8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69

General

Target

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Size

3.8MB
MD5

b26577485ebc461b7967b447a3fb2cd0
SHA1

004dd6a10ad81eb59c29e00daf24b3c87850f7ca
SHA256

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69
SHA512

b777651d6cd29b36a25337954e180c90f7cd418ce42069525ecbab18854e0aa05095daf2bbd557e5fff14ea71f4fd6d9cef8aa01d573937f6677d2cff15ee790
SSDEEP

49152:P3YwWSKin8J2vzfQaKiHKNc8T8A+5MSBfLL0fM0iD9AsCfY:QwzKin0wzfvKMK68ToKSBfv0kbW

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\BD0fNWCNIfHHJA.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exeregsvr32.exe

pid process

996 8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
1144 regsvr32.exe
780 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\NoExplorer = "1"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Drops file in System32 directory 4 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Windows\System32\GroupPolicy	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Drops file in Program Files directory 8 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID\ = ".9"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\TinyWallet\\BD0fNWCNIfHHJA.tlb"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ThreadingModel = "Apartment"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\BD0fNWCNIfHHJA.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}\Implemented Categories	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

pid	process
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	pid	process
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exe

description	pid	process	target process
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 996 wrote to memory of 1144	996	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe
PID 1144 wrote to memory of 780	1144	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f} = "1"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

C:\Users\Admin\AppData\Local\Temp\8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
"C:\Users\Admin\AppData\Local\Temp\8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:996

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1144

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:780

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat
Filesize
3KB

MD5
a9ca0e755594d3e8431ce373d07ff4ae

SHA1
9920d9e6042fdee61892f650eb390c67b7962f61

SHA256
6a79c67f96dbb0c38869b28417d518b55788401e9dd1a02483db71795838d043

SHA512
6ad9f9f957c2e08d3c41682a96e1f2085061b233b815cff4e1b465acb75b04e0ce5e06fd7bce055f7b025eb7769193dde1a2d61c42ec78fc350f1cab46cbb831

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb
Filesize
3KB

MD5
0152dae58a1c6dfd44a95f6e69b7b963

SHA1
895438957356d0757810c9a65205a884faec2106

SHA256
76794dc7bc140457b22160a2f056c2c51632c3f7f1240c1715b92ff5da13ad7e

SHA512
24e23727571fdc54d4f6986df3ae18942bade4bba3706b93107ffb2df3a9c76ebd3ed1a3e013fd481709c86b26f45eac33b86d602690b4cfcf6544c8a358c2aa

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll
Filesize
753KB

MD5
12616f209056f6862945cec7d54be14e

SHA1
fc0e12882ceb1d0d8e1b98de09d98a8670f8e729

SHA256
d76f3a653ff95f8af915083ab8bcebdeecb605cf7842cf04b0f627cfdb72fc56

SHA512
67849d35017a6481847bcba348cdfdb60eb0361262d3c22717f2bbc634d6d076fcc03420764aa66ccd0062e2d13a95a70e1b271fb1c4245ab18427eb10615f08

Download Submit
\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
memory/780-66-0x0000000000000000-mapping.dmp

Download
memory/780-67-0x000007FEFBBF1000-0x000007FEFBBF3000-memory.dmp

Filesize
8KB

Download
memory/996-54-0x00000000760E1000-0x00000000760E3000-memory.dmp

Filesize
8KB

Download
memory/996-55-0x0000000000810000-0x00000000008D9000-memory.dmp

Filesize
804KB

Download
memory/1144-62-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads