3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5

General

Target

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Size

4.2MB
MD5

4d299919345a7b638eefedf1d47ec7ba
SHA1

0b0bc6c60c9d6814d61a7d38a1e94b16e62e01e8
SHA256

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5
SHA512

a317ecdedfa6d0097b071995bfd4aa71fd545c1f39284413f52faff19061749aaceb010ed34a69e44d12c105379463fac3f88e1b39d341144129ad16d2fafb9f
SSDEEP

98304:dIBSGdaGj0ESHa9xfyjII+YJ372FiCLIHkkXr0EExD:dV60g9xfymNY0X

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Processes:

regsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\fNzWUqXQrvalaA.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exeregsvr32.exeregsvr32.exe

pid process

1192 3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
948 regsvr32.exe
1796 regsvr32.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbogndijjffmioiinbnpbgffpallggng\5.2\manifest.json	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbogndijjffmioiinbnpbgffpallggng\5.2\manifest.json	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hbogndijjffmioiinbnpbgffpallggng\5.2\manifest.json	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

Processes:

regsvr32.exe3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ = "PriceLess"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ = "PriceLess"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\NoExplorer = "1"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	regsvr32.exe

Drops file in System32 directory 4 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	ioc	process
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Windows\System32\GroupPolicy	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Drops file in Program Files directory 8 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	ioc	process
File created	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.tlb	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.tlb	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File created	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dat	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dat	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File created	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File created	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dll	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
File opened for modification	C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dll	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exeregsvr32.exe

description	ioc	process
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Modifies registry class 64 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exeregsvr32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{bd69fdac-22fb-4c06-876b-18f5e4001a9a}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\Programmable	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\fNzWUqXQrvalaA.x64.dll"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\VersionIndependentProgID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ = "PriceLess"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID\ = ".9"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\VersionIndependentProgID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{bd69fdac-22fb-4c06-876b-18f5e4001a9a}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ThreadingModel = "Apartment"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\ProgID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\Programmable	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\VersionIndependentProgID\	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriceLess"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\fNzWUqXQrvalaA.dll"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD69FDAC-22FB-4C06-876B-18F5E4001A9A}\Implemented Categories	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

pid	process
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	pid	process
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Token: SeDebugPrivilege	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

Suspicious use of WriteProcessMemory 14 IoCs

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exeregsvr32.exe

description	pid	process	target process
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 1192 wrote to memory of 948	1192	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe
PID 948 wrote to memory of 1796	948	regsvr32.exe	regsvr32.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

Processes:

3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{bd69fdac-22fb-4c06-876b-18f5e4001a9a} = "1"	3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe

C:\Users\Admin\AppData\Local\Temp\3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe
"C:\Users\Admin\AppData\Local\Temp\3fca11b830bfc01388d5674ce880aa887c9218ef22b1b64cf58d7d1a6951d2d5.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1192

C:\Windows\SysWOW64\regsvr32.exe
regsvr32.exe /s "C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll"
2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:948

C:\Windows\system32\regsvr32.exe
/s "C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll"
3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1796

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Browser Extensions

1

T1176

Privilege Escalation

Defense Evasion

Modify Registry

3

T1112

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dat
Filesize
3KB

MD5
0970d13b5541ca4ed15053af1b283d9d

SHA1
724909853c120ba58d3f7bd86e86425fdb5ad777

SHA256
60bee2be52d5f8ff0315473b9da58308e63956a39e41cd96f21ee11b5715b2b1

SHA512
f99741cd9b5d64d8cdfe24906dc917647f09411e1d94b795d6662eeb60167eb35af5bf74301398f5d85328f79066951ed8c1f75b1b95f1d7887475970bb91fc6

Download Submit
C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.tlb
Filesize
3KB

MD5
0d2aeb4f00b6579ca162c9a79f104dba

SHA1
fbc3019106417014ba01e5703e2729496feb6c39

SHA256
4cbe20901caaa5ec47de0c8e5d5333d219bbc51dadf3ad02083b21a2350fd283

SHA512
083c3b7ec8a01d78880349c2de635e70bc45db1523c6e9962f4d687bd15705b28a4001afd48e7be60e34ab7c2a8bf62ff1b91404c38202cfb51fd7df449e124e

Download Submit
C:\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.dll
Filesize
744KB

MD5
211ab5ec38ee0ed680e1b90b37916d5b

SHA1
5a8f6d8b08d6ebffd28608766fe73660fe00a781

SHA256
c5de64a026df3c1275ea3e50b3565b8cfc4d17b09eb958a23bcc29557589b409

SHA512
451ee835b2caed20a57529059a9e434b8e9139c45a579cc3d6693c1af5b516d3580abcd94370e916ff9a11e5cb859cee4a1dbbab943909d2a77fbc68a200a125

Download Submit
\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
\Program Files (x86)\PriceLess\fNzWUqXQrvalaA.x64.dll
Filesize
874KB

MD5
1dc66c50cea34da91b5e917e0157ff0d

SHA1
c7ddb2f9d46f1836d7368434db0131619f5e7c08

SHA256
19627221bde386227801b307cb903837ce957f1aa6194ec8bfc7b180434f41d0

SHA512
48e4c5a2603ba68aaa87d03fc1fbd5c9c672c3e3b9c50178a8f00e6296ae8d14ee6bf043c6bdca49f728f1ebda156007902af628af0a41760de22c8204453fef

Download Submit
memory/948-61-0x0000000000000000-mapping.dmp

Download
memory/1192-54-0x0000000076701000-0x0000000076703000-memory.dmp

Filesize
8KB

Download
memory/1192-55-0x0000000002A50000-0x0000000002B1B000-memory.dmp

Filesize
812KB

Download
memory/1796-65-0x0000000000000000-mapping.dmp

Download
memory/1796-66-0x000007FEFC391000-0x000007FEFC393000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads