Analysis
-
max time kernel
39s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:01
Static task
static1
Behavioral task
behavioral1
Sample
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe
Resource
win10v2004-20221111-en
General
-
Target
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe
-
Size
4.3MB
-
MD5
1058e7221af7a5ead913a633e7359d01
-
SHA1
6592ad9d1f4131391558a472a01b32c812b6a640
-
SHA256
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e
-
SHA512
b37734489b6fa9ce820b667ef4973fdec24f3f93ef1ff16843f5fc3422c870863d28fdf8fc095aea0acddd8951c570636f89cb2c725368fe0b475518c2f009b9
-
SSDEEP
49152:wrbSCcbNWMdfBcm9fEC7VAE4N3XnSOu4vO6yiMPn+7d8cYxpA:ZWMvdMNHnS74v1nMPn+7
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\P7mfDMIWFePvVx.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exeregsvr32.exeregsvr32.exepid process 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1428 regsvr32.exe 1152 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnfhfikgijelpakhcbolfpjbicmijfcj\1.0\manifest.json cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnfhfikgijelpakhcbolfpjbicmijfcj\1.0\manifest.json cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fnfhfikgijelpakhcbolfpjbicmijfcj\1.0\manifest.json cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ = "TinyWallet" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\NoExplorer = "1" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ = "TinyWallet" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Drops file in Program Files directory 8 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exedescription ioc process File opened for modification C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dll cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.dll cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File opened for modification C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.dll cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.tlb cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File opened for modification C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.tlb cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.dat cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File opened for modification C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.dat cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe File created C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dll cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C51B7DF4-6DA1-44AD-983F-6970D1A6BA22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{C51B7DF4-6DA1-44AD-983F-6970D1A6BA22} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Modifies registry class 64 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ProgID cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{c51b7df4-6da1-44ad-983f-6970d1a6ba22}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\TinyWallet" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ = "TinyWallet" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32\ThreadingModel = "Apartment" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{c51b7df4-6da1-44ad-983f-6970d1a6ba22}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\P7mfDMIWFePvVx.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ProgID cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ProgID\ = ".9" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\TinyWallet\\P7mfDMIWFePvVx.tlb" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\ = "TinyWallet" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\Programmable cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{C51B7DF4-6DA1-44AD-983F-6970D1A6BA22}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\VersionIndependentProgID\ regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22}\InprocServer32 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exepid process 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exedescription pid process Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Token: SeDebugPrivilege 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exeregsvr32.exedescription pid process target process PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1220 wrote to memory of 1428 1220 cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe PID 1428 wrote to memory of 1152 1428 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{c51b7df4-6da1-44ad-983f-6970d1a6ba22} = "1" cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe"C:\Users\Admin\AppData\Local\Temp\cee8faaf85e12cd2d676dc6025271a144a3727948c45633a5f409f304f0b948e.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.datFilesize
3KB
MD5daf656274499b66a622af767c6943541
SHA115f606debdf7db783d161eca937e1b2f1f9b228b
SHA2567ba6abc9689b14f9455776d2e7f129bed6cdf127e0b58e60aa535ea40ce1e6fb
SHA5124e6d895c0eb0aaf68c648119cc291f83eb17b71914e12734a7bd0b84386958cd4e117aa5c5a1b57d27d02415c0bbda4430f7132a3e1a6c72c5c3b3b516953071
-
C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.tlbFilesize
3KB
MD5d83675648e6f93a17ca3b6062d97759d
SHA14072a4f6e706a0121be068aa3a38ba4a7c4f9ba1
SHA2564c1cecd724cb309cf65ccdc1ddaf8678524abc45a2bb3dedbb5f3ae5e603968c
SHA512d27620a33f446aef5e7501ce599b3b09b9df1d2a12cbf9644ce50610709b50052eb89e48f8360123a67876780cc0d584e09be82f65ab4e3694271ccd26a00841
-
C:\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.dllFilesize
737KB
MD515b1d0053054e33606c48c3be74b73fb
SHA1c6bded9c595b0cca4039470b43005b30af94d004
SHA256a959cc9313ba65bb36d7041db8bb7e735fbf5fc550e345e5ca132eb7097d5c80
SHA512647492954e192cf2f9685852ed7f90991ff73f084bd1537bd573fdb527be4cc1d63b23961cccfc43424e75f226a8b2dcd37ded53dd72195637219df67c6964b5
-
\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\TinyWallet\P7mfDMIWFePvVx.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
memory/1152-65-0x0000000000000000-mapping.dmp
-
memory/1152-66-0x000007FEFB531000-0x000007FEFB533000-memory.dmpFilesize
8KB
-
memory/1220-54-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/1220-55-0x0000000002950000-0x0000000002A18000-memory.dmpFilesize
800KB
-
memory/1428-61-0x0000000000000000-mapping.dmp