1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565

General

Target

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Size

4.2MB
MD5

7e50f7be375d446ac3f2384325232980
SHA1

43c16cb18a5e825fd796ed435f228d8f55771d2e
SHA256

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565
SHA512

ebfeb66b5ce554a1594f1e22a399a38cf85442fa4ecfb312e8d56787fcebbbbe8ce7041bbfa8e277dc5b2515dc555a870bf19ce39219bcdeb8885e2ba237c8ed
SSDEEP

49152:YPNexh0PvmaZ/aspZTOu+75oc4CbRlu+eBl9KjgFB:KPvme/jV+7ScPvsBl9Kj

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32\ = "C:\\Program Files (x86)\\SmartOnes\\loyzHUErREyz7Q.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exeregsvr32.exeregsvr32.exe

pid process

2028 1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
1988 regsvr32.exe
1040 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\haclghopngoghplggjegidcaooabgnmh\4.0\manifest.json	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\haclghopngoghplggjegidcaooabgnmh\4.0\manifest.json	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\haclghopngoghplggjegidcaooabgnmh\4.0\manifest.json	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}\ = "SmartOnes"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}\NoExplorer = "1"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}\ = "SmartOnes"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e8119b39-1757-46c2-8871-281cd833fc88}	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File opened for modification	C:\Windows\System32\GroupPolicy	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Drops file in Program Files directory 8 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dat	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dll	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dll	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.tlb	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File opened for modification	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.tlb	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
File created	C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dat	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{e8119b39-1757-46c2-8871-281cd833fc88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E8119B39-1757-46C2-8871-281CD833FC88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E8119B39-1757-46C2-8871-281CD833FC88}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{e8119b39-1757-46c2-8871-281cd833fc88}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Modifies registry class 64 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "SmartOnes"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8119B39-1757-46C2-8871-281CD833FC88}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32\ = "C:\\Program Files (x86)\\SmartOnes\\loyzHUErREyz7Q.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "SmartOnes"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8119B39-1757-46C2-8871-281CD833FC88}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8119B39-1757-46C2-8871-281CD833FC88}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{e8119b39-1757-46c2-8871-281cd833fc88}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{e8119b39-1757-46c2-8871-281cd833fc88}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32\ThreadingModel = "Apartment"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\Programmable	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\SmartOnes"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "SmartOnes"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{e8119b39-1757-46c2-8871-281cd833fc88}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\VersionIndependentProgID\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\ProgID	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\VersionIndependentProgID	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\InprocServer32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E8119B39-1757-46C2-8871-281CD833FC88}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8119B39-1757-46C2-8871-281CD833FC88}	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\ = "SmartOnes"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\SmartOnes\\loyzHUErREyz7Q.tlb"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88}\ProgID\ = ".9"	regsvr32.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

pid	process
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

description	pid	process
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Token: SeDebugPrivilege	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exeregsvr32.exe

description	pid	process	target process
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 2028 wrote to memory of 1988	2028	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe
PID 1988 wrote to memory of 1040	1988	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{e8119b39-1757-46c2-8871-281cd833fc88} = "1"	1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe

C:\Users\Admin\AppData\Local\Temp\1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe
"C:\Users\Admin\AppData\Local\Temp\1b0c6a6c054f9913456c2340c5b977e4db70f548bb761a247ac997ed5aaa0565.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1988

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1040

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dat
Filesize
3KB

MD5
3fc747c2b75ac2ecbef610aa0bfbf970

SHA1
d42bff786990bf51655accc6e5da3d579e22a58a

SHA256
ca444538a22568522b417bc8e1a0c391efc2f3ce23cd27d7208cf362c5a72166

SHA512
ab1e436cf44c0f13cd956220c8d00e5f7fda575d39a9902701782533b9659fa092b184d6d1dcbe2f77035a26494598d676167eaff387d9a037d5ddb9036332cf

Download Submit
C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.tlb
Filesize
3KB

MD5
662093ad59715d81e0a2b7cfbd4ac684

SHA1
83419c0803aa1c25a27b1fb8ad4a663d2d4878b0

SHA256
68fc930e26f7f38e30df8f8f40d1232b81af62d4cf27a281a8f645788ad1f6c4

SHA512
0eaffb7f011f548e1c6f8490c3d353fa05976140383df85663b5ef13be110d4847f08afe236a796a7f10a28895d29a7344e6d346389aa0780cc24af50fd66bf6

Download Submit
C:\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll
Filesize
874KB

MD5
c204b63eda2256280c0d74669210c890

SHA1
0a66d21505519e92683ac9845c3ff9ee6e196332

SHA256
505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0

SHA512
1bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425

Download Submit
\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.dll
Filesize
744KB

MD5
fc8b2dfce95210e4fe59b69a454ce14a

SHA1
46acd69f9bc55784091a572c8aa4d4d153a874f8

SHA256
3b408b96d81cfe3167926bcb62020da4d95001d8d2c3fc4d67708ec21488f189

SHA512
5ba3bb3437bb523721eac4e5c510b3fcb7b15090efeccd43075c8a42a776acad0c785431d7e2287e1b812556a30cd17bdde3d0d99f505a739c2042843d2cc1bf

Download Submit
\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll
Filesize
874KB

MD5
c204b63eda2256280c0d74669210c890

SHA1
0a66d21505519e92683ac9845c3ff9ee6e196332

SHA256
505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0

SHA512
1bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425

Download Submit
\Program Files (x86)\SmartOnes\loyzHUErREyz7Q.x64.dll
Filesize
874KB

MD5
c204b63eda2256280c0d74669210c890

SHA1
0a66d21505519e92683ac9845c3ff9ee6e196332

SHA256
505902d13946b15000ecb6aadb6946a298193dbef795f1d085a233ca5d7ab4f0

SHA512
1bec19d922bbf35807826f156663338b9d0cfa221d41b531555577579646e5cbb5854a510da918c92755f10782e4f5fc8e49c4e4b24c32b7e800ca51691c7425

Download Submit
memory/1040-65-0x0000000000000000-mapping.dmp

Download
memory/1040-66-0x000007FEFB771000-0x000007FEFB773000-memory.dmp

Filesize
8KB

Download
memory/1988-61-0x0000000000000000-mapping.dmp

Download
memory/2028-54-0x0000000074B51000-0x0000000074B53000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000002AB0000-0x0000000002B77000-memory.dmp

Filesize
796KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads