28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc

General

Target

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Size

3.0MB
MD5

1606e84959475fcd8a5cc60dcb1612b4
SHA1

1da778c1715525e85e80e7fec70f2771339aef9d
SHA256

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc
SHA512

2953b86d5473d59bff6bdce0343083c96e81a42515c8246be8351aafda5eddaf2a1f83a8c90b16aeca31d0cdf2c6c3fdfb2edc43a1b9790388f3414b939d2a5c
SSDEEP

49152:7l+a1UdHZG7n0pp10VvlEw13EQ23PT/Vl9+NafBOBrIavcQ:xiuwX1SVCrNsBrI

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32\ = "C:\\Program Files (x86)\\GoSSave\\M32yqLxdLp2Hkj.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exeregsvr32.exeregsvr32.exe

pid process

1852 28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
856 regsvr32.exe
1164 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

description	ioc	process
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnoihhdaelnmegdlpjblmaaagfjfafbl\2.0\manifest.json	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnoihhdaelnmegdlpjblmaaagfjfafbl\2.0\manifest.json	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pnoihhdaelnmegdlpjblmaaagfjfafbl\2.0\manifest.json	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ = "GoSSave"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ = "GoSSave"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}\NoExplorer = "1"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{05dbcd8c-a964-462d-b041-536ea2a319eb}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Drops file in System32 directory 4 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File opened for modification	C:\Windows\System32\GroupPolicy	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Drops file in Program Files directory 8 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dat	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File opened for modification	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dll	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File opened for modification	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dll	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.tlb	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File opened for modification	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.tlb	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
File created	C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dat	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{05dbcd8c-a964-462d-b041-536ea2a319eb}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{05DBCD8C-A964-462D-B041-536EA2A319EB}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{05DBCD8C-A964-462D-B041-536EA2A319EB}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{05dbcd8c-a964-462d-b041-536ea2a319eb}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Modifies registry class 64 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "GoSSave"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{05dbcd8c-a964-462d-b041-536ea2a319eb}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\VersionIndependentProgID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32\ = "C:\\Program Files (x86)\\GoSSave\\M32yqLxdLp2Hkj.dll"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSSave"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\Programmable	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05DBCD8C-A964-462D-B041-536EA2A319EB}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05DBCD8C-A964-462D-B041-536EA2A319EB}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ProgID\ = ".9"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32\ = "C:\\Program Files (x86)\\GoSSave\\M32yqLxdLp2Hkj.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "GoSSave"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{05dbcd8c-a964-462d-b041-536ea2a319eb}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ProgID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05DBCD8C-A964-462D-B041-536EA2A319EB}\Implemented Categories	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05DBCD8C-A964-462D-B041-536EA2A319EB}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\GoSSave"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ = "GoSSave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ProgID\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ = "GoSSave"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05DBCD8C-A964-462D-B041-536EA2A319EB}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\ProgID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSSave\\M32yqLxdLp2Hkj.tlb"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{05dbcd8c-a964-462d-b041-536ea2a319eb}"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb}\VersionIndependentProgID\	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

pid	process
1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exeregsvr32.exe

description	pid	process	target process
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 1852 wrote to memory of 856	1852	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe
PID 856 wrote to memory of 1164	856	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{05dbcd8c-a964-462d-b041-536ea2a319eb} = "1"	28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe

C:\Users\Admin\AppData\Local\Temp\28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe
"C:\Users\Admin\AppData\Local\Temp\28c46317ccfd356e44bca7d82ce9dd46e4a2507b0b75b003f93e88e1fe7230cc.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1852

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:856

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1164

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dat
Filesize
4KB

MD5
1e687acd66faf9bef57b8b546730cc4a

SHA1
a1d9e6ddd1854d3fb1258357b59544d93ed2fb38

SHA256
56fcc10a2513ffc3ed4523337a783f86fe0f1a650a40d97d23a999ddef98b136

SHA512
f02c5181bda73108f20e78a953faf74d76d1a1ec76b77b0a9d97819693a4776ea63c0a1718dee3a9d7e156adbbefbea95548c5f9e235c9c7a7cce56b1c133eb4

Download Submit
C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.tlb
Filesize
3KB

MD5
92756a87f506c53ffa4f08473e79b5ae

SHA1
125c2f2d08520c51f8746ede70f746ef8a6de3cf

SHA256
7e1a9e2e2faea603ec96b5d3a906eb86a495cbe2ca4be8bc6a902e7bf2981877

SHA512
1aaef6b900b931ed65d48b7258558ca3dad7b47c3f269f5b3af78210fbf07f438db132dfe8f5cf3f24d75b9ef5a537fa5c057f43d04c068220d4cfb8d93b192e

Download Submit
C:\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll
Filesize
689KB

MD5
343075f940027d076b1a8a928e4ecd7c

SHA1
2c544aa0b1c2872afdaf49e966fc46bf1a0b348f

SHA256
8c2ec31e34cd2bfc4c9a3464abf774d7e13796c29cd615042ae8661b3530e3b0

SHA512
3a0a2076b991582e9c355426673950e06ccb1d9c7efc7be37ada2330b28152661d0535292f6e00f63045639e69d47de200cd2d378194e65b56317921e3fd675f

Download Submit
\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.dll
Filesize
610KB

MD5
44786626cc0757d485d2ae91232f06e7

SHA1
f8416c9f7d1647afa38f3304510f7ad9456af2c0

SHA256
5b0d904dbc30696d9ef9326edb60bb068514bc858a348534c4d91b5435618906

SHA512
f4dd00c5ca0bdf9f3f32d8c2ffcbe57bedf8bfbb1c1454a7af39d4c0bdc6e59de2dc98be304708272e7dd980f46e1b964497e40579f1406999aca49f3c054cdf

Download Submit
\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll
Filesize
689KB

MD5
343075f940027d076b1a8a928e4ecd7c

SHA1
2c544aa0b1c2872afdaf49e966fc46bf1a0b348f

SHA256
8c2ec31e34cd2bfc4c9a3464abf774d7e13796c29cd615042ae8661b3530e3b0

SHA512
3a0a2076b991582e9c355426673950e06ccb1d9c7efc7be37ada2330b28152661d0535292f6e00f63045639e69d47de200cd2d378194e65b56317921e3fd675f

Download Submit
\Program Files (x86)\GoSSave\M32yqLxdLp2Hkj.x64.dll
Filesize
689KB

MD5
343075f940027d076b1a8a928e4ecd7c

SHA1
2c544aa0b1c2872afdaf49e966fc46bf1a0b348f

SHA256
8c2ec31e34cd2bfc4c9a3464abf774d7e13796c29cd615042ae8661b3530e3b0

SHA512
3a0a2076b991582e9c355426673950e06ccb1d9c7efc7be37ada2330b28152661d0535292f6e00f63045639e69d47de200cd2d378194e65b56317921e3fd675f

Download Submit
memory/856-80-0x0000000000000000-mapping.dmp

Download
memory/1164-85-0x000007FEFBA81000-0x000007FEFBA83000-memory.dmp

Filesize
8KB

Download
memory/1164-84-0x0000000000000000-mapping.dmp

Download
memory/1852-65-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-78-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-69-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-71-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-70-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-72-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-73-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-75-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-74-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-76-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-77-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-67-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-68-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-66-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-54-0x0000000075521000-0x0000000075523000-memory.dmp

Filesize
8KB

Download
memory/1852-64-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-63-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-62-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-61-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-60-0x00000000005E2000-0x00000000005E6000-memory.dmp

Filesize
16KB

Download
memory/1852-55-0x0000000000450000-0x00000000004F1000-memory.dmp

Filesize
644KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads