Analysis
-
max time kernel
44s -
max time network
64s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 19:05
Static task
static1
Behavioral task
behavioral1
Sample
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe
Resource
win10v2004-20220901-en
General
-
Target
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe
-
Size
4.2MB
-
MD5
392eb4f6b1bdee5e29975f8acb94ce07
-
SHA1
660b31b9f03b1cef3ce8ad6b5598a8b82e86d334
-
SHA256
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b
-
SHA512
96f4a436e29636e25bf1964b0489c03887c98790acbb09670817263b5f2331507b3b646ed16e40b7bbaac678ef611ca21681b3c22cdcf50bfadb54b62402ee9f
-
SSDEEP
49152:lo2ipIZ1YdVemQGdy+dYXt+nnxR9VarazzibdEkoCfdeCyvJ+ZyUReq7TLzWY:q9piYdVemZylXgXhzzibdlwCyEvR3z
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\HSxy2tteZTt0N9.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exeregsvr32.exeregsvr32.exepid process 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 668 regsvr32.exe 576 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmicammghmboghjicnclpnmmnkgjmdng\1.0\manifest.json cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmicammghmboghjicnclpnmmnkgjmdng\1.0\manifest.json cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jmicammghmboghjicnclpnmmnkgjmdng\1.0\manifest.json cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.execd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92}\ = "TinyWallet" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92}\ = "TinyWallet" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92}\NoExplorer = "1" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{adb3d944-9110-428c-b338-8d8f0e713a92} regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Drops file in Program Files directory 8 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process File created C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.dll cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.dll cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.tlb cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.tlb cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.dat cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.dat cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File created C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dll cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe File opened for modification C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dll cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Processes:
regsvr32.execd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{adb3d944-9110-428c-b338-8d8f0e713a92} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{adb3d944-9110-428c-b338-8d8f0e713a92} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ADB3D944-9110-428C-B338-8D8F0E713A92} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ADB3D944-9110-428C-B338-8D8F0E713A92} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\VersionIndependentProgID cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\HSxy2tteZTt0N9.dll" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32\ThreadingModel = "Apartment" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADB3D944-9110-428C-B338-8D8F0E713A92}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\TinyWallet" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\HSxy2tteZTt0N9.x64.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ADB3D944-9110-428C-B338-8D8F0E713A92}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ADB3D944-9110-428C-B338-8D8F0E713A92}\Implemented Categories cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\ProgID\ = ".9" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\VersionIndependentProgID cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\TinyWallet\\HSxy2tteZTt0N9.tlb" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\ProgID\ = ".9" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{adb3d944-9110-428c-b338-8d8f0e713a92}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\ProgID cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\InprocServer32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\ = "TinyWallet" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92}\Programmable cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exepid process 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription pid process Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Token: SeDebugPrivilege 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exeregsvr32.exedescription pid process target process PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 972 wrote to memory of 668 972 cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe PID 668 wrote to memory of 576 668 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{adb3d944-9110-428c-b338-8d8f0e713a92} = "1" cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe"C:\Users\Admin\AppData\Local\Temp\cd9be34a78d6796e1e221ca599f8eb7fc2ef079344af166d6993880d8cd80e6b.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.datFilesize
3KB
MD5548d5bd036c828af0038831c4f1464d9
SHA147130743e2ca2ad3741a8af531cdddc670bc4de9
SHA256fa25b74b7d244a7eac8d12b94db5abbbe379376e68654956599ff5f87e6c903c
SHA5123edc7a117ab32b562b9bbb9bdbf6c41306b288571aa5eaa5179ee928ad681bb8c3d3230904ff4cddd81824ef54038590681c6e0325419d391ef4fd46af70a5b7
-
C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.tlbFilesize
3KB
MD5dad7dc8242a2925ade239718a506374e
SHA108d7aba181e62216e2976c15a9107b760e0ef3ab
SHA2567dd64eeefd4900b4ef39b47ef2cbe5cf6f7e184ca74dedb351c749c60d39981b
SHA51271dd707836f3415c8b36cc485a879f82d3d5bd0cae95b891eb8cc3fcb3a3ada8f3fa53b68a06a866bca111b8c72d75bcefc118c9785fa20178cf13c4e57ac8ea
-
C:\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.dllFilesize
740KB
MD5f37095c241e62cc8b66a00a187fd1155
SHA182a9120f26b4e76df5fe123a5176d28aa898b23c
SHA2560810e4c7b6fb4ad3f7a3abee5bf321f720515e6c3e605c9348bc51e741906874
SHA512eab1bdf2b0f79af777ce967d02789cf3fc39a09fafa43ff230a650bc42e871538e98953479a2849249d765037dc92175069335d8010da4fc1286f48a088b8b9b
-
\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\TinyWallet\HSxy2tteZTt0N9.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
memory/576-65-0x0000000000000000-mapping.dmp
-
memory/576-66-0x000007FEFB771000-0x000007FEFB773000-memory.dmpFilesize
8KB
-
memory/668-61-0x0000000000000000-mapping.dmp
-
memory/972-54-0x0000000074D81000-0x0000000074D83000-memory.dmpFilesize
8KB
-
memory/972-55-0x0000000002960000-0x0000000002A2B000-memory.dmpFilesize
812KB