Analysis
-
max time kernel
182s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 19:45
Static task
static1
Behavioral task
behavioral1
Sample
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe
Resource
win10v2004-20221111-en
General
-
Target
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe
-
Size
3.5MB
-
MD5
43196de1ea54e3385d854d99d9d02230
-
SHA1
84a1e0d33397e0467ec03141a44d4b440ba3d4c1
-
SHA256
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24
-
SHA512
f04fd0f06c0ef14847c77862c021cfbe77ac55c34293bc56c590affec204a5b27fb0e62633b07b458eeb2ea3c980fd49529e12aa3bdd68e7ed2f9b74d93b26f5
-
SSDEEP
49152:ScboYAWt7MukxmEUa0G6hnl9nkyb3BeZitUQ47nNRsD0rIDS4olxfvQtqGdzL8ql:D8YAWbIeEitd4Zmo8DBGxfvudAy1zg
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
Processes:
regsvr32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32\ = "C:\\Program Files (x86)\\PricueLesss\\qHRGlNLHI6zUIk.x64.dll" regsvr32.exe -
Loads dropped DLL 3 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exeregsvr32.exeregsvr32.exepid process 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 548 regsvr32.exe 4676 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exedescription ioc process File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogifjmjgmhaicnhfkdjjejghmnlcjcpb\5.2\manifest.json 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogifjmjgmhaicnhfkdjjejghmnlcjcpb\5.2\manifest.json 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogifjmjgmhaicnhfkdjjejghmnlcjcpb\5.2\manifest.json 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogifjmjgmhaicnhfkdjjejghmnlcjcpb\5.2\manifest.json 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogifjmjgmhaicnhfkdjjejghmnlcjcpb\5.2\manifest.json 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exeregsvr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\NoExplorer = "1" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ = "PricueLesss" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ = "PricueLesss" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Drops file in System32 directory 4 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Drops file in Program Files directory 8 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exedescription ioc process File created C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dll 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dll 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.dll 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.dll 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.tlb 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.tlb 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File created C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.dat 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe File opened for modification C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.dat 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exeregsvr32.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Modifies registry class 64 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exeregsvr32.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{0dff7f09-bc73-4940-aa32-0b92ab066fd6}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\VersionIndependentProgID 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\Programmable 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ = "PricueLesss" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32\ = "C:\\Program Files (x86)\\PricueLesss\\qHRGlNLHI6zUIk.dll" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6}\Implemented Categories 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PricueLesss" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ProgID\ = ".9" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\Programmable 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6}\Implemented Categories regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PricueLesss" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{0dff7f09-bc73-4940-aa32-0b92ab066fd6}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PricueLesss" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{0dff7f09-bc73-4940-aa32-0b92ab066fd6}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PricueLesss" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6} 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{0DFF7F09-BC73-4940-AA32-0B92AB066FD6}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exepid process 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exedescription pid process Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe Token: SeDebugPrivilege 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exeregsvr32.exedescription pid process target process PID 1924 wrote to memory of 548 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe regsvr32.exe PID 1924 wrote to memory of 548 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe regsvr32.exe PID 1924 wrote to memory of 548 1924 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe regsvr32.exe PID 548 wrote to memory of 4676 548 regsvr32.exe regsvr32.exe PID 548 wrote to memory of 4676 548 regsvr32.exe regsvr32.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{0dff7f09-bc73-4940-aa32-0b92ab066fd6} = "1" 29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe"C:\Users\Admin\AppData\Local\Temp\29023d4b5bc179778e8e83d916c0e15a89ea4fac03fe9990629a445aa717dc24.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1924 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:548 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:4676
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:4172
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:4060
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.datFilesize
4KB
MD5d2c4827a0a3add9d0053c13967ce311f
SHA1a9a11f3b1c150b22b5ce2f19ad02daf74782c69a
SHA25633baa0e4a921c48ff5ce540d9dfccf99865a5dc850d504e893fd96866662f7b4
SHA51217a97d012cb915c2dc1e073bec9ee341bb272f7b4e8361392e97bcbcefaec8acf71bdf4596bb4c8ba66575b3658e31fc379fcbdbf1e4c6283afc190bd56db978
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.dllFilesize
623KB
MD52f700827f71ba8d02b87b1145bde267e
SHA1a3264aa5c20eea8279b82283d98410f9c3491865
SHA2561d5544b85315e47c0dfbf7bf6a037ed4c66f7f3ac192da07352d574526393b1f
SHA512ff50314ff77b859688dad9c8a73de194d05fc56f11ed6b4996d61f85f3fa138d13270f8f0283f88642d5886e15fc7a2924f0c42da2d40b8f4b563a29ed15b181
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.tlbFilesize
3KB
MD569f83b6fbfb0b8bcd41fd7526c15f0f8
SHA16e77c6a9db881c687513fca345f7014a34581fbd
SHA256138bbb7b27e2101e06fd2ee40807bf0cf5092c706b63f20275cb0acd5ca4ddd4
SHA512e266fc64bd30a7e070089c2a0dca878a482c49b6069adf2fbe08e87584298d75960846845c1f207d2784a652e34908997aabcdacfd11956cca21df42bc13fcdd
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
C:\Program Files (x86)\PricueLesss\qHRGlNLHI6zUIk.x64.dllFilesize
704KB
MD5b006dc4fc0353a50f457e148a8783482
SHA1df404fe8ca7df2a6cf389db2e64cbde87da702ea
SHA25611f47eb93788cb172f91b1edd66d590011bde04c328733f18fd93e7391b0e116
SHA512345128159a96f6e085a212cd9b81a17487c2bf3c0e57e70683a498aa79cd012b40349cd4414622094d6b425cd99070e2d43a9052b8c65bffd75a374e585d0e05
-
memory/548-138-0x0000000000000000-mapping.dmp
-
memory/1924-132-0x0000000003370000-0x0000000003414000-memory.dmpFilesize
656KB
-
memory/4676-141-0x0000000000000000-mapping.dmp