Analysis
-
max time kernel
25s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24/11/2022, 10:43
Static task
static1
Behavioral task
behavioral1
Sample
53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
General
-
Target
53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe
-
Size
4.2MB
-
MD5
de9eadc49d5be342ac805de6b24662df
-
SHA1
9f5c0aaa3a7440ab04091cd49cd8a42a1ef65922
-
SHA256
53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f
-
SHA512
5a2fa3059df75a1e52b56af23ec5fbf4e0035e3749e4811eaa03da6f89f26506a67dde3b8b36ed1066bd79056b0d154e1dda6e0224eda19fe094eebe531baecc
-
SSDEEP
98304:nHyu3FMNc0kSHaRxfyDII7YJ372FeZP5Hiyc+shFkevFrmyerz/rg0:nfH0ARxfyACyc+shFFMrz/rg
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\fyCqbg76PNWhYY.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
pid Process 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 1708 regsvr32.exe 952 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjdadgplgajdiakjdefihdgihbfjgnl\5.2\manifest.json 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjdadgplgajdiakjdefihdgihbfjgnl\5.2\manifest.json 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\kjjdadgplgajdiakjdefihdgihbfjgnl\5.2\manifest.json 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783}\ = "PriceLess" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783}\NoExplorer = "1" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783}\ = "PriceLess" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e323126d-8840-4a40-ac94-4af763703783} regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Windows\System32\GroupPolicy 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.dll 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.dll 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File created C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.tlb 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.tlb 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File created C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.dat 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.dat 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File created C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.x64.dll 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe File opened for modification C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.x64.dll 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{e323126d-8840-4a40-ac94-4af763703783} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{e323126d-8840-4a40-ac94-4af763703783} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E323126D-8840-4A40-AC94-4AF763703783} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{E323126D-8840-4A40-AC94-4AF763703783} regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\ = "PriceLess" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\VersionIndependentProgID\ 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\fyCqbg76PNWhYY.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E323126D-8840-4A40-AC94-4AF763703783} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E323126D-8840-4A40-AC94-4AF763703783}\Implemented Categories 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{e323126d-8840-4a40-ac94-4af763703783}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\Programmable 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{e323126d-8840-4a40-ac94-4af763703783}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E323126D-8840-4A40-AC94-4AF763703783}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\VersionIndependentProgID 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\InprocServer32\ThreadingModel = "Apartment" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\fyCqbg76PNWhYY.tlb" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriceLess" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{E323126D-8840-4A40-AC94-4AF763703783}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\VersionIndependentProgID 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{e323126d-8840-4a40-ac94-4af763703783}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{e323126d-8840-4a40-ac94-4af763703783}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Token: SeDebugPrivilege 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 2028 wrote to memory of 1708 2028 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe 28 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 PID 1708 wrote to memory of 952 1708 regsvr32.exe 29 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{e323126d-8840-4a40-ac94-4af763703783} = "1" 53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe"C:\Users\Admin\AppData\Local\Temp\53a80461ddcd9b6c885cbd63f6deb867815c60a189e6754891e4f13f71feeb6f.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2028 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\fyCqbg76PNWhYY.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:952
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD50dde6ffa170966ea36d3670c6baa225d
SHA1ba15b73b107255126c101ac3e9b7d1cb16d072f2
SHA25633f71edb11f35934b83e3aa9b0d099bc670101e819a1c67cba59f2a0190fe061
SHA5122dbcc97b1735ee20ae03df5d39bb2b35cf39548a772f48de2d082f3cff45a6ecefa1a17448c114ffe3573c74937fb231c2460f3a22dbc4e851f2f842c4ee90bf
-
Filesize
3KB
MD50d2aeb4f00b6579ca162c9a79f104dba
SHA1fbc3019106417014ba01e5703e2729496feb6c39
SHA2564cbe20901caaa5ec47de0c8e5d5333d219bbc51dadf3ad02083b21a2350fd283
SHA512083c3b7ec8a01d78880349c2de635e70bc45db1523c6e9962f4d687bd15705b28a4001afd48e7be60e34ab7c2a8bf62ff1b91404c38202cfb51fd7df449e124e
-
Filesize
874KB
MD51dc66c50cea34da91b5e917e0157ff0d
SHA1c7ddb2f9d46f1836d7368434db0131619f5e7c08
SHA25619627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0
SHA51248e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef
-
Filesize
744KB
MD5211ab5ec38ee0ed680e1b90b37916d5b
SHA15a8f6d8b08d6ebffd28608766fe73660fe00a781
SHA256c5de64a026df3c1275ea3e50b3565b8cfc4d17b09eb958a23bcc29557589b409
SHA512451ee835b2caed20a57529059a9e434b8e9139c45a579cc3d6693c1af5b516d3580abcd94370e916ff9a11e5cb859cee4a1dbbab943909d2a77fbc68a200a125
-
Filesize
874KB
MD51dc66c50cea34da91b5e917e0157ff0d
SHA1c7ddb2f9d46f1836d7368434db0131619f5e7c08
SHA25619627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0
SHA51248e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef
-
Filesize
874KB
MD51dc66c50cea34da91b5e917e0157ff0d
SHA1c7ddb2f9d46f1836d7368434db0131619f5e7c08
SHA25619627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0
SHA51248e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef