Analysis
-
max time kernel
44s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:16
Static task
static1
Behavioral task
behavioral1
Sample
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe
Resource
win10v2004-20220812-en
General
-
Target
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe
-
Size
3.0MB
-
MD5
05b9e1d5d3a017140de1f73e8b877e90
-
SHA1
0c94c09ea02c8cfeab198dfada6f27907a8a1893
-
SHA256
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32
-
SHA512
06493b1fa4238f611350da9ffd50d8db9d77e3f353564b04b76bf48b43f7ec00050e0b94ea0178b115913cfe54143e3711cd5d215d03ce4e62e1a3f792c218a8
-
SSDEEP
49152:ARw6H1AOhKZC6X6PfX58D+F5yJ7xfpR3KOMBl64tXtxO1ChmFat1:owywZVm58wwXfp5K964I1C
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32\ = "C:\\Program Files (x86)\\SauveClicker\\fKyOYFoUdeN4Yh.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exeregsvr32.exeregsvr32.exepid process 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1544 regsvr32.exe 1508 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription ioc process File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\djehpbbeclopecmicpllpbahmgnbfeca\2.1\manifest.json acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\djehpbbeclopecmicpllpbahmgnbfeca\2.1\manifest.json acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\djehpbbeclopecmicpllpbahmgnbfeca\2.1\manifest.json acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exeacb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803}\ = "SauveClicker" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803}\ = "SauveClicker" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803}\NoExplorer = "1" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1817aedc-9740-4b53-9030-b05f72736803} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File opened for modification C:\Windows\System32\GroupPolicy acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Drops file in Program Files directory 8 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription ioc process File opened for modification C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.tlb acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.dat acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File opened for modification C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.dat acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dll acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File opened for modification C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dll acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.dll acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File opened for modification C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.dll acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe File created C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.tlb acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1817AEDC-9740-4B53-9030-B05F72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1817AEDC-9740-4B53-9030-B05F72736803} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1817aedc-9740-4b53-9030-b05f72736803} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1817aedc-9740-4b53-9030-b05f72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Modifies registry class 64 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\VersionIndependentProgID\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\Programmable acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817AEDC-9740-4B53-9030-B05F72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817AEDC-9740-4B53-9030-B05F72736803}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "SauveClicker" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32\ = "C:\\Program Files (x86)\\SauveClicker\\fKyOYFoUdeN4Yh.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\ProgID acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{1817aedc-9740-4b53-9030-b05f72736803}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\Programmable acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\ProgID\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\VersionIndependentProgID acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817AEDC-9740-4B53-9030-B05F72736803}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SauveClicker\\fKyOYFoUdeN4Yh.tlb" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{1817aedc-9740-4b53-9030-b05f72736803}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817AEDC-9740-4B53-9030-B05F72736803}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\ = "SauveClicker" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\ProgID\ = ".9" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\VersionIndependentProgID acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817aedc-9740-4b53-9030-b05f72736803}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{1817aedc-9740-4b53-9030-b05f72736803}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1817AEDC-9740-4B53-9030-B05F72736803} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1817aedc-9740-4b53-9030-b05f72736803} acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SauveClicker" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{1817aedc-9740-4b53-9030-b05f72736803}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exepid process 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription pid process Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Token: SeDebugPrivilege 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exeregsvr32.exedescription pid process target process PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1456 wrote to memory of 1544 1456 acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe PID 1544 wrote to memory of 1508 1544 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1817aedc-9740-4b53-9030-b05f72736803} = "1" acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe"C:\Users\Admin\AppData\Local\Temp\acb1630435a7334c0398ad387228b57f25036e99930a8d12fbfe2602b317ac32.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1456 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1508
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.datFilesize
4KB
MD5e92567555663117097e7915ae68c353f
SHA1501e46b72bbe6932a5c77c3b18973d5b81dcdf04
SHA2569fdd5c102df68a3147298effb28e019c74d24313a621706a13f75b9e30110d85
SHA51263b3c03ce6eb88fe7f50cc00ed6a4cffc7fc8bf5097c7900982ceff8e2ca84dd49483d23dd71fc61b0bc4fab9ca13c38da0b25b87298e5e5ed29ba46651b9fe8
-
C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.tlbFilesize
3KB
MD58975ae080c68d5863e475ebe7a1f6d25
SHA1bf8854718a8704708f0683e9a352b373b5274ddc
SHA25619c44cfa1a172d5a04099e8ee72f14f489c2621f605d5fd804f698a55d6a1b1b
SHA51290e030e61e7d5b0bdf8ba3d24026e2ba0615f0d1a0ca22d8e97fcf6631c43e878a90f4bdbf41b2d561c9b3e93cecd89970ef8a53ac03e9d386591b268006cb5a
-
C:\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dllFilesize
694KB
MD5e9f95f5b361b10a8a380911c5fa141b6
SHA1bf049eede0411d0a4d062f16d609c002dccfbd5a
SHA2566e269e9c4dc3ed8305b4055f52b6fb0631fa18f6df60dcb1dec8ad44b790fa1f
SHA512a1c12856a23210fa75361a6e7c0c7ca2fc8ec4fda1b0187eb7f4f578074af8a208a1958f198c35c529a34ab3ea5691c9f3aa5208838deb5249fe81a3b4e952d1
-
\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.dllFilesize
613KB
MD508be663045b4c154e774779db71c233d
SHA112fffa2f8d304aa400edd98b0facd5209d2e70a9
SHA2565aab1d08e4e9943f9e1073fab42c697fc0e390e8597cea073aad7ab56114ef11
SHA512807cfda1ee06ba3550dd9d4c2dc9d329e137f8eba7350dda8b27a473a30c4dfc2e2cc5802cf906794271f5219f636f7e68d2cf491f66440d1ab4933cdca40bc7
-
\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dllFilesize
694KB
MD5e9f95f5b361b10a8a380911c5fa141b6
SHA1bf049eede0411d0a4d062f16d609c002dccfbd5a
SHA2566e269e9c4dc3ed8305b4055f52b6fb0631fa18f6df60dcb1dec8ad44b790fa1f
SHA512a1c12856a23210fa75361a6e7c0c7ca2fc8ec4fda1b0187eb7f4f578074af8a208a1958f198c35c529a34ab3ea5691c9f3aa5208838deb5249fe81a3b4e952d1
-
\Program Files (x86)\SauveClicker\fKyOYFoUdeN4Yh.x64.dllFilesize
694KB
MD5e9f95f5b361b10a8a380911c5fa141b6
SHA1bf049eede0411d0a4d062f16d609c002dccfbd5a
SHA2566e269e9c4dc3ed8305b4055f52b6fb0631fa18f6df60dcb1dec8ad44b790fa1f
SHA512a1c12856a23210fa75361a6e7c0c7ca2fc8ec4fda1b0187eb7f4f578074af8a208a1958f198c35c529a34ab3ea5691c9f3aa5208838deb5249fe81a3b4e952d1
-
memory/1456-54-0x0000000074B51000-0x0000000074B53000-memory.dmpFilesize
8KB
-
memory/1456-55-0x0000000000E20000-0x0000000000EC2000-memory.dmpFilesize
648KB
-
memory/1508-86-0x0000000000000000-mapping.dmp
-
memory/1508-87-0x000007FEFB771000-0x000007FEFB773000-memory.dmpFilesize
8KB
-
memory/1544-82-0x0000000000000000-mapping.dmp