8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9

General

Target

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Size

4.1MB
MD5

1a2b64907ed5c16c599db94e8d1ec6d2
SHA1

375012c47c58a06e2dad5ff8b6748c2cf9618048
SHA256

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9
SHA512

dc864296f838e08c43f2e1335997337ff28c3ab431bb77f5dc529cd0402d253905e2ad9295032038118d116ff614b34e9e5f0684c92668a8f7648cb74e05cfcb
SSDEEP

98304:6kOh1YDuo30kSHG9xfyLII0YJ372FKUP5Hiyc+shUXn6uR3BWV:6RWh009xfyuCyc+shUXn6uR3BW

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\29eNw3ahldRQKc.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exeregsvr32.exeregsvr32.exe

pid process

1652 8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
240 regsvr32.exe
1368 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}\ = "TinyWallet"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}\NoExplorer = "1"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}\ = "TinyWallet"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{2681970d-f50f-4e63-a789-145e073c8a93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Drops file in Program Files directory 8 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

description	ioc	process
File created	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.tlb	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.tlb	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File created	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dat	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dat	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File created	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File created	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dll	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
File opened for modification	C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dll	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2681970D-F50F-4E63-A789-145E073C8A93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2681970D-F50F-4E63-A789-145E073C8A93}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2681970d-f50f-4e63-a789-145e073c8a93}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{2681970d-f50f-4e63-a789-145e073c8a93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Modifies registry class 64 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exeregsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970D-F50F-4E63-A789-145E073C8A93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\Programmable	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970D-F50F-4E63-A789-145E073C8A93}\Implemented Categories	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\ProgID	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{2681970d-f50f-4e63-a789-145e073c8a93}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970D-F50F-4E63-A789-145E073C8A93}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{2681970d-f50f-4e63-a789-145e073c8a93}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\ = "TinyWallet"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\ = "TinyWallet"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\VersionIndependentProgID\	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\ProgID\ = ".9"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\VersionIndependentProgID	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{2681970D-F50F-4E63-A789-145E073C8A93}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93}\Programmable	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{2681970D-F50F-4E63-A789-145E073C8A93}\Implemented Categories	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

pid	process
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

description	pid	process
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Token: SeDebugPrivilege	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exeregsvr32.exe

description	pid	process	target process
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 1652 wrote to memory of 240	1652	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe
PID 240 wrote to memory of 1368	240	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{2681970d-f50f-4e63-a789-145e073c8a93} = "1"	8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe

C:\Users\Admin\AppData\Local\Temp\8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe
"C:\Users\Admin\AppData\Local\Temp\8270240401f67984085dfa3255306a2aa75e9362a19c9245c2b6bc65232e03c9.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1652

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:240

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1368

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dat
Filesize
3KB

MD5
cc12f0fefe410fd009f37640338965a5

SHA1
c06049452e261a822981c735c35dc7e4a14fbf0c

SHA256
8902ab1716bed2a067715842c68f848dded5440fbf52989c70caa7071badf33f

SHA512
b217b26be104b2697e238b48f0003871d89e42b10da5a377450d360b7eec9efd4f44607fa2f5c9b7119ef553e6abc38663d970651b5f7063e4618846ca3aa945

Download Submit
C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.tlb
Filesize
3KB

MD5
0d2aeb4f00b6579ca162c9a79f104dba

SHA1
fbc3019106417014ba01e5703e2729496feb6c39

SHA256
4cbe20901caaa5ec47de0c8e5d5333d219bbc51dadf3ad02083b21a2350fd283

SHA512
083c3b7ec8a01d78880349c2de635e70bc45db1523c6e9962f4d687bd15705b28a4001afd48e7be60e34ab7c2a8bf62ff1b91404c38202cfb51fd7df449e124e

Download Submit
C:\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.dll
Filesize
744KB

MD5
211ab5ec38ee0ed680e1b90b37916d5b

SHA1
5a8f6d8b08d6ebffd28608766fe73660fe00a781

SHA256
c5de64a026df3c1275ea3e50b3565b8cfc4d17b09eb958a23bcc29557589b409

SHA512
451ee835b2caed20a57529059a9e434b8e9139c45a579cc3d6693c1af5b516d3580abcd94370e916ff9a11e5cb859cee4a1dbbab943909d2a77fbc68a200a125

Download Submit
\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
\Program Files (x86)\TinyWallet\29eNw3ahldRQKc.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
memory/240-62-0x0000000000000000-mapping.dmp

Download
memory/1368-66-0x0000000000000000-mapping.dmp

Download
memory/1368-67-0x000007FEFBB81000-0x000007FEFBB83000-memory.dmp

Filesize
8KB

Download
memory/1652-54-0x0000000076041000-0x0000000076043000-memory.dmp

Filesize
8KB

Download
memory/1652-55-0x0000000000550000-0x000000000061B000-memory.dmp

Filesize
812KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads