Analysis
-
max time kernel
45s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe
Resource
win10v2004-20220812-en
General
-
Target
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe
-
Size
4.3MB
-
MD5
9cf1a56290f23a33e5a3d98b7ccfbb6a
-
SHA1
2e768ddba23c79b8b606731f885c7fe11a18446d
-
SHA256
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f
-
SHA512
bea0ad885cbecdeeb0ce0f190e55db3ac67a1fa877f25ef1b4e3fc8e8f1638452999372931944a2556ac2e699e8bef779e27bd8c2dcf34e58c7fa76f9bb73143
-
SSDEEP
49152:ZBeGnMbNZ8dtB8+RfUFAE4NQduyi2FnEcXPu84EdDvT0BZQ:AZ8xMMNQduyioEcXb
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\yvJi6EtO1RFQXS.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exeregsvr32.exeregsvr32.exepid process 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1876 regsvr32.exe 300 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dapdifgapmgbgjkdohneebbmcbkjbhec\5.2\manifest.json a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\dapdifgapmgbgjkdohneebbmcbkjbhec\5.2\manifest.json a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\dapdifgapmgbgjkdohneebbmcbkjbhec\5.2\manifest.json a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ = "PriceLess" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ = "PriceLess" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\NoExplorer = "1" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Drops file in System32 directory 4 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription ioc process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File opened for modification C:\Windows\System32\GroupPolicy a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Drops file in Program Files directory 8 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription ioc process File opened for modification C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.dll a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.tlb a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File opened for modification C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.tlb a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.dat a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File opened for modification C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.dat a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dll a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File opened for modification C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dll a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe File created C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.dll a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Processes:
regsvr32.exea8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3039CCC7-420D-49A2-8777-16D44AE4BC3A} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{3039CCC7-420D-49A2-8777-16D44AE4BC3A} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Modifies registry class 64 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039CCC7-420D-49A2-8777-16D44AE4BC3A}\Implemented Categories a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriceLess" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\VersionIndependentProgID\ a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\yvJi6EtO1RFQXS.dll" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039CCC7-420D-49A2-8777-16D44AE4BC3A} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ = "PriceLess" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{3039ccc7-420d-49a2-8777-16d44ae4bc3a}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID\ = ".9" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\VersionIndependentProgID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32\ThreadingModel = "Apartment" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039CCC7-420D-49A2-8777-16D44AE4BC3A}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\ProgID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\yvJi6EtO1RFQXS.tlb" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exepid process 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription pid process Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Token: SeDebugPrivilege 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exeregsvr32.exedescription pid process target process PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1020 wrote to memory of 1876 1020 a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe PID 1876 wrote to memory of 300 1876 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{3039ccc7-420d-49a2-8777-16d44ae4bc3a} = "1" a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe"C:\Users\Admin\AppData\Local\Temp\a8391b8274498d7f92cd74d3ee87c3a5fccf557d3d75af78c860961ad8df368f.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1020 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:300
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.datFilesize
3KB
MD52fec01a1f28e069ebdeac67b3810aa61
SHA183f3908e2c0d25f3266c3fdfb1f0db15f3174fb5
SHA256df77e426ab8f70dde5904162f6948ac2f234362e5deb295544184262239a3147
SHA512930e5f275c240f47a0a8b19ec0ab45d6aa2c101336c48e85c968752280539e05647e72287c4761950bb716e0a8fc3729dfbe58a6d85db32cac8c86a2ebd75ad2
-
C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.tlbFilesize
3KB
MD5d83675648e6f93a17ca3b6062d97759d
SHA14072a4f6e706a0121be068aa3a38ba4a7c4f9ba1
SHA2564c1cecd724cb309cf65ccdc1ddaf8678524abc45a2bb3dedbb5f3ae5e603968c
SHA512d27620a33f446aef5e7501ce599b3b09b9df1d2a12cbf9644ce50610709b50052eb89e48f8360123a67876780cc0d584e09be82f65ab4e3694271ccd26a00841
-
C:\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.dllFilesize
737KB
MD515b1d0053054e33606c48c3be74b73fb
SHA1c6bded9c595b0cca4039470b43005b30af94d004
SHA256a959cc9313ba65bb36d7041db8bb7e735fbf5fc550e345e5ca132eb7097d5c80
SHA512647492954e192cf2f9685852ed7f90991ff73f084bd1537bd573fdb527be4cc1d63b23961cccfc43424e75f226a8b2dcd37ded53dd72195637219df67c6964b5
-
\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
\Program Files (x86)\PriceLess\yvJi6EtO1RFQXS.x64.dllFilesize
871KB
MD536cddfd3d2717b327fc5f8baa561bfd0
SHA18bba9508ea9646fdb43dfe05e18ce6ef87a91e31
SHA2567c99cf9fe01131c53365eaefcc4eca91a24bb0bd40f15291dfa6a7f31999fb60
SHA5123af4fd610616eb2e2b84977afbc836e38b6191a28074b39b092f540358e058fa91def134b61f2e7658225b5d7725e9363841ef74aee27ffaa908fa109f6bb74c
-
memory/300-65-0x0000000000000000-mapping.dmp
-
memory/300-66-0x000007FEFBB41000-0x000007FEFBB43000-memory.dmpFilesize
8KB
-
memory/1020-54-0x00000000762D1000-0x00000000762D3000-memory.dmpFilesize
8KB
-
memory/1020-55-0x00000000029E0000-0x0000000002AA8000-memory.dmpFilesize
800KB
-
memory/1876-61-0x0000000000000000-mapping.dmp