Analysis
-
max time kernel
45s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 03:52
Static task
static1
Behavioral task
behavioral1
Sample
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe
Resource
win10v2004-20221111-en
General
-
Target
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe
-
Size
4.2MB
-
MD5
725b9b2995a30fbf9f197d7ce2e62245
-
SHA1
d0e2f9eeaffaef48d5920659db3c6a5f57d7de57
-
SHA256
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86
-
SHA512
dcdb78e04f89d4890cd2cd9adff95f3b05c0f072928bcd75ac63f5282df8e837b066372d7ae96483a1b44461be90da850c8a84bc27da682028d8da2ffb497923
-
SSDEEP
98304:aPHy4dVem3IU8PXn7bdlqTvUSN+WtuvxFsPEtR:Inr3NrtuJXt
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\31z9mYDInFPWlH.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exeregsvr32.exeregsvr32.exepid process 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1152 regsvr32.exe 524 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gahdopnmhdhfhebhnnleekbmedejbifh\5.2\manifest.json 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\gahdopnmhdhfhebhnnleekbmedejbifh\5.2\manifest.json 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\gahdopnmhdhfhebhnnleekbmedejbifh\5.2\manifest.json 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ = "PriceLess" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ = "PriceLess" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\NoExplorer = "1" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{0fa8d362-5265-4eef-9a0b-e2537c07d081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Drops file in System32 directory 4 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Drops file in Program Files directory 8 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription ioc process File created C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.tlb 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.tlb 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.dat 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.dat 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dll 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dll 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File created C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.dll 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe File opened for modification C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.dll 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0FA8D362-5265-4EEF-9A0B-E2537C07D081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0FA8D362-5265-4EEF-9A0B-E2537C07D081} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0fa8d362-5265-4eef-9a0b-e2537c07d081} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0fa8d362-5265-4eef-9a0b-e2537c07d081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Modifies registry class 64 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\VersionIndependentProgID\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0FA8D362-5265-4EEF-9A0B-E2537C07D081} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ThreadingModel = "Apartment" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{0fa8d362-5265-4eef-9a0b-e2537c07d081}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{0fa8d362-5265-4eef-9a0b-e2537c07d081}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ = "PriceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\31z9mYDInFPWlH.tlb" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID\ = ".9" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\31z9mYDInFPWlH.dll" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0FA8D362-5265-4EEF-9A0B-E2537C07D081} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\31z9mYDInFPWlH.x64.dll" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\VersionIndependentProgID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081}\ProgID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exepid process 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription pid process Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Token: SeDebugPrivilege 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exeregsvr32.exedescription pid process target process PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1464 wrote to memory of 1152 1464 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe PID 1152 wrote to memory of 524 1152 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0fa8d362-5265-4eef-9a0b-e2537c07d081} = "1" 2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe"C:\Users\Admin\AppData\Local\Temp\2328d4d765d5bfd2e2464cbb1e71eac8c111a51755fa78e36f53579a38607f86.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1464 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:524
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.datFilesize
3KB
MD5f7a9780d23c330eb34f65436d48c92c2
SHA195960a88d88c681f3e731e43323ac7a07c63ee95
SHA2560c8a85a08e902d5f41c15da03de38971f68ee9d762a0257866e23d33051f2237
SHA51249e559560a88167a7178a92a631b46b5fd683ae6ac9c1af07349e4b8c0e9749581e9731606d9b44a8324ca8b2080da7f7a3303cf42abd04c7dbe0260b5e47613
-
C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.tlbFilesize
3KB
MD5dad7dc8242a2925ade239718a506374e
SHA108d7aba181e62216e2976c15a9107b760e0ef3ab
SHA2567dd64eeefd4900b4ef39b47ef2cbe5cf6f7e184ca74dedb351c749c60d39981b
SHA51271dd707836f3415c8b36cc485a879f82d3d5bd0cae95b891eb8cc3fcb3a3ada8f3fa53b68a06a866bca111b8c72d75bcefc118c9785fa20178cf13c4e57ac8ea
-
C:\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\PriceLess\31z9mYDInFPWlH.dllFilesize
740KB
MD5f37095c241e62cc8b66a00a187fd1155
SHA182a9120f26b4e76df5fe123a5176d28aa898b23c
SHA2560810e4c7b6fb4ad3f7a3abee5bf321f720515e6c3e605c9348bc51e741906874
SHA512eab1bdf2b0f79af777ce967d02789cf3fc39a09fafa43ff230a650bc42e871538e98953479a2849249d765037dc92175069335d8010da4fc1286f48a088b8b9b
-
\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\PriceLess\31z9mYDInFPWlH.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
memory/524-66-0x000007FEFB9E1000-0x000007FEFB9E3000-memory.dmpFilesize
8KB
-
memory/524-65-0x0000000000000000-mapping.dmp
-
memory/1152-61-0x0000000000000000-mapping.dmp
-
memory/1464-54-0x00000000758B1000-0x00000000758B3000-memory.dmpFilesize
8KB
-
memory/1464-55-0x0000000002A60000-0x0000000002B2B000-memory.dmpFilesize
812KB