Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:14
Static task
static1
Behavioral task
behavioral1
Sample
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe
Resource
win10v2004-20221111-en
General
-
Target
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe
-
Size
4.3MB
-
MD5
ccdc0150b7d3ad18eeb151d8071016a3
-
SHA1
33ac9cae63bd68ee1d96d19bdf20c9a8dd182dd4
-
SHA256
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4
-
SHA512
913c44419edb0c7ac7e57a5974c3dd834ebcb09f6687111b4a20968becb4378341b06d7f99b8a47d047e95c3a3e7bf1e513bce0299e78ff22b6160176fc3f8bb
-
SSDEEP
49152:EUEvXcbN7MdNBR/PBfltMqdMxR+w2UduyiV4vO6yiMPn+7d0agxpA:37MRR1FMnlduyiV4v1nMPn+7
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\f83dFOfzAIIrNC.x64.dll" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exeregsvr32.exeregsvr32.exepid process 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2036 regsvr32.exe 768 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\egpilbgeiomodhcomhkmgdlibibmlefp\5.2\manifest.json a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\egpilbgeiomodhcomhkmgdlibibmlefp\5.2\manifest.json a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\egpilbgeiomodhcomhkmgdlibibmlefp\5.2\manifest.json a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exea5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032}\ = "PriceLess" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032}\NoExplorer = "1" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032}\ = "PriceLess" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{abdac405-185b-4ad5-add1-4a0984e7e032}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Drops file in Program Files directory 8 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process File opened for modification C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.dat a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dll a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File opened for modification C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dll a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.dll a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File opened for modification C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.dll a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.tlb a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File opened for modification C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.tlb a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe File created C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.dat a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Processes:
regsvr32.exea5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{abdac405-185b-4ad5-add1-4a0984e7e032} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{abdac405-185b-4ad5-add1-4a0984e7e032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032} regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032}\Implemented Categories a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\ = "PriceLess" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\ = "PriceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{abdac405-185b-4ad5-add1-4a0984e7e032}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\ProgID\ = ".9" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\f83dFOfzAIIrNC.dll" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\Programmable a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{abdac405-185b-4ad5-add1-4a0984e7e032}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\VersionIndependentProgID a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\VersionIndependentProgID\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\InprocServer32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\f83dFOfzAIIrNC.tlb" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriceLess" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{abdac405-185b-4ad5-add1-4a0984e7e032}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\Programmable a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{ABDAC405-185B-4AD5-ADD1-4A0984E7E032} a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exepid process 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription pid process Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Token: SeDebugPrivilege 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exeregsvr32.exedescription pid process target process PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2028 wrote to memory of 2036 2028 a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe PID 2036 wrote to memory of 768 2036 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{abdac405-185b-4ad5-add1-4a0984e7e032} = "1" a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe"C:\Users\Admin\AppData\Local\Temp\a5d4b2c4975d300359d2b95a90940d5f5b7382487e5a979e8ced307ca75a8de4.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.datFilesize
3KB
MD56e3a5bc65ad71ed5fd1ccd765ca3ac64
SHA1e51ea12e0961470aa6eae34306f776f7d73428b2
SHA256c3e93507089e406097c3f8153a467ed5eb029b17eabf9791292439d6131dd887
SHA51257a1a4a4ae2c5add120dfeda85ef1646763d654d59bd037d8c060fe7cf698c2dfe850328c6ea35ad4fc4f3d816e0bd9b6ddc373b26f045647427195436a08520
-
C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.tlbFilesize
3KB
MD5d83675648e6f93a17ca3b6062d97759d
SHA14072a4f6e706a0121be068aa3a38ba4a7c4f9ba1
SHA2564c1cecd724cb309cf65ccdc1ddaf8678524abc45a2bb3dedbb5f3ae5e603968c
SHA512d27620a33f446aef5e7501ce599b3b09b9df1d2a12cbf9644ce50610709b50052eb89e48f8360123a67876780cc0d584e09be82f65ab4e3694271ccd26a00841
-
C:\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.dllFilesize
737KB
MD515b1d0053054e33606c48c3be74b73fb
SHA1c6bded9c595b0cca4039470b43005b30af94d004
SHA256a959cc9313ba65bb36d7041db8bb7e735fbf5fc550e345e5ca132eb7097d5c80
SHA512647492954e192cf2f9685852ed7f90991ff73f084bd1537bd573fdb527be4cc1d63b23961cccfc43424e75f226a8b2dcd37ded53dd72195637219df67c6964b5
-
\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\PriceLess\f83dFOfzAIIrNC.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
memory/768-71-0x0000000000000000-mapping.dmp
-
memory/768-72-0x000007FEFB631000-0x000007FEFB633000-memory.dmpFilesize
8KB
-
memory/2028-54-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/2028-55-0x0000000000550000-0x0000000000618000-memory.dmpFilesize
800KB
-
memory/2036-67-0x0000000000000000-mapping.dmp