bg.jsFilesize
8KB
MD5bea2415d5de24cbbcbae27a5aee87a33
SHA13a3fcd035587bd371662ca2fffd291cbb9010f89
SHA2565b095d965148e033ca221465e712ac6d4b91d6a9ecdeb436b0dcf6f92bc1a1fa
SHA512220732f98bf1df6963e7f854dfaec42ac77b17a832e62d9d0fd90141f79ce35dd8978ae9ffc61fa769302eb34c7b4736f28b55081f09389bcd80ca70d23b7a62
-
C:\Users\Admin\AppData\Local\Temp\3d5e48f1\[email protected]\install.rdfFilesize
593B
MD5315df512f58526bc86c260b25b973ae1
SHA18d58bba7144f3627e195b86f55ab3124d8f3b8d3
SHA256e2fb5488a0adbd8a3bf8b6a8b6c6b94e6abeb41b89fed421c4fe4fb3f31afa8a
SHA512ecee011b1dfd3c48e674d0567c85e27124daf5e815a995833e6f967f81b2b54968a228567388e4bf7a2d9cff2c79fc98a56805cae4336a65efa72ab40564de16
-
memory/1284-152-0x0000000000000000-mapping.dmp
-
memory/3256-149-0x0000000000000000-mapping.dmp
-
memory/4864-132-0x0000000000000000-mapping.dmp