f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81

General

Target

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Size

3.6MB
MD5

47a6e22d22bcef59ddcc80ae67015b2e
SHA1

52e8656c18cba56dbba496d9c1189d91715a19b0
SHA256

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81
SHA512

86024babadf0624fea9f1d1c7b8cd2067a120b96ee8dd73997e00da5583a46835d2f4ee2df91cc33bb6c124112ab760a97aaa67f88e06654882e8bfe72564083
SSDEEP

49152:FenE7OV9IaDRmipN8mDISXM07PefsM0r4xOygHdmyMYpSWfZqA:FenES9DRwmDIS/GfsKxgHdblpSWfk

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\I6OtNjdzKIs45H.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exeregsvr32.exeregsvr32.exe

pid process

612 f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
1484 regsvr32.exe
536 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcgedhjjccopdpdohbimbpjhfohmpkmn\5.2\manifest.json	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcgedhjjccopdpdohbimbpjhfohmpkmn\5.2\manifest.json	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kcgedhjjccopdpdohbimbpjhfohmpkmn\5.2\manifest.json	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exef30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}\ = "PriceLess"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}\NoExplorer = "1"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1c67e171-23fb-4b28-a841-db14ef659a83}\ = "PriceLess"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	ioc	process
File opened for modification	C:\Windows\System32\GroupPolicy	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Drops file in Program Files directory 8 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	ioc	process
File created	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dll	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dll	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.tlb	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.tlb	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dat	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dat	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File created	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
File opened for modification	C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1c67e171-23fb-4b28-a841-db14ef659a83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1C67E171-23FB-4B28-A841-DB14EF659A83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1C67E171-23FB-4B28-A841-DB14EF659A83}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{1c67e171-23fb-4b28-a841-db14ef659a83}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Modifies registry class 64 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C67E171-23FB-4B28-A841-DB14EF659A83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{1c67e171-23fb-4b28-a841-db14ef659a83}"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\VersionIndependentProgID	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\I6OtNjdzKIs45H.dll"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ProgID\ = ".9"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\I6OtNjdzKIs45H.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C67E171-23FB-4B28-A841-DB14EF659A83}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ProgID\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriceLess"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ = "PriceLess"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1C67E171-23FB-4B28-A841-DB14EF659A83}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1C67E171-23FB-4B28-A841-DB14EF659A83}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{1c67e171-23fb-4b28-a841-db14ef659a83}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\VersionIndependentProgID\	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\Programmable	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ = "PriceLess"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83}\ProgID	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\I6OtNjdzKIs45H.tlb"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

pid	process
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	pid	process
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Token: SeDebugPrivilege	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exeregsvr32.exe

description	pid	process	target process
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 612 wrote to memory of 1484	612	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe
PID 1484 wrote to memory of 536	1484	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{1c67e171-23fb-4b28-a841-db14ef659a83} = "1"	f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe

C:\Users\Admin\AppData\Local\Temp\f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe
"C:\Users\Admin\AppData\Local\Temp\f30ae3cadadc5cfaf4fc217710b32aa6a070e2f988bedef1ac247b5841c60d81.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:612
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll"
    3⤵
    - Registers COM server for autorun
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:536

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dat

Filesize
3KB

MD5
9b942b02e02014b19fa028eb10b2408d

SHA1
d9d0c0847dc7f80b7b6ac9c453250d522b89f705

SHA256
696127452514d39ffa555bbdf309a4674a76066b137a8a0c65a80548b07be00d

SHA512
fcf761774ea2eedfdf39f6fe6e124b662d138980d44da8b4fdd2e2e3b8ff752cdb0eaa0275efcdc4adc9e068e03904ef0cbc29ccb19fd1f339809b417b7807c4

Download Submit
C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.tlb

Filesize
3KB

MD5
74dcfbb4c0210a05872897b72dad6ccc

SHA1
ae4fe72c69877b895e4fd9e27dcdb57edaf08e5b

SHA256
fd828f1d5979ed1997727e6709529f2455e308ff5d771ecf8f362dc311c116a6

SHA512
8aff1886b7a1e20bb1b4aedf9ce380c607f9e34d7cb155890b0de4f45a2fdd3a7d4c66bc43341521100ca675b64e966e90cf0a4220ec813681172baf0b2e96dc

Download Submit
C:\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.dll

Filesize
626KB

MD5
40bb0aaab84ce029293396ecf927c32d

SHA1
52f60ebe0af63494869e9b9e8ced6409cd9461fb

SHA256
b268dd30a47ce2568d761b67fb522d9c0f5638dc0f0b2bc229bb589b49745d78

SHA512
8f9d3f7c3e0ceac22096e125bbf31c4e7206b804cb9482ae7eebfca63dcbc09bb8e64341820a501c3d03e15b2658b29706c3e222a2d68312a8f7023ca14dd706

Download Submit
\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
\Program Files (x86)\PriceLess\I6OtNjdzKIs45H.x64.dll

Filesize
703KB

MD5
02dc4deb3ed0a4ed4ab84f5ec9fd303b

SHA1
1376b56ac30294ddff639dbf3b832d534f3c3fb9

SHA256
8498051cb730a3be5d7dc8eabd939f2f7223464145061bc15afc7d3cee88c421

SHA512
1bea8bbe0ce9cc0f652437c7ebb2b1c6d2741db6976a6b3228cc5358a5985f47228e1b475d7ed4bf66a0834c09916517c3e813a6b9ebebedf608a8666493a1b7

Download Submit
memory/536-65-0x0000000000000000-mapping.dmp

Download
memory/536-66-0x000007FEFBA21000-0x000007FEFBA23000-memory.dmp

Filesize
8KB

Download
memory/612-54-0x0000000075011000-0x0000000075013000-memory.dmp

Filesize
8KB

Download
memory/612-55-0x00000000007A0000-0x0000000000844000-memory.dmp

Filesize
656KB

Download
memory/1484-61-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads