1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a

Analysis

max time kernel
151s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
25/11/2022, 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Size

4.4MB
MD5

be0e80ab4ed599eed9c9ed88497f4889
SHA1

20138d996e141fe2ecd5a188305e5d182e04f8fb
SHA256

1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a
SHA512

af972968f194fc54ed32aef5bf9022e9e8c8d4bbc5aa912f695b7e63bca0b2d35c7019a45a7732c17a0c1140908400d87f63245c7a3d6ebe035bd9ef757e2215
SSDEEP

98304:vkAqgoOMVeJrNjPLZtSrJY811P9xMvMz/B0+IqdFAD8oBdJnorTiGh3+RPneF1we:v9KFOrNJpKgW

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaave\\Pfqb.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

pid	Process
4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
4476	regsvr32.exe
2068	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhednokfeemhbehbmeadppehkbeppnhl\2.0\manifest.json	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhednokfeemhbehbmeadppehkbeppnhl\2.0\manifest.json	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhednokfeemhbehbmeadppehkbeppnhl\2.0\manifest.json	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhednokfeemhbehbmeadppehkbeppnhl\2.0\manifest.json	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\lhednokfeemhbehbmeadppehkbeppnhl\2.0\manifest.json	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ = "GoSaave"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\NoExplorer = "1"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ = "GoSaave"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Windows\System32\GroupPolicy	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\GoSaave\Pfqb.dat	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Program Files (x86)\GoSaave\Pfqb.x64.dll	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Program Files (x86)\GoSaave\Pfqb.x64.dll	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Program Files (x86)\GoSaave\Pfqb.dll	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Program Files (x86)\GoSaave\Pfqb.dll	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Program Files (x86)\GoSaave\Pfqb.tlb	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File opened for modification	C:\Program Files (x86)\GoSaave\Pfqb.tlb	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
File created	C:\Program Files (x86)\GoSaave\Pfqb.dat	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ProgID\ = "GaoSaave.2.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave\CurVer	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ProgID	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave.2.0\CLSID\ = "{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ProgID\ = "GaoSaave.2.0"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave.2.0\ = "GoSaave"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\GoSaave\\Pfqb.tlb"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave.2.0	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave.2.0\CLSID\ = "{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\VersionIndependentProgID	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\VersionIndependentProgID	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Implemented Categories	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Programmable	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32\ThreadingModel = "Apartment"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\Programmable	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave\ = "GoSaave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\ = "GoSaave"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32\ = "C:\\Program Files (x86)\\GoSaave\\Pfqb.dll"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\GaoSaave.GaoSaave\ = "GoSaave"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B}\InprocServer32	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4476	4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe	83
PID 4648 wrote to memory of 4476	4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe	83
PID 4648 wrote to memory of 4476	4648	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe	83
PID 4476 wrote to memory of 2068	4476	regsvr32.exe	84
PID 4476 wrote to memory of 2068	4476	regsvr32.exe	84

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{CCE9A4DB-7034-964C-F3A4-9673E6399E6B} = "1"	1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe

C:\Users\Admin\AppData\Local\Temp\1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe
"C:\Users\Admin\AppData\Local\Temp\1765fad9afd3645601b6d9e7b915988787ed97da1efdd143113229b25579996a.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:4648
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\GoSaave\Pfqb.x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\GoSaave\Pfqb.x64.dll"
    3⤵
    - Registers COM server for autorun
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:2068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:4792

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:5008

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\GoSaave\Pfqb.dat

Filesize
4KB

MD5
990be8bdf005ee14fd4bd0027bf3ae7c

SHA1
4846c761bca9e56f851dd88113222b2043e20665

SHA256
3e82ecf8c93f8417382789d9b060da6a5d4a4cff55bd283efd177ff3e8b8f269

SHA512
e154bcf944dd9d14817bf3567149f1a0226014b31589cf564146707a95bf970fe1260f6a51ede78b0076399f68baf45d85ab56d682b23065174cf9498d3356c9

Download Submit
C:\Program Files (x86)\GoSaave\Pfqb.dll

Filesize
619KB

MD5
d87bbe9d29b88e94ba03b16567033ddf

SHA1
19102742808244a23ca403d983dfd9f7088fffe3

SHA256
fdbce4dd2b45ac64620fc875bd12d8706a197bc3def75cdc33b9984f039da5b5

SHA512
24ea28c1104ee07604124842a99e359a53644e7693515dcf1b9a4dc7c8258c9d1bdc8b78b7018582521b6d41aebb96a1a38b6994fe83a12e29418bb011c69d03

Download Submit
C:\Program Files (x86)\GoSaave\Pfqb.tlb

Filesize
3KB

MD5
fb73184b9c1bfaa44e6cbdb593fd2909

SHA1
4585af18986a5e24c544fcecd9e02e3006f440d1

SHA256
c89fa0e13aa5c8930b6f28648653b815d4a93cd13e8d7d0f1bf8bf1a49920edb

SHA512
2e130f61d2211b7d2799905937b78d5119c3b22580c467dcfe757d8ac5b1e86c33fb69e3c67a6267f4db0a2730dc7cc399b8020d077b30d77428f54ec03523ed

Download Submit
C:\Program Files (x86)\GoSaave\Pfqb.x64.dll

Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
C:\Program Files (x86)\GoSaave\Pfqb.x64.dll

Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
C:\Program Files (x86)\GoSaave\Pfqb.x64.dll

Filesize
699KB

MD5
1fe3d25ff48d168cb86094de5401cab0

SHA1
c6e746f4c629185d8ef71d275845e1d072483923

SHA256
5cecdf46cd265705f19edaabc14272048a1da3563ed099303f8ed47ba3056a04

SHA512
ba3df2cf1031830fc9847c3213ec9fcd1c36c646071b2e5ae12b4bbf502a199e704131b6c53954a6ff969ba611e13743e89f0b26614b831d8b39c61a484c9be4

Download Submit
memory/4648-132-0x0000000003030000-0x00000000030D4000-memory.dmp

Filesize
656KB

Download