e6d0b85d153a17dfb760d300110537ecf5dc04d9d07b915cbc3bffb8cd682451

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
19/06/2024, 12:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe
Size 1.9MB
Sample240619-n83ldavark
SHA256 e6d0b85d153a17dfb760d300110537ecf5dc04d9d07b915cbc3bffb8cd682451
MD5 bb178b3809aa2825c42a03b3e350ee40
SHA1 384d12daf6c48d37aace56ddcc06d1bc57105a82
SHA512 3a0d3e53d94ee0853d2b9b1dcfa6575f2f92200c84b6a2ce7b6bfd9b6e4e02b7f148fb25b28697443cff83e2c3e5e2738b44f399aee57662d9de8fc6a113df81
SSDEEP 49152:Cuum1rFj6I2O04hbivi9UGNyDMq7bJc4sy8sDibsSe/Y//:CuVrp6TwOviCayDMp4syPr0/
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

adware discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2724	YvVk.exe

Loads dropped DLL 3 IoCs

pid	Process
2724	YvVk.exe
4336	regsvr32.exe
924	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibelejodmepdabncgigjjnimepcnhkjc\1.0\manifest.json	YvVk.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibelejodmepdabncgigjjnimepcnhkjc\1.0\manifest.json	YvVk.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibelejodmepdabncgigjjnimepcnhkjc\1.0\manifest.json	YvVk.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibelejodmepdabncgigjjnimepcnhkjc\1.0\manifest.json	YvVk.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ibelejodmepdabncgigjjnimepcnhkjc\1.0\manifest.json	YvVk.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ = "YoutubeAdblocker"	YvVk.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\NoExplorer = "1"	YvVk.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ = "YoutubeAdblocker"	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\YoutubeAdblocker\BJx.dat	YvVk.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\BJx.dat	YvVk.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\BJx.x64.dll	YvVk.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\BJx.x64.dll	YvVk.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\BJx.dll	YvVk.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\BJx.dll	YvVk.exe
File created	C:\Program Files (x86)\YoutubeAdblocker\BJx.tlb	YvVk.exe
File opened for modification	C:\Program Files (x86)\YoutubeAdblocker\BJx.tlb	YvVk.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	YvVk.exe
Key created	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	YvVk.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2447855248-390457009-3660902674-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	regsvr32.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\ = "YoutubeAdblocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID\ = "{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ProgID\ = "YoutubeAdblocker.1.0"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\CLSID\ = "{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\Programmable	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\BJx.tlb"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ = "YoutubeAdblocker"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker	YvVk.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\Programmable	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\Implemented Categories	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID	YvVk.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\VersionIndependentProgID	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ProgID\ = "YoutubeAdblocker.1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\ = "YoutubeAdblocker"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker.1.0\CLSID	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CurVer\ = "YoutubeAdblocker.1.0"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\VersionIndependentProgID	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\VersionIndependentProgID\ = "YoutubeAdblocker"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\ = "YoutubeAdblocker"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CurVer\ = "YoutubeAdblocker.1.0"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\InprocServer32\ThreadingModel = "Apartment"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\InprocServer32\ = "C:\\Program Files (x86)\\YoutubeAdblocker\\BJx.dll"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	YvVk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\ProgID	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	YvVk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\YoutubeAdblocker.YoutubeAdblocker\CLSID\ = "{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4}\InprocServer32	YvVk.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 2724	2456	bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 2724	2456	bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe	82
PID 2456 wrote to memory of 2724	2456	bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe	82
PID 2724 wrote to memory of 4336	2724	YvVk.exe	85
PID 2724 wrote to memory of 4336	2724	YvVk.exe	85
PID 2724 wrote to memory of 4336	2724	YvVk.exe	85
PID 4336 wrote to memory of 924	4336	regsvr32.exe	86
PID 4336 wrote to memory of 924	4336	regsvr32.exe	86

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{3071FFE3-CC74-78DB-0414-AA86CAFFDDA4} = "1"	YvVk.exe

C:\Users\Admin\AppData\Local\Temp\bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe
"C:\Users\Admin\AppData\Local\Temp\bb178b3809aa2825c42a03b3e350ee40_NeikiAnalytics.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Users\Admin\AppData\Local\Temp\25b5287f\YvVk.exe
  "C:\Users\Admin\AppData\Local\Temp/25b5287f/YvVk.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2724
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\YoutubeAdblocker\BJx.x64.dll"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\YoutubeAdblocker\BJx.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BJx.dll

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\BJx.dll
Size 444KB
SHA256 9c75f34a8e8d2a55f223b5f9c23c86eabe0afcb155195f3c7a4ea548c351855a
MD5 bfc1b10c063a8f4adbd7b7d8cd58260b
SHA1 b10f35bb90a431468b12ba47406b838c58b96885
SHA512 e920958fd3f75f0dfece71d7930eecfff6421e2f33becc74d5761eacd02f6c4fb67fe2b79a8a70cd98bb11595c363211c0fbb0eef3519f25261b8bc6e3c087ec
SSDEEP 12288:WcSBG0tgyogcyU/b+4BpUb1+LEa8kYjQ:W1B0gcykC4PUpWEaU
MD5 SHA1 SHA512 SSDEEP

Submit Download

BJx.tlb

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\BJx.tlb
Size 3KB
SHA256 67ed82d80a9be14682a558f7fa014b916c20af139f7cd58597e9e62f28eb2297
MD5 ee3f8bc3299efad0827180afadbffec9
SHA1 d799e82e27b071c1ef0b777d6ac0a1bca84b2001
SHA512 a7488a3aec960f2044a2fc72e72b50ccaea322e5d5c7ac6dfde57eaa80a4a6a92268b42856e15b32ed47f1a0c25064839a022cc187b6582d02825619f1bc3fb0
MD5 SHA1 SHA512

Submit Download

BJx.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\BJx.x64.dll
Size 500KB
SHA256 1ad498d4b4bec52d7e55d8774d2ce767efcde217c930129c802131d71ba7ffc2
MD5 523dd2104b8059af7801ba967dcaaa75
SHA1 72924b28eb44b17a4a383c321cc250c3fe793e9a
SHA512 951605ea88de6164bae3f840494a2cd38d9a1cf08d7abf3cc9dd3f78f66e1d33ba24639ef4b879ed3b8c0ce0f338a6146201d493d5c822df9631c2ef1139dd35
SSDEEP 6144:4Hmc/rqubXGmR8havYnju9IuA3CXic+gYNwRzABD77SDMTQ0r/ZA2jKSBZ7g/ivN:4G9K8hpnju9eSSj0zAt73i2jjuavN
MD5 SHA1 SHA512 SSDEEP

Submit Download

YvVk.dat

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\YvVk.dat
Size 3KB
SHA256 b25341d08e776ebda0f95e4f77aee9b5cb70f0210c19289aa58270817ae931f6
MD5 b356f83dfee4f543e830950b4a2309a9
SHA1 eb0584e1e4a29145d733c46d5ad131fcee2ce21b
SHA512 3ee8bef43ca9b7b418bbe2db9da334c73b34f7b7f8869c3c75de07307ae17c9d7743aaa2fee5db9a19317e0f94937312621bef219e3ceae85ce40c3c392619c0
MD5 SHA1 SHA512

Submit Download

YvVk.exe

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\YvVk.exe
Size 701KB
SHA256 5c9e0b374fe64a525472d7359bf92f83d7a149b4eeb1260de83b36c73227b928
MD5 0b71540ebb7b82ff9a24772dcf5dda66
SHA1 34f7bd5f17978959c2a9835dc75dd2c1befd6e04
SHA512 1048f8bfe2c5f905bf1eaed90d4f707e547eceeb79375316ccd3e901d6de81b13f6ce27f6e61d895ad43893c901315954c589d25999b9c439ea650780bc88536
SSDEEP 12288:JoxFHvRDZCvaL4ONsFQ27e9t3BNWynHwYbg0DWQodxwHkv:JoxZvavpONsKDHwYbDWLdxwH
MD5 SHA1 SHA512 SSDEEP

Submit Download

N4bei.js

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\ibelejodmepdabncgigjjnimepcnhkjc\N4bei.js
Size 25KB
SHA256 8fe5712eaf605deff83db8b3f6f5d1ec2ef20957b52492df0dd33d3de2b2c23c
MD5 74ea591395c7aba1d8de8903e3275892
SHA1 59dee5a4f011e3486c4dbb13d8f69566bedd3499
SHA512 7b71b6e28024d2e70203d4f070d15276cff06c58adb79fb5d1968294857cc0515dd7e95ecd9e91efb49ea9692e3f57b9b84f264902c876db0fa7f85f7cb4a3db
SSDEEP 384:GzH8tC3X/AC10p4ihSfrFylFEm1791kG5yW6AJNytLy7kco9rg7S/S9y:GY03PVK45c51796G/s79rruy
MD5 SHA1 SHA512 SSDEEP

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\ibelejodmepdabncgigjjnimepcnhkjc\background.html
Size 142B
SHA256 e2d2ec0875177a6a884581e450d4018f5d2f927ad21da33e176ef996826e2bae
MD5 4972f7852d62316f318f51d929e2602f
SHA1 5692f7ff534b308ff53b4c0a79a64c73f24239fb
SHA512 c0017e75fab4245bfc664a37c6a6bb7b4726b72550f7e8b25f67082eb128c439f84f0901ce4c67f7280f4cf4d4634012e8e887420305aad16e48d2b5959a521f
MD5 SHA1 SHA512

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\ibelejodmepdabncgigjjnimepcnhkjc\content.js
Size 6KB
SHA256 766efab9884f45b56b4f8c998663a988cb11d7a4be7d8bce645b017b64cee6ce
MD5 0f5f2b33c9abdc9869d2a98e7ffb1a04
SHA1 efcaa20aae11bfddc42317f4f2af4caa753db9c5
SHA512 8a919d87290bc727133ffb1f85eba2540e1e2022d8c225f6024e65068fe0de4d739f561eea6a34305bee7e317e8ef75ca0d8c2c82c5e446c44c9ea75e4d6b11d
SSDEEP 192:tyjxevbmeOC7bhqFDbTTfg2uNGSo4dBdj2MG5USGHua2:8xAbmeOC63T7+oce
MD5 SHA1 SHA512 SSDEEP

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\ibelejodmepdabncgigjjnimepcnhkjc\lsdb.js
Size 7KB
SHA256 ee97bb6ea592e4230110cdd003b2b0f1d81b72e5aef9acdd8597ff0876292366
MD5 7f7313043b73c578288b313d66aab77a
SHA1 ec8e5b3f3e46c9a101d9ad4e4e7e9c8ecb78e9b9
SHA512 c16323cbaa83568342bc2ca1b05011f8d36a19f571044bf21cdb6d6f1bb49713f2aa4aacd050409469eb7a6ddb8c0c9f2eb1e29405aead0a6d3438bacada235f
SSDEEP 192:K3fVVP2Fg9dOC1oVqb7NPyQ8gncb3KhTwAiQNdI/M71m:K3dgkJb7NYgs3K2A7M/3
MD5 SHA1 SHA512 SSDEEP

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\ibelejodmepdabncgigjjnimepcnhkjc\manifest.json
Size 508B
SHA256 6e03e688a9f7cc23a788e004cea4c87ee73e36c1053d2fb34a214bcc597f3ea2
MD5 e2832fbedae560495781610b5c511afa
SHA1 95f9c6fe1ea5a6ee009bce1e9c215ef53fb5c108
SHA512 2e206b58d02a88d21cb0cd74d5523b9f07f4558b4af9a19936befb256c2dc868107ab1716849e09b665721d1ac7b01ba6762bb54822596e39a4cdad763c68cb9
MD5 SHA1 SHA512

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\[email protected]\bootstrap.js
Size 2KB
SHA256 6c325461fba531a94cf8cbdcfc52755494973df0629ce0ee3fef734ab0838fc4
MD5 df13f711e20e9c80171846d4f2f7ae06
SHA1 56d29cda58427efe0e21d3880d39eb1b0ef60bee
SHA512 6c51cee3bf13f164c4a5c9884cc6053cbf9db9701d34c07dc5761d2c047d3d1f7a361b32996a430107e9a4ce68a29149d747a84c76778a1e8780719a3d30470e
MD5 SHA1 SHA512

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\[email protected]\chrome.manifest
Size 24B
SHA256 ee382fba1253a494232ad3ad2699465b915428b948a6a2152f69a1644ee112b3
MD5 3b8c8f0ea6bed47581b621062f8fce24
SHA1 c49c68ee2d38f96972a4c45503410b050b19fb84
SHA512 3435df498522668851b0bd32b34f615ef84255cfc3bc8aa588dbf49878587378e96b25c796853fdd2fd84b369a350790ecf82e0ae16deb6505afc3815ebfb43c
MD5 SHA1 SHA512

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\25b5287f\[email protected]\install.rdf
Size 606B
SHA256 318fbafd8b2580e4825eff6a82cc35a8f4ad14835cbbefaaa600aa763bfdb9a4
MD5 f79d8293b878c419f0229275f50dbb36
SHA1 0748fff20e7086e84cd9e870e21ecc6f78a16c7a
SHA512 8349ff0558adf173151c28bc9642677a0c7dc7195df2a30a1c866afdff0d1e76c2bc1c03e9513f13a01d961ce5488eafd2678f87a9a1653c0491407831ef275a
MD5 SHA1 SHA512

Submit Download

bg.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\s2p9ahae.default-release\extensions\staged\[email protected]\content\bg.js
Size 29KB
SHA256 e74bf833d091ed5377f7dfd24b8e5ccc0355fe66f903749b028596809ec1a62f
MD5 318444644ead412f7e378b3c05e8e05a
SHA1 fbf40ca9a2112efdc52562580cb5fecaed837763
SHA512 4a99445f585c000cd9c1649bd74115a471a18346b61f8df0766f5b08fa70cc6a6c26606e4f52240f7bcc5c3989d57897ca8b8b16ee424a4ea964b43d0f2c78f9
SSDEEP 768:AvXRg4CC4E2oheMgcGHKeBqd/HytVh037LFoEn:A5g/W2oEMgxVmqY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads