8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69

General

Target

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Size

3.8MB
MD5

b26577485ebc461b7967b447a3fb2cd0
SHA1

004dd6a10ad81eb59c29e00daf24b3c87850f7ca
SHA256

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69
SHA512

b777651d6cd29b36a25337954e180c90f7cd418ce42069525ecbab18854e0aa05095daf2bbd557e5fff14ea71f4fd6d9cef8aa01d573937f6677d2cff15ee790
SSDEEP

49152:P3YwWSKin8J2vzfQaKiHKNc8T8A+5MSBfLL0fM0iD9AsCfY:QwzKin0wzfvKMK68ToKSBfv0kbW

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\BD0fNWCNIfHHJA.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exeregsvr32.exe

pid process

2044 8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2176 regsvr32.exe
2424 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 5 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ohfgpbbdpjkciffkkieibcbhbgcfofli\1.0\manifest.json	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\NoExplorer = "1"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Drops file in System32 directory 4 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Windows\System32\GroupPolicy	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Drops file in Program Files directory 8 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File created	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

regsvr32.exe8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe

Modifies registry class 64 IoCs

Processes:

regsvr32.exe8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID\ = ".9"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}\Implemented Categories	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID\	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ = "TinyWallet"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\ProgID	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ThreadingModel = "Apartment"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\BD0fNWCNIfHHJA.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{859881aa-7f0b-44be-9d7c-67dcba3b452f}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\InprocServer32	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{859881AA-7F0B-44BE-9D7C-67DCBA3B452F}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f}\Programmable	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

pid	process
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	pid	process
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
Token: SeDebugPrivilege	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

Suspicious use of WriteProcessMemory 5 IoCs

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exeregsvr32.exe

description	pid	process	target process
PID 2044 wrote to memory of 2176	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 2044 wrote to memory of 2176	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 2044 wrote to memory of 2176	2044	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	regsvr32.exe	regsvr32.exe
PID 2176 wrote to memory of 2424	2176	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 1 IoCs

evasion

Modify Registry

T1112

Processes:

8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{859881aa-7f0b-44be-9d7c-67dcba3b452f} = "1"	8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe

C:\Users\Admin\AppData\Local\Temp\8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe
"C:\Users\Admin\AppData\Local\Temp\8cc06b9c6216a14c6cc2410e755f865598ce90b0c0e674d850e1c25d39430e69.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2044

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2176

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2424

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
1⤵
PID:1428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

1

T1176

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dat
Filesize
3KB

MD5
a9ca0e755594d3e8431ce373d07ff4ae

SHA1
9920d9e6042fdee61892f650eb390c67b7962f61

SHA256
6a79c67f96dbb0c38869b28417d518b55788401e9dd1a02483db71795838d043

SHA512
6ad9f9f957c2e08d3c41682a96e1f2085061b233b815cff4e1b465acb75b04e0ce5e06fd7bce055f7b025eb7769193dde1a2d61c42ec78fc350f1cab46cbb831

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.dll
Filesize
753KB

MD5
12616f209056f6862945cec7d54be14e

SHA1
fc0e12882ceb1d0d8e1b98de09d98a8670f8e729

SHA256
d76f3a653ff95f8af915083ab8bcebdeecb605cf7842cf04b0f627cfdb72fc56

SHA512
67849d35017a6481847bcba348cdfdb60eb0361262d3c22717f2bbc634d6d076fcc03420764aa66ccd0062e2d13a95a70e1b271fb1c4245ab18427eb10615f08

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.tlb
Filesize
3KB

MD5
0152dae58a1c6dfd44a95f6e69b7b963

SHA1
895438957356d0757810c9a65205a884faec2106

SHA256
76794dc7bc140457b22160a2f056c2c51632c3f7f1240c1715b92ff5da13ad7e

SHA512
24e23727571fdc54d4f6986df3ae18942bade4bba3706b93107ffb2df3a9c76ebd3ed1a3e013fd481709c86b26f45eac33b86d602690b4cfcf6544c8a358c2aa

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
C:\Program Files (x86)\TinyWallet\BD0fNWCNIfHHJA.x64.dll
Filesize
890KB

MD5
dbdd5a981bb803210188cc5f47853374

SHA1
3ee3427556bf240a4e381c59c221157474f6332e

SHA256
82dd9d5cc8dffbdbbcbb846f9de1719467f957faec0e469cf03f661c6db34e95

SHA512
8952131b23a1536f76e85d61f971827f17f3faba4e376e3ec2a57a98c57906ba36ba0d630f87eb684760fadd1d268ccf7e099c3731c09e755698726c01b91515

Download Submit
memory/2044-132-0x0000000003A00000-0x0000000003AC9000-memory.dmp

Filesize
804KB

Download
memory/2176-138-0x0000000000000000-mapping.dmp

Download
memory/2424-141-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads