a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8

General

Target

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Size

3.5MB
MD5

3a968b8c954157114073e5bd743aaa3d
SHA1

d73ea225e10f83715c57b2dace71a08503d08364
SHA256

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8
SHA512

2ff68abb2b9b29461663d775585aaa4a2323402b874cfab5c398ab26cea825a37804f5d5ecce59780676691eaec233ed1d4f7e836612f67957cfdb91e33f69c9
SSDEEP

49152:+kXOyeYGNWDrQA0dxv95KjAAVYz2vqYZsdOCw+DFrlOtu1FutI/P:/hHSTojTk2RZsdRwOrlOw1F8

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32\ = "C:\\Program Files (x86)\\YoutuubieAdBlocke\\QjmYgRYj9apmJ6.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exeregsvr32.exeregsvr32.exe

pid process

912 a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
1328 regsvr32.exe
1304 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
1328	regsvr32.exe
1304	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exeregsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}\NoExplorer = "1"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ = "YoutuubieAdBlocke"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ = "YoutuubieAdBlocke"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

Drops file in Program Files directory 8 IoCs

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

description	ioc	process
File created	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File opened for modification	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File created	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dll	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File opened for modification	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dll	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File created	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.tlb	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File opened for modification	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.tlb	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File created	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dat	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
File opened for modification	C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dat	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ffdb4fe6-df07-4456-808d-677c32d4891a}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{FFDB4FE6-DF07-4456-808D-677C32D4891A}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{FFDB4FE6-DF07-4456-808D-677C32D4891A}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ffdb4fe6-df07-4456-808d-677c32d4891a}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

Modifies registry class 64 IoCs

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\Programmable	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{ffdb4fe6-df07-4456-808d-677c32d4891a}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ = "YoutuubieAdBlocke"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ProgID\ = ".9"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFDB4FE6-DF07-4456-808D-677C32D4891A}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFDB4FE6-DF07-4456-808D-677C32D4891A}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YoutuubieAdBlocke\\QjmYgRYj9apmJ6.tlb"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\YoutuubieAdBlocke"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32\ThreadingModel = "Apartment"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\VersionIndependentProgID	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ProgID	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ = "YoutuubieAdBlocke"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{FFDB4FE6-DF07-4456-808D-677C32D4891A}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\ProgID\ = ".9"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "YoutuubieAdBlocke"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{ffdb4fe6-df07-4456-808d-677c32d4891a}"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32\ = "C:\\Program Files (x86)\\YoutuubieAdBlocke\\QjmYgRYj9apmJ6.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exeregsvr32.exe

description	pid	process	target process
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 912 wrote to memory of 1328	912	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe
PID 1328 wrote to memory of 1304	1328	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{ffdb4fe6-df07-4456-808d-677c32d4891a} = "1"	a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe

C:\Users\Admin\AppData\Local\Temp\a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe
"C:\Users\Admin\AppData\Local\Temp\a1bc84cf8f43eddda12afa4bee39f4393a3a06dcd76f8defa644fbbbbb3050a8.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:912

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1328

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1304

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dat
Filesize
4KB

MD5
ec29b3221278fd287b4d572429c422f8

SHA1
ef7ce3b017d0f69c65a23836f99e861ad062baec

SHA256
d9242d7b8e4e4e71226b692ccc512074f21e3abfae9d27a5801de1a7cd447c39

SHA512
dc6c4457a77b1de6925366d0191715839558cd89d9958b60df9599a5ac8c850b215885f9086e9f0f7b0e01969d8f9edaa0435ae7337b156aa47a93594abcf895

Download Submit
C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.tlb
Filesize
3KB

MD5
446bf1779f1f4c99e90d34218088897a

SHA1
8fbbfe0f6260a33e5e242746f45bab89bc71b1cb

SHA256
fbb113fcbf66becc1465cd0b5238f395a164298d57cb8ae6e860c385fb8c1cd7

SHA512
4977809238dc5c3e4786b777e60c58d2651b3dd46ef4c0ce2ab7bdc206eb9cd836dd803c57c2a3ed4e2e9f0e070eb508b9eb647fe3e8b3b1ecc674f57538717e

Download Submit
C:\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll
Filesize
699KB

MD5
e9d65b59189466bb82c4bdc0c013182a

SHA1
0cf2ea965ee62ce8e7913b1c7b92bc45abc17272

SHA256
5108837e4c1a0b3f489642c4a99cc16dfd0ebea773f4eccd047fcb182fe55978

SHA512
7e41258d5b8e71599369f517017ddce504a066d000abc74a7d526f089b6340aeebdd6152d42bb5730b8dfe3911d0b54ddb3e47dfdf08a1983e13592c84c18932

Download Submit
\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.dll
Filesize
618KB

MD5
fa22e2b9ff3086baceedeafbadec9f28

SHA1
0bb8d621faff9fcfcd8377079b9a47110e8c5c5e

SHA256
57e84f2e0c131c0579c6895ff74cc028885addf1ff80631de2a06b870b808bc3

SHA512
f80f7e0cc59a592c2cc8502a267dbd7811be6d4769ae0a422b4b63bae77e7a817594da98a9c27a75bf70117e6c8f1ed84fe99adc20b0d9c281e8ee9ecf2839a5

Download Submit
\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll
Filesize
699KB

MD5
e9d65b59189466bb82c4bdc0c013182a

SHA1
0cf2ea965ee62ce8e7913b1c7b92bc45abc17272

SHA256
5108837e4c1a0b3f489642c4a99cc16dfd0ebea773f4eccd047fcb182fe55978

SHA512
7e41258d5b8e71599369f517017ddce504a066d000abc74a7d526f089b6340aeebdd6152d42bb5730b8dfe3911d0b54ddb3e47dfdf08a1983e13592c84c18932

Download Submit
\Program Files (x86)\YoutuubieAdBlocke\QjmYgRYj9apmJ6.x64.dll
Filesize
699KB

MD5
e9d65b59189466bb82c4bdc0c013182a

SHA1
0cf2ea965ee62ce8e7913b1c7b92bc45abc17272

SHA256
5108837e4c1a0b3f489642c4a99cc16dfd0ebea773f4eccd047fcb182fe55978

SHA512
7e41258d5b8e71599369f517017ddce504a066d000abc74a7d526f089b6340aeebdd6152d42bb5730b8dfe3911d0b54ddb3e47dfdf08a1983e13592c84c18932

Download Submit
memory/912-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/912-55-0x0000000000790000-0x0000000000833000-memory.dmp

Filesize
652KB

Download
memory/1304-65-0x0000000000000000-mapping.dmp

Download
memory/1304-66-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download
memory/1328-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads