Analysis
-
max time kernel
20s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 04:56
Static task
static1
Behavioral task
behavioral1
Sample
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe
Resource
win10v2004-20220812-en
General
-
Target
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe
-
Size
4.2MB
-
MD5
83f7ce44fac5b64d00930e3f6556bc61
-
SHA1
e9193d46a83a797339ef5ca1687acb7a3539c5ea
-
SHA256
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755
-
SHA512
7516fbb19bfb4283c94ec8fedf8122871eedc9f858c805ffb3f260cabc4f1ddb1352e579b8ad8280f7a2d85738ed52a29138bc5680c7e855b26aba27ff9a5ba9
-
SSDEEP
49152:QoW62oa/YdVemHPFSBdYQsLV7xR9VaBOtL/ZMeydf//yUReq7TLzsf:HZ2JYdVemtSoQSXeOhhMeyV//vR3z
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\vx3AiN8y8z09d3.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exeregsvr32.exeregsvr32.exepid process 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1288 regsvr32.exe 984 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpknjbmmfllehjlhfohlmjnhcjocidch\1.0\manifest.json 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpknjbmmfllehjlhfohlmjnhcjocidch\1.0\manifest.json 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\fpknjbmmfllehjlhfohlmjnhcjocidch\1.0\manifest.json 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463}\ = "TinyWallet" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463}\NoExplorer = "1" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{eab81cef-7c3d-4d20-9377-b2c15082a463}\ = "TinyWallet" regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription ioc process File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Windows\System32\GroupPolicy 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Drops file in Program Files directory 8 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription ioc process File created C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.dat 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.dat 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File created C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dll 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dll 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File created C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.dll 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.dll 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File created C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.tlb 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe File opened for modification C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.tlb 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exeregsvr32.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{eab81cef-7c3d-4d20-9377-b2c15082a463} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EAB81CEF-7C3D-4D20-9377-B2C15082A463} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{EAB81CEF-7C3D-4D20-9377-B2C15082A463} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{eab81cef-7c3d-4d20-9377-b2c15082a463} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Modifies registry class 64 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TinyWallet" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID\ regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\ProgID\ = ".9" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID\ 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{EAB81CEF-7C3D-4D20-9377-B2C15082A463}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{EAB81CEF-7C3D-4D20-9377-B2C15082A463}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32\ThreadingModel = "Apartment" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TinyWallet" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{eab81cef-7c3d-4d20-9377-b2c15082a463}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\ = "TinyWallet" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32\ = "C:\\Program Files (x86)\\TinyWallet\\vx3AiN8y8z09d3.dll" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\VersionIndependentProgID 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{eab81cef-7c3d-4d20-9377-b2c15082a463}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{eab81cef-7c3d-4d20-9377-b2c15082a463}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463} 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\Programmable 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463}\InprocServer32 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exepid process 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription pid process Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Token: SeDebugPrivilege 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exeregsvr32.exedescription pid process target process PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1448 wrote to memory of 1288 1448 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe PID 1288 wrote to memory of 984 1288 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{eab81cef-7c3d-4d20-9377-b2c15082a463} = "1" 0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe"C:\Users\Admin\AppData\Local\Temp\0f09ddf094353d404adae65d04fabe75753033cfc83a6eac63ad9e674ebd6755.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1448 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:984
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.datFilesize
3KB
MD50ee942fada4f40475118bc209503aeb6
SHA18040028ce6585d6cc0dc8c374350da6f28ef42fd
SHA256e3d700aebc77105e252d7daa89c9f4a47af17df56d3f8379ce8efebdf7e7ddd6
SHA5128a1a02497041a983fbadf01d60900da71ad73cceb0fbc76aedd093f6e1fb12534bc446742d402a4b4e0be583ae214ed81bc7485c750523f1e4af80832557011f
-
C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.tlbFilesize
3KB
MD5dad7dc8242a2925ade239718a506374e
SHA108d7aba181e62216e2976c15a9107b760e0ef3ab
SHA2567dd64eeefd4900b4ef39b47ef2cbe5cf6f7e184ca74dedb351c749c60d39981b
SHA51271dd707836f3415c8b36cc485a879f82d3d5bd0cae95b891eb8cc3fcb3a3ada8f3fa53b68a06a866bca111b8c72d75bcefc118c9785fa20178cf13c4e57ac8ea
-
C:\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.dllFilesize
740KB
MD5f37095c241e62cc8b66a00a187fd1155
SHA182a9120f26b4e76df5fe123a5176d28aa898b23c
SHA2560810e4c7b6fb4ad3f7a3abee5bf321f720515e6c3e605c9348bc51e741906874
SHA512eab1bdf2b0f79af777ce967d02789cf3fc39a09fafa43ff230a650bc42e871538e98953479a2849249d765037dc92175069335d8010da4fc1286f48a088b8b9b
-
\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
\Program Files (x86)\TinyWallet\vx3AiN8y8z09d3.x64.dllFilesize
875KB
MD50c3a0b1a34377f22a3a16b868c74205c
SHA1d24dd7c000de9f860b66a66539ea145feb8d94cc
SHA2564744114a0e7734acac9ec0e7c91da4074811f5b71349d235491da22a3f6293fc
SHA5120785ea18a70c03858026fe056c630a83231db8941407766cca99ab8414868943e6994964a15aa7ec8d13a72daafa016e0d2ca638b43e6e21cf077fc8f96bbc61
-
memory/984-65-0x0000000000000000-mapping.dmp
-
memory/984-66-0x000007FEFBD81000-0x000007FEFBD83000-memory.dmpFilesize
8KB
-
memory/1288-61-0x0000000000000000-mapping.dmp
-
memory/1448-54-0x0000000076121000-0x0000000076123000-memory.dmpFilesize
8KB
-
memory/1448-55-0x0000000000A10000-0x0000000000ADB000-memory.dmpFilesize
812KB