Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe
Resource
win10v2004-20221111-en
General
-
Target
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe
-
Size
4.3MB
-
MD5
bf8e8840ecdf6f1fdc189275452b4a8c
-
SHA1
9fa4232697eca3f5768c1a325db2123ae057530a
-
SHA256
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465
-
SHA512
108a9536fe338f5f2a2a47a960808377bfca6f9f62637b13290f1450dad03b4cd4f934099192ab51808c07e8687ccff647591d28dec1511695ea44a0330fe55e
-
SSDEEP
49152:h3D5ZguBg9jqHodaz0YY0bZ+KnkLwwKp9N7071I8G8geMUBtfoCC8J5:Fngo7oYY0bMOKJKp9TYtt
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLesS\\gwQL2er6jdKV66.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exeregsvr32.exeregsvr32.exepid process 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1444 regsvr32.exe 612 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkenibnkcbekpbaogjhkdplnbhnchbah\5.2\manifest.json 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkenibnkcbekpbaogjhkdplnbhnchbah\5.2\manifest.json 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\hkenibnkcbekpbaogjhkdplnbhnchbah\5.2\manifest.json 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
regsvr32.exe2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ = "PriceLesS" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\NoExplorer = "1" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ = "PriceLesS" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 4 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Drops file in Program Files directory 8 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process File created C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.tlb 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.tlb 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.dat 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.dat 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dll 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dll 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File created C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.dll 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe File opened for modification C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.dll 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Processes:
regsvr32.exe2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{331C039A-4EB9-42FD-B0B1-5CF20A05AF48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{331C039A-4EB9-42FD-B0B1-5CF20A05AF48} regsvr32.exe -
Modifies registry class 64 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exeregsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLesS" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ProgID\ = ".9" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID\ 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ = "PriceLesS" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLesS\\gwQL2er6jdKV66.tlb" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ = "PriceLesS" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{331c039a-4eb9-42fd-b0b1-5cf20a05af48}" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32\ThreadingModel = "Apartment" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLesS" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ProgID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331C039A-4EB9-42FD-B0B1-5CF20A05AF48}\Implemented Categories 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{331c039a-4eb9-42fd-b0b1-5cf20a05af48}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331C039A-4EB9-42FD-B0B1-5CF20A05AF48} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331C039A-4EB9-42FD-B0B1-5CF20A05AF48} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLesS" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ProgID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\ProgID\ = ".9" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\VersionIndependentProgID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLesS\\gwQL2er6jdKV66.dll" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48}\InprocServer32 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exepid process 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription pid process Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Token: SeDebugPrivilege 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exeregsvr32.exedescription pid process target process PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1056 wrote to memory of 1444 1056 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe PID 1444 wrote to memory of 612 1444 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{331c039a-4eb9-42fd-b0b1-5cf20a05af48} = "1" 2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe"C:\Users\Admin\AppData\Local\Temp\2de95cd7872b7abe2910b94e4f66f4257f1de5ac2122a7210e39dc7e49145465.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1056 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1444 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:612
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.datFilesize
4KB
MD5cbc24216fc71a56c4effc32827c5d8e3
SHA1b8bed56e601c65f3a8d4985d3b0ea2732477d36d
SHA25687dc751ed337e95a7b58d6d43607088bf835c83922b5237b6a1f8e6c06539431
SHA512bfe35841c397b7834a221223be36771588605978032624356f9d5637eb6ca44e21291e6b56d5aa7bcb6407b12c35c9438322e4ca7ca576c3ada6861f0305ef1c
-
C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.tlbFilesize
3KB
MD5b88e5accb725137a786c4b9ee9316402
SHA1a1bac7876b516f0de051af0db2817a8c141db709
SHA25601bb6e7ac8f4d0015cce471ad8eb028413bbb5dab69413501119c3ef11dbafbb
SHA512b9a3556d6c90ce86191253108abd9019799169842db366196743086f1de7983fceedfc065c9845d9585f7905d8ea4d87c7315f4bc35c5e994633448f5a27ca83
-
C:\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dllFilesize
712KB
MD5212fe2ff13095b12b43efbe1cf8d1d0b
SHA1e7a88037e303749c4a12446b97bfb6f4d1c61045
SHA2564fba14e6931cf6728974fb41bd8183682033d432f85ee59129577c428fb6c7a3
SHA512de42bd7b39bb72ccea6a038396ed31563178657165eaa5f5b3bb93fa3feba522313505bf4080c46c693942511682d6579b5c920ecc956a5b29408521c73b4915
-
\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.dllFilesize
631KB
MD562dea1b9f8eccf477ad316a17fbf9da1
SHA1347ba0964f8f8bf4bdf36e77ef7e06de07badc95
SHA256cd7495501312f1f864c18dc5e7b8e618f1ae23d21fcf3e9ee16e3127965d3644
SHA5122a2b6a66240452b57c063e8f80a93ac61a122a47ef0b3d3b34a39eeb19ab70ae7ac4bb67b2d108c576a005ea2413299fa59ac6515e45dec58b7f34f22cba4684
-
\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dllFilesize
712KB
MD5212fe2ff13095b12b43efbe1cf8d1d0b
SHA1e7a88037e303749c4a12446b97bfb6f4d1c61045
SHA2564fba14e6931cf6728974fb41bd8183682033d432f85ee59129577c428fb6c7a3
SHA512de42bd7b39bb72ccea6a038396ed31563178657165eaa5f5b3bb93fa3feba522313505bf4080c46c693942511682d6579b5c920ecc956a5b29408521c73b4915
-
\Program Files (x86)\PriceLesS\gwQL2er6jdKV66.x64.dllFilesize
712KB
MD5212fe2ff13095b12b43efbe1cf8d1d0b
SHA1e7a88037e303749c4a12446b97bfb6f4d1c61045
SHA2564fba14e6931cf6728974fb41bd8183682033d432f85ee59129577c428fb6c7a3
SHA512de42bd7b39bb72ccea6a038396ed31563178657165eaa5f5b3bb93fa3feba522313505bf4080c46c693942511682d6579b5c920ecc956a5b29408521c73b4915
-
memory/612-69-0x0000000000000000-mapping.dmp
-
memory/612-70-0x000007FEFC2F1000-0x000007FEFC2F3000-memory.dmpFilesize
8KB
-
memory/1056-54-0x0000000075A71000-0x0000000075A73000-memory.dmpFilesize
8KB
-
memory/1056-55-0x00000000010F0000-0x0000000001196000-memory.dmpFilesize
664KB
-
memory/1444-65-0x0000000000000000-mapping.dmp