ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/08/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24.exe
Size 1.6MB
Sample260827-nadvcstdmg
SHA256 ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24
MD5 d5cb7f8a305a9601166458fb8ac02716
SHA1 4805a53639fe506c2a65c715d8197933afad7ca5
SHA512 d3c9cdb828749a1ba172445ecdebba8f2869ce1bd3f604defa4a7e765fee0c31236e68863b8040264e708110d00eb87e947e5fbb177c1949b2ab39df1f9e853a
SSDEEP 49152:BXql1ivqFJsa5PnxnVjkW/ouWjQemVoG7DfbBRgGE:BXqo+nxuW/oNQvoB
TLSH
T19B751200EA009131E5B305FAC9EE777E653CBBA1D71558DB63C81E9D4BB22E17A31263
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

adware defense_evasion discovery persistence privilege_escalation spyware stealer

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Executes dropped EXE 1 IoCs

pid	Process
2988	nauaJoGmCg.exe

Loads dropped DLL 3 IoCs

pid	Process
2988	nauaJoGmCg.exe
4492	regsvr32.exe
1688	regsvr32.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\finkaonpelohpmiebmbpmiglhadflccn\2.19\manifest.json	nauaJoGmCg.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}	nauaJoGmCg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}\NoExplorer = "1"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}\ = "Surf And keeap"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}\NoExplorer = "1"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}\ = "Surf And keeap"	nauaJoGmCg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8FD01442-3B23-173E-9411-22637046D623}	regsvr32.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.x64.dll	nauaJoGmCg.exe
File created	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.dll	nauaJoGmCg.exe
File opened for modification	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.dll	nauaJoGmCg.exe
File created	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.tlb	nauaJoGmCg.exe
File opened for modification	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.tlb	nauaJoGmCg.exe
File created	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.dat	nauaJoGmCg.exe
File opened for modification	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.dat	nauaJoGmCg.exe
File created	C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.x64.dll	nauaJoGmCg.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	nauaJoGmCg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regsvr32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	nauaJoGmCg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{8FD01442-3B23-173E-9411-22637046D623}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8FD01442-3B23-173E-9411-22637046D623}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{8FD01442-3B23-173E-9411-22637046D623}	nauaJoGmCg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{8FD01442-3B23-173E-9411-22637046D623}	nauaJoGmCg.exe
Key deleted	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	nauaJoGmCg.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ProgID\ = "Surrf ando Keep.2.19"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ProgID	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19\ = "Surf And keeap"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ = "Surf And keeap"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	nauaJoGmCg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32\ = "C:\\Program Files (x86)\\Surf And keeap\\gG8LQUiBL.dll"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32\ = "C:\\Program Files (x86)\\Surf And keeap\\gG8LQUiBL.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.2.19\CLSID	nauaJoGmCg.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\TypeLib\Version = "1.0"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib\Version = "1.0"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\ = "Surf And keeap"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ProgID\ = "Surrf ando Keep.2.19"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Surrf	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ando	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\Surf And keeap"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ = "IIEPluginMain"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ProxyStubClsid32	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ = "Surf And keeap"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\Surf And keeap\\gG8LQUiBL.tlb"	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID\ = "{8FD01442-3B23-173E-9411-22637046D623}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep.Surrf	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Keep\CLSID\ = "{8FD01442-3B23-173E-9411-22637046D623}"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\ProgID	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\VersionIndependentProgID	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8FD01442-3B23-173E-9411-22637046D623}\VersionIndependentProgID\ = "Surrf ando Keep"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{C66F0B7A-BD67-4982-AF71-C6CA6E7F016F}\ProxyStubClsid32	nauaJoGmCg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\ = "ILocalStorage"	nauaJoGmCg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{31E3BC75-2A09-4CFF-9C92-8D0ED8D1DC0F}\TypeLib	nauaJoGmCg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2988	1392	ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24.exe	85
PID 2988 wrote to memory of 4492	2988	nauaJoGmCg.exe	86
PID 4492 wrote to memory of 1688	4492	regsvr32.exe	87

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{8FD01442-3B23-173E-9411-22637046D623} = "1"	nauaJoGmCg.exe

C:\Users\Admin\AppData\Local\Temp\ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24.exe
"C:\Users\Admin\AppData\Local\Temp\ffd8d913c9908132914adefbc7617fa8f0701165bc9d00521395bd8d069a5e24.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Users\Admin\AppData\Local\Temp\00294823\nauaJoGmCg.exe
  "C:\Users\Admin\AppData\Local\Temp/00294823/nauaJoGmCg.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops Chrome extension
  - Installs/modifies Browser Helper Object
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2988
- - C:\Windows\SysWOW64\regsvr32.exe
    regsvr32.exe /s "C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.x64.dll"
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4492
  - - C:\Windows\system32\regsvr32.exe
      /s "C:\Program Files (x86)\Surf And keeap\gG8LQUiBL.x64.dll"
      4⤵
      Loads dropped DLL
      Installs/modifies Browser Helper Object
      Modifies Internet Explorer settings
      Modifies registry class
      PID:1688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

RdUgxuFor6Z.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\RdUgxuFor6Z.js
Size 5KB
SHA256 013bd2c2589b88a5d929ca39dd36a1a7f88ec38efa9201dede9122ae518189af
MD5 d04d8a88c1a54e9c44f4c05d2a7d946e
SHA1 161ef58e3c9948aea8b9ea5f95f9762ee4f4dd0f
SHA512 287ff1a0114d827bfe856645b65c72888e3965fe89eb3a7847f1f79bc0ebf9c3f1c36ea8af1bbeec79de32fc12a7782f54144e68314bc91759717d1cb344e8c4
SSDEEP 96:Zh5LJxjTWgUSO7Ov7O3SO0OSSOFOiO4OYWN0wvpjeXY7/aU7HJJ0vOaz:/NKgUSO7Ov7O3SO0OSSOFOiO4OY7qpI3
TLSH
T1BCC1C69C75F3620281913B614C6F0B9D9527A8612D188DE039FDA1D1BFB49A4105FFEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

background.html

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\background.html
Size 148B
SHA256 fab9b72f3d045ba6bc77960b1b755616b50efafd0b7d6b18c07de85caeeea423
MD5 1a9cddc5c665eb5483a64e5501f4eb86
SHA1 982f3093ca84a7a3d248c77783bef04fddf1ef83
SHA512 75bfbae536de22b50070854fd61f1982b919c9a4c5225e242c9341f981ee85972d56369b707a197d061c36ac47443f02f09fd889e497ad2cfd54ba8f89155758
TLSH
T143C02BDABC44806CA9103DD40CF1B2CC4C4C8434B481CD391CF8303904403EC8C13341
MD5 SHA1 SHA512 TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\content.js
Size 197B
SHA256 fb01e87250ac9985ed08d97f2f99937a52998ea9faebdc88e4071d6517e1ea6b
MD5 5f9891607f65f433b0690bae7088b2c1
SHA1 b4edb7579dca34dcd00bca5d2c13cbc5c8fac0de
SHA512 76018b39e4b62ff9ea92709d12b0255f33e8402dfc649ed403382eebc22fb37c347c403534a7792e6b5de0ed0a5d97a09b69f0ffc39031cb0d4c7d79e9440c7c
TLSH
T142D01227F73D7CECD2293CB9C96A8A0063F30911B912247271F5D6802D74E003559AB5
MD5 SHA1 SHA512 TLSH

Submit Download

lsdb.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\lsdb.js
Size 559B
SHA256 e3cf0049af8b9f6cb4f0223ccb8438f4b0c75863684c944450015868a0c45704
MD5 209b7ae0b6d8c3f9687c979d03b08089
SHA1 6449f8bff917115eef4e7488fae61942a869200f
SHA512 1b38d5509283ef25de550b43ef2535dee1a13eff12ad5093f513165a47eec631bcc993242e2ce640f36c61974431ae2555bd6e2a97aba91eb689b7cd4bf25a25
TLSH
T1A4F0AF3A5157233340A76EFFB86A2428A671D702E51C06613E7207803C9839F03A5DDF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\manifest.json
Size 507B
SHA256 3ade4e7ddfa48cef3989f1245804869bb3d1043cb82d69d5f299074543e14570
MD5 3c48fa0fc627c6d63f3bdcf847cb5150
SHA1 bef18d1ffd49fa5c0261fe433d2c32d88693adde
SHA512 05aa636b9aeef56da5896d3e6860bf770fed9a3f18b2cab513bd96f89aa08da8e3ae7dbee379983d4c28a0ae13ebe2acce74b8c102859bdaa0183708869ab095
TLSH
T111F0E977EC44883617F89B5528B46243F666174F24D00C0FB57E645C0BB0AB61052325
MD5 SHA1 SHA512 TLSH

Submit Download

sqlite.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\finkaonpelohpmiebmbpmiglhadflccn\sqlite.js
Size 1KB
SHA256 5463fdf33e3077932d24563a03bfc451eda09a31730c6cb56110b2153f9e46b3
MD5 4aabf34b82f5e7576acd05bf6ac07419
SHA1 7d0d2931b8989ebc07ee32dae69cb4c2c7643c86
SHA512 45bd68c44eb9b36e35c1859ab8a9afea0945413cf6d504882b5c180b9a90a0b79027627911dc58a10aa3c37b635dc8e636c399c0e4617420a71b0a5919cc2f54
TLSH
T1E0213A9E78177A7300ABBA32603F098E657F6240FD9645F17C7252D05D3562D209EDBC
MD5 SHA1 SHA512 TLSH

Submit Download

gG8LQUiBL.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\gG8LQUiBL.dll
Size 416KB
SHA256 e23b94a809d4306dce3c0fb5a7dc76ad25e133cb74daa489629419ba1d849ebe
MD5 b5e8219112f5de28e71487fd8c367b8f
SHA1 cc60f4497ee2328e43e89474c412d75a90be2e1b
SHA512 d4dd2a41ab9c17125263824f3f4b5c6f3a5f8dc7c78adc298391a6a18b495a521388e2c8524c5050b7452df89d048a12b014e711fef7e4ed8b439d8959a7357d
SSDEEP 6144:9/c93WBQEoIK6lNS1huqSFeACGcW6kbO36JDWZA+VbfDKHAN2xq:9/c93WBLKUvbhBukbrbqb+gAxq
TLSH
T1F4944A00F281C138E4BB11B67B7D96956428BE720B6988C7B3C86E5F5D709D36B30B67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gG8LQUiBL.tlb

Path C:\Users\Admin\AppData\Local\Temp\00294823\gG8LQUiBL.tlb
Size 3KB
SHA256 2e46c45652d03653c407468ca871f4e910b4cec36af85853e2bd06f3fb7ad4ae
MD5 8d1f5f85eefb09e07c0f1357289b7251
SHA1 f9e39ac9d8e978d8fe834c527a6160eb58392e77
SHA512 df483e23bf19f90b07cf70d5e4bf7a26ece3bea39cc78b0dd652d179890000ec2c603841f5354e27676f60055094e13749ad6fc11dcf56aa8be32a8a7d916fd7
TLSH
T147817B4AFB91CB63C4A941315D6ED3E91670FC198E116B03332A332E6D727897F224A0
MD5 SHA1 SHA512 TLSH

Submit Download

gG8LQUiBL.x64.dll

Path C:\Users\Admin\AppData\Local\Temp\00294823\gG8LQUiBL.x64.dll
Size 463KB
SHA256 5b9f026657796490c626a88c1b7533fc23a1ee92b4bad819f4d0940e18d0c7ae
MD5 51869d78edfbeb04d0805522d9232518
SHA1 4c1a736dbf800b83580265a6c6ae2ebd13e0b3cc
SHA512 9f99165b2c27df5f43131d857340aeb197d24b00a7176943c98f9b45bd7919e4ce002f68c9c1ed03424f42a1ce94ff3968b315cf9f6d2edfba708d86fc2c03fc
SSDEEP 6144:vubh8V1Yg80MDKAjY9HzGSAAbMhj1jT9rtnzkSaTTKPn:vuEa0MDKaY9lAA+TdkSJP
TLSH
T16FA4E746EBB350E8E0B2C53885A3A22AF5727C1587349BDB9341DF6A5F22BD0E53C351
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bootstrap.js

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\bootstrap.js
Size 2KB
SHA256 a7dfea4bf7e1d46a8b8e64ccfb2cf35017e3a5b350eead26d6671254d2b3c46f
MD5 1b53c596cfb1aa2209446ff64c17dabd
SHA1 2542da14728dcdbe1763f1ee39fe9ceae38ad414
SHA512 be54481675c38ef6a41697cf8cd3ab5a0b126922b192732a9c587dd8905b74b66c79eb0c849f62bbe8934979a894be63734b0ad59ffae295f5797cbfaa327030
TLSH
T1D951F14BA5F92410047A3E256B1FA7A535438672398D8E453BA88380FFE0CDBD792DCC
MD5 SHA1 SHA512 TLSH

Submit Download

chrome.manifest

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\chrome.manifest
Size 112B
SHA256 c759dae7c26f9724836981fae89569be2b029600e75554932ecb67e7cf018d6a
MD5 5c1f33cfcda4916e2a0059591cb21929
SHA1 b64d5e571fd68da6843de6aebac84e18fc0f2343
SHA512 a57dc63d7e59ff3e8d9173883e49c9aa2b815134b9c8d9707c4ef67093f12182459b1c4fd6ef8ed4490b8f58b4bfeb24e06a1b12e408cc0e05b2977a34fb8e84
TLSH
T13EB092311B1F534827AAC880144230A07B708D20908471657099108C42C03C1AACEB59
MD5 SHA1 SHA512 TLSH

Submit Download

install.rdf

Path C:\Users\Admin\AppData\Local\Temp\00294823\[email protected]\install.rdf
Size 609B
SHA256 3f5fb53f906d27e5188eb76a0aa1d64924d088b6cda3da036622617e036c9815
MD5 90067d7e9fb93c54e69e1e816fb612b5
SHA1 102e023cf064dd8f7609de4eda6eb2dce4c7c593
SHA512 a4c7182e2f574aa23cfcc02e00a7162ae8877e1a236e361fa05e87b9c14fdd1563634b9429c936a01834ff23041a2d60ccdddad4222512697301b4b275c41266
TLSH
T170F0441ACA40BE14E2A7CB222C709104B27817AE81429048FC8F1E178B8C6EE42B3283
MD5 SHA1 SHA512 TLSH

Submit Download

nauaJoGmCg.dat

Path C:\Users\Admin\AppData\Local\Temp\00294823\nauaJoGmCg.dat
Size 3KB
SHA256 0a9fa89c035e81830587e29214659603d734da5ca2cf82dd390be187beaec057
MD5 c2a97a2a84f2c356de6e609fe8128852
SHA1 19153cbdacc5ead5783ba578150fcb91f6a13b84
SHA512 1ed3fd4978cf3af05d068a35d6a792596c86fe2d72595142d17ede285516af41df4b7c498410ae847cbc6b319eb4ce144afd6406cb46d1ed662337ee6a2cdb96
TLSH
T1E5816C00EF3F67227E725469305193578E72FD8511780D9289E8917C7CB63E04238293
MD5 SHA1 SHA512 TLSH

Submit Download

nauaJoGmCg.exe

Path C:\Users\Admin\AppData\Local\Temp\00294823\nauaJoGmCg.exe
Size 489KB
SHA256 cb90dc623c6927c7d6aae483b917e2b4aca0ed46d0d619dd7fe9fc3e9d74d90f
MD5 a0b8b6a6967532631848d298e7947584
SHA1 921e36f888e2a9fbc73c381109526ce1ea874999
SHA512 773e03d2bc7e7ac4070d238092364060396682b94289aec1fd07dfb91c3e42bbbc0069bcf50ae29750409f22ccbcdecd13c7555a1e3346272b0838d30202287a
SSDEEP 6144:BAV3hBFp2j6Sywkk/C8gtvQgBXOM3zxpgXoXQowI/VAG+7AOPKhkNPerZwQ0:K3hBb8YKgDBX7pg4XQVI/Vl2lZerp0
TLSH
T1B4B43821B3A2D03DD4B346B2FE2EF662143579B846E1944BBBC01E5D28F56D39620F63
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bg.js

Path C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\6apqb380.default-release\extensions\staged\[email protected]\content\bg.js
Size 9KB
SHA256 d3aae42ffd3ff36027872a523dd114b87c843d9c57a9857e27836f8b0107a546
MD5 b1d13f9e6de144f8a20306e7ae63f432
SHA1 8a0f0d2366c90512b63f9b30dbbeb54004733db3
SHA512 fc77284d00bf66477397922eaa500022e8d536f058b52a98a09c10fe8b948ccc24009c701d1cf2589be30047f3a54a8a86f25150dd8ad60e3852500e8cca0716
SSDEEP 192:lo3v4CCMMZ235UsZkJn7ERhz6O7Ov7O3SO0OSSOFOiO4O6VqkYTyac76:uvXtsu1ZkJ4PzRcBTyyB2
TLSH
T15612D5A9B6BB152301A137768C3F1A89D07F9491AC8C48947CFD52E19F78A99009DEFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads