dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521

General

Target

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Size

3.6MB
MD5

4258a8e06c306af4b10d47845edc3f5a
SHA1

4cce90ffc31b89c573f98ef1c15c9cd91561cd87
SHA256

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521
SHA512

27b2708d412fa50812304c727e4dcf1d2eefa58a0784b77189a6f433a5a11535f7e7ab30f51b123a1e50c866c4ea484771807aae750ce102c1e5bff789329a63
SSDEEP

49152:74nE7OIsfFhUwdNN8mDISXM+w7PcfsM0r4xOyjHdmyMYpSWEZqh:74nEQfFhUvmDIS8kfsKxjHdblpSWEk

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\MHCy5Ig6mdI9OK.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exeregsvr32.exeregsvr32.exe

pid process

1060 dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1864 regsvr32.exe
1244 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nicljbcalminjmippjmopbbhlfahfhbn\1.0\manifest.json	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nicljbcalminjmippjmopbbhlfahfhbn\1.0\manifest.json	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nicljbcalminjmippjmopbbhlfahfhbn\1.0\manifest.json	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exedcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ = "TinyWallet"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ = "TinyWallet"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}\NoExplorer = "1"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{345855ab-57c9-4d2b-ae4e-befc805bae94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Drops file in System32 directory 4 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Drops file in Program Files directory 8 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
File created	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dll	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dll	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.tlb	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.tlb	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File created	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dat	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dat	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exedcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{345855ab-57c9-4d2b-ae4e-befc805bae94}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{345855ab-57c9-4d2b-ae4e-befc805bae94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{345855AB-57C9-4D2B-AE4E-BEFC805BAE94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{345855AB-57C9-4D2B-AE4E-BEFC805BAE94}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855AB-57C9-4D2B-AE4E-BEFC805BAE94}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{345855ab-57c9-4d2b-ae4e-befc805bae94}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855AB-57C9-4D2B-AE4E-BEFC805BAE94}\Implemented Categories	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\TinyWallet"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855AB-57C9-4D2B-AE4E-BEFC805BAE94}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\TinyWallet\\MHCy5Ig6mdI9OK.tlb"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ProgID	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{345855ab-57c9-4d2b-ae4e-befc805bae94}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ProgID\ = ".9"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\VersionIndependentProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ = "TinyWallet"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\VersionIndependentProgID\	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\VersionIndependentProgID	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94}\Programmable	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

pid	process
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	pid	process
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Token: SeDebugPrivilege	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exeregsvr32.exe

description	pid	process	target process
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1060 wrote to memory of 1864	1060	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe
PID 1864 wrote to memory of 1244	1864	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{345855ab-57c9-4d2b-ae4e-befc805bae94} = "1"	dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe

C:\Users\Admin\AppData\Local\Temp\dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe
"C:\Users\Admin\AppData\Local\Temp\dcddff9dce6f9879176760ab75ccabbf41e31371f982471de8b922eaf8f8b521.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1060

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1864

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1244

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dat

Filesize
3KB

MD5
18bbca0bf2087904b23656843163eff1

SHA1
33e769b8a7cfb20fb53adc3ebd3a251bde304aec

SHA256
b6075fceff55396e57ae659765522690e278ea0e5b6fe9dc6f357409eb3ab907

SHA512
c5e0673274ed4d389751bfb16b626a47b50e58db1ef0bccf8f59d8b75441f89b30818c05c997896e6aecf3bb0ae15e7877d572bf37bba25aa2401894ee61b50a

Download Submit
C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.tlb

Filesize
3KB

MD5
74dcfbb4c0210a05872897b72dad6ccc

SHA1
ae4fe72c69877b895e4fd9e27dcdb57edaf08e5b

SHA256
fd828f1d5979ed1997727e6709529f2455e308ff5d771ecf8f362dc311c116a6

SHA512
8aff1886b7a1e20bb1b4aedf9ce380c607f9e34d7cb155890b0de4f45a2fdd3a7d4c66bc43341521100ca675b64e966e90cf0a4220ec813681172baf0b2e96dc

Download Submit
C:\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.dll

Filesize
626KB

MD5
40bb0aaab84ce029293396ecf927c32d

SHA1
52f60ebe0af63494869e9b9e8ced6409cd9461fb

SHA256
b268dd30a47ce2568d761b67fb522d9c0f5638dc0f0b2bc229bb589b49745d78

SHA512
8f9d3f7c3e0ceac22096e125bbf31c4e7206b804cb9482ae7eebfca63dcbc09bb8e64341820a501c3d03e15b2658b29706c3e222a2d68312a8f7023ca14dd706

Download Submit
\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\TinyWallet\MHCy5Ig6mdI9OK.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
memory/1060-54-0x0000000074DA1000-0x0000000074DA3000-memory.dmp

Filesize
8KB

Download
memory/1060-55-0x00000000027C0000-0x0000000002864000-memory.dmp

Filesize
656KB

Download
memory/1244-65-0x0000000000000000-mapping.dmp

Download
memory/1244-66-0x000007FEFB5D1000-0x000007FEFB5D3000-memory.dmp

Filesize
8KB

Download
memory/1864-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads