94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6

General

Target

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Size

3.7MB
MD5

70c78a095f21aacddc1c43822400a2a8
SHA1

87ea9cd0f698209aa28f73614c06322f5369b6cb
SHA256

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6
SHA512

7311fd5b4c3893798c4859e3e12d9c8732b5d8d025a8881b47e4b3408332b6ba0bec30bd40186e3580afb96b385a6f956e8628473f3240f4d1ad9c80039697a6
SSDEEP

49152:tU9Vf+rUODa8wka5YrSVGp72NtJTvbzsv2Cb2P85PCnxhsNqSQ:SFOHwkmU729vPsvrb2kIxh

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32\ = "C:\\Program Files (x86)\\YoutuebeADBloocKee\\On2COYHvrCOnBv.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exeregsvr32.exeregsvr32.exe

pid process

2012 94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
1728 regsvr32.exe
756 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

pid	process
2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
1728	regsvr32.exe
756	regsvr32.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ = "YoutuebeADBloocKee"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ = "YoutuebeADBloocKee"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\NoExplorer = "1"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

Drops file in Program Files directory 8 IoCs

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

description	ioc	process
File created	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File opened for modification	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File created	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dll	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File opened for modification	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dll	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File created	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.tlb	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File opened for modification	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.tlb	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File created	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dat	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
File opened for modification	C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dat	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

Modifies registry class 64 IoCs

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32\ThreadingModel = "Apartment"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ProgID\ = ".9"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\VersionIndependentProgID\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ProgID	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\VersionIndependentProgID	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YoutuebeADBloocKee\\On2COYHvrCOnBv.tlb"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\VersionIndependentProgID\	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\Programmable	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{9f55549e-32b7-4b2a-bbdc-65122e84dede}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ = "YoutuebeADBloocKee"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}\Implemented Categories	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\YoutuebeADBloocKee"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32\ = "C:\\Program Files (x86)\\YoutuebeADBloocKee\\On2COYHvrCOnBv.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "YoutuebeADBloocKee"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "YoutuebeADBloocKee"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\Programmable	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede}\InprocServer32\ = "C:\\Program Files (x86)\\YoutuebeADBloocKee\\On2COYHvrCOnBv.dll"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{9F55549E-32B7-4B2A-BBDC-65122E84DEDE}	regsvr32.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exeregsvr32.exe

description	pid	process	target process
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 2012 wrote to memory of 1728	2012	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe
PID 1728 wrote to memory of 756	1728	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{9f55549e-32b7-4b2a-bbdc-65122e84dede} = "1"	94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe

C:\Users\Admin\AppData\Local\Temp\94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe
"C:\Users\Admin\AppData\Local\Temp\94328bceca5c2fa4ab7fb81037b0c6493a8408d57ae40d5103b222c8bd3f79b6.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1728

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:756

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dat
Filesize
3KB

MD5
3aa88d9c11b1ef1f5c68a70a0f5bebff

SHA1
1fd561e58d960f30e64a7a0e3d4a32474eb511fc

SHA256
b0e409baac9a4f027d9866f583f86702213ddc680ee5472a2291e29d7c4f5fef

SHA512
c213c23d3037470430fbb242a822421501a96ce2a41bac1a1f5528de4776f37c8de5e25c8f8de67dad0569f86ee7c2d0a86f1166671f0853eb48fd72fb77135d

Download Submit
C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.tlb
Filesize
3KB

MD5
e1ccf2e2dc93dd6a8927a6a4c375cbf3

SHA1
6bb9a0affe3c3b578a9260203e27cf075f0c1e97

SHA256
bf1bebb0095af9e438bc56a22b44e8afc85be11c724101bb9ec5c73086cfd411

SHA512
4a63951366c5cfbb05168bb3c232f5b4ca88e1104fc417fcace08479b11e171928379b2eace384e471f0a96e39aa9c22b8153683c43c961830d2f74c1eae23de

Download Submit
C:\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.dll
Filesize
619KB

MD5
5e35cea39dca842e67bac26c3fdd9d1c

SHA1
df707169ba389d66f018c6c91b44fed189bf90f7

SHA256
2ffd483b8f32d93802a44acf46c920ba91a7dcaee0e6bf8b7fd22cecdc27fa3f

SHA512
9ba60c200a22712b86d20407bf98e70e8a9a3a104d0dd5be6a1fb4a547a77d28c1fd824a5af8c6201ff3a98ee451c1ee4fd7902ee79c01e82221e149100e0665

Download Submit
\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
\Program Files (x86)\YoutuebeADBloocKee\On2COYHvrCOnBv.x64.dll
Filesize
698KB

MD5
98554a06d97cb19eb00faf80f1dd48aa

SHA1
ae493d7183f9882f6f130435ab7179da39bca8bd

SHA256
703c564e8a6a1a133a54d15fafe8649f6e4f0b95ca433ef8d4392193e62ebe85

SHA512
5316afa98627223997288d37688acc769fa138368adecb501e1cc62823856c1a2d6175c34ad90bc0e4a6ee6a3d87d70ff6fccee13ae848562ae3eb97cc526cd5

Download Submit
memory/756-68-0x0000000000000000-mapping.dmp

Download
memory/756-69-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1728-64-0x0000000000000000-mapping.dmp

Download
memory/2012-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2012-55-0x00000000028D0000-0x0000000002972000-memory.dmp

Filesize
648KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads