aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1

General

Target

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Size

4.7MB
MD5

5c1af6c4ee3ef15c7daf7cafc0770275
SHA1

52a2dfb3dd0243ec61dde701fac8788c91307f31
SHA256

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1
SHA512

c3e41a24164360ae37f8f4afd619cb994c46e86ac98e6a61c67b1fd9f414925dd879c095bcf88c6d1f1db516e513a66fa9576fea2b3a08707e85a700f5686f2e
SSDEEP

49152:xhTUhc3r3uqMRBIp+jGnLJJ6kWXbvNV/zwFC4+Gmr4BOIa8+8vM5Xx37ayvjz7r:3pMAp+jkr6jRt74pmwvX+8vM

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\g9dm6PLCuYqXor.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exeregsvr32.exeregsvr32.exe

pid process

1148 aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
848 regsvr32.exe
812 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	ioc	process
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmcehkjocgnhjkdlcncbjbibbioobjdl\5.2\manifest.json	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmcehkjocgnhjkdlcncbjbibbioobjdl\5.2\manifest.json	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmcehkjocgnhjkdlcncbjbibbioobjdl\5.2\manifest.json	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exeaa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ = "PriceLess"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\NoExplorer = "1"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ = "PriceLess"	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Windows\System32\GroupPolicy	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Drops file in Program Files directory 8 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	ioc	process
File created	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.tlb	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.tlb	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dat	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dat	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File created	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dll	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
File opened for modification	C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dll	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Modifies registry class 64 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\VersionIndependentProgID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\VersionIndependentProgID\	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\Programmable	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ = "PriceLess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\g9dm6PLCuYqXor.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\g9dm6PLCuYqXor.tlb"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ProgID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ProgID\ = ".9"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D06AA9C7-C72D-40A1-86FF-EA7FC048EB36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\VersionIndependentProgID\	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\VersionIndependentProgID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\ = "PriceLess"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\g9dm6PLCuYqXor.dll"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

pid	process
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	pid	process
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Token: SeDebugPrivilege	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exeregsvr32.exe

description	pid	process	target process
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 1148 wrote to memory of 848	1148	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe
PID 848 wrote to memory of 812	848	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{d06aa9c7-c72d-40a1-86ff-ea7fc048eb36} = "1"	aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe

C:\Users\Admin\AppData\Local\Temp\aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe
"C:\Users\Admin\AppData\Local\Temp\aa01e68609d6a0ad20894595c44235415f37759aa36576db9eab22afda09bbf1.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1148

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:812

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dat
Filesize
3KB

MD5
0a2bc93f66672ee3f19997859be4e388

SHA1
173723cea6e2b22c2f51ed9a0af9fc9fd617e312

SHA256
bb3ea896b47386cd7438a3a46a4551d0bac85b413693416e444b46ec5a7e2b66

SHA512
616dfeb19829b0b55ca42cef6ec1dab96a348fe808ba4ecc16e88f4b1800585fe14f0d1fd734f4241ae18320e168ace06047fbe8880ec793610b0c456099ac4e

Download Submit
C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.tlb
Filesize
3KB

MD5
bb4329f83ddf3322ca225aad6e22d888

SHA1
affebe55d944adda34347a8246439dc2c0efb805

SHA256
d70fbe4ee77d0e6d8199470997eedc1ddb8b94c665b14091718343fe15168305

SHA512
1d02eef9ba5937351d78c6fa04ba58fde26c3d7a77e234dc1283e7d9edb8942ab9b485b09429562b4288ef32da27f63ae647f36be3838dfcdb8b3bbe95827770

Download Submit
C:\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll
Filesize
891KB

MD5
628b7a7ac42e2ddf53e8256b34ba4cce

SHA1
4442437a22f6dd03aa22adf2654a55bfa70927d8

SHA256
1b54c342462c9badcff17c5c9c31dc209dbd5a400583e3c5296cca5cc3ffc9fe

SHA512
f1d48cbbb076a0458ffb51fef15fb360902bedb29af166ca7beb57d5f107715f9f57ace67a396957f7e4dac6550974093bb05e5598e47a815cb0bde3a3fc47af

Download Submit
\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.dll
Filesize
755KB

MD5
63e9398a76ae6e5d95d97108f792fc39

SHA1
fc85020bf16dcf1961c01e9e27e9fea1b53991f3

SHA256
6751b1114b2be7585825a4cd412e98390f43dc981ac06eb326941cc4d2997ae2

SHA512
e18f0e3b84cd1e54f32dc6764cb2cd635a74aafb67e38a6d6cb8e4146e000650f1c464a5fbe8dc0b2364f61bac4d47adaaa801c3efcad1b38c18736dd19990f0

Download Submit
\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll
Filesize
891KB

MD5
628b7a7ac42e2ddf53e8256b34ba4cce

SHA1
4442437a22f6dd03aa22adf2654a55bfa70927d8

SHA256
1b54c342462c9badcff17c5c9c31dc209dbd5a400583e3c5296cca5cc3ffc9fe

SHA512
f1d48cbbb076a0458ffb51fef15fb360902bedb29af166ca7beb57d5f107715f9f57ace67a396957f7e4dac6550974093bb05e5598e47a815cb0bde3a3fc47af

Download Submit
\Program Files (x86)\PriceLess\g9dm6PLCuYqXor.x64.dll
Filesize
891KB

MD5
628b7a7ac42e2ddf53e8256b34ba4cce

SHA1
4442437a22f6dd03aa22adf2654a55bfa70927d8

SHA256
1b54c342462c9badcff17c5c9c31dc209dbd5a400583e3c5296cca5cc3ffc9fe

SHA512
f1d48cbbb076a0458ffb51fef15fb360902bedb29af166ca7beb57d5f107715f9f57ace67a396957f7e4dac6550974093bb05e5598e47a815cb0bde3a3fc47af

Download Submit
memory/812-65-0x0000000000000000-mapping.dmp

Download
memory/812-66-0x000007FEFB531000-0x000007FEFB533000-memory.dmp

Filesize
8KB

Download
memory/848-61-0x0000000000000000-mapping.dmp

Download
memory/1148-54-0x0000000075001000-0x0000000075003000-memory.dmp

Filesize
8KB

Download
memory/1148-55-0x0000000002C50000-0x0000000002D1C000-memory.dmp

Filesize
816KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads