Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 14:52
Static task
static1
Behavioral task
behavioral1
Sample
d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe
Resource
win10v2004-20220901-en
General
-
Target
d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe
-
Size
4.6MB
-
MD5
d3c26ef7a6509a8059e4c05f1926b0a8
-
SHA1
46cdd1d607cdff66990e78f6c90d9b41b517b3eb
-
SHA256
d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1
-
SHA512
d4608b61bf7ece3edee254e7850c0ed170da1a8261af0a04fc5474abf5ad83c248149ed99a52393bca6820cee4a1ec5bd92ec6a7e70a9a6facdfe7898085591e
-
SSDEEP
98304:YoBQXwcATVTwymaBp1tf3MIGT1CB5ckO:YoNBTVTwymaPbGTYB9
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\NdhmMEpXijnIHc.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
pid Process 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1748 regsvr32.exe 1972 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjnolilfigiblknnecnghoepehiaohob\5.2\manifest.json d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjnolilfigiblknnecnghoepehiaohob\5.2\manifest.json d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjnolilfigiblknnecnghoepehiaohob\5.2\manifest.json d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe}\ = "PriceLess" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe}\NoExplorer = "1" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{946352f5-63cb-4730-ba44-540fd16358fe}\ = "PriceLess" regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Windows\System32\GroupPolicy d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.dat d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.dat d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.x64.dll d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.x64.dll d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.dll d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.dll d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File created C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.tlb d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe File opened for modification C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.tlb d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
description ioc Process Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{946352F5-63CB-4730-BA44-540FD16358FE} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{946352f5-63cb-4730-ba44-540fd16358fe} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{946352f5-63cb-4730-ba44-540fd16358fe} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{946352F5-63CB-4730-BA44-540FD16358FE} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriceLess\\NdhmMEpXijnIHc.tlb" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\NdhmMEpXijnIHc.dll" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ProgID d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352F5-63CB-4730-BA44-540FD16358FE} regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ = "PriceLess" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ProgID\ = ".9" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352F5-63CB-4730-BA44-540FD16358FE} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{946352f5-63cb-4730-ba44-540fd16358fe}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriceLess" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{946352f5-63cb-4730-ba44-540fd16358fe}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriceLess" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\InprocServer32\ = "C:\\Program Files (x86)\\PriceLess\\NdhmMEpXijnIHc.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{946352f5-63cb-4730-ba44-540fd16358fe}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ProgID\ = ".9" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\VersionIndependentProgID\ d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\VersionIndependentProgID d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352F5-63CB-4730-BA44-540FD16358FE}\Implemented Categories d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{946352F5-63CB-4730-BA44-540FD16358FE}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Token: SeDebugPrivilege 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1552 wrote to memory of 1748 1552 d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe 28 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 PID 1748 wrote to memory of 1972 1748 regsvr32.exe 29 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{946352f5-63cb-4730-ba44-540fd16358fe} = "1" d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe"C:\Users\Admin\AppData\Local\Temp\d6e5bfea5def9f8900c869455d59141e374f8f035d363ff83bc8b51647d05ba1.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1552 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriceLess\NdhmMEpXijnIHc.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:1972
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5114fb34862522d8733bbdf9b74f11976
SHA10f625c0571958b8c6a5201d78ea542e98635f0f1
SHA2567afcf6e3f2e8e6e1770721f3766d5f4aefb4316d8d09012a080e788aa5419629
SHA5127adf11ae8911ac779d00a7ded8ce5c54aff313e587da7fbd329d441cff3e05a794e025c484a4e1c3d56c3f71d0109c1ec1a15ac3c91698269c9fcd6b42179e8e
-
Filesize
3KB
MD5a605ae2858a95cc2ce9bb1e9d9304674
SHA16d921d39e97d8fa34c010b4045e45ba776565ac9
SHA2563074c890173c5cfefa194ea54ad1fd95801384893476628823481fe071576d45
SHA51295335e817be4486e8e949ac701f4ffa22c579a3509d62278f05ce5b5e369bd3949ebf90e1ac8f3aa4ee59525e2c59a906666633c594d264fbbb76146216e7725
-
Filesize
889KB
MD5042040d8e80233e425b5c9e39da669a3
SHA1f4d544cc6f6979cdab77b0072642edb4824aac04
SHA256d5adc62ab4e22acf8f91d165bde2e398cec14e4424542e355bd07e54f6b2aed2
SHA512d127946ea1b7d08f184646a44ef6f8f59daa70c46b6e54638fa15b9c8a4dfcf62ed384c7961447070fbfb3875cecffc85c963752e0ac8b5cba430826a0b7bac5
-
Filesize
751KB
MD568b0c82a53fdfe07ab206ee2078ec984
SHA1dc0bc38f5219340b309e53841f562499bf517568
SHA2566c37c9e2af50feb15f2cd2ac1e85a03c1cab2d997bea12da8beea59bc0099c21
SHA512e194eed7704e793e36a0e8d130d672c5788b3d41adde92b5876ba32f52a1c8065952243666ca804736f567e5af316ac80d2f7d5612bc90f6a92b9269f6678330
-
Filesize
889KB
MD5042040d8e80233e425b5c9e39da669a3
SHA1f4d544cc6f6979cdab77b0072642edb4824aac04
SHA256d5adc62ab4e22acf8f91d165bde2e398cec14e4424542e355bd07e54f6b2aed2
SHA512d127946ea1b7d08f184646a44ef6f8f59daa70c46b6e54638fa15b9c8a4dfcf62ed384c7961447070fbfb3875cecffc85c963752e0ac8b5cba430826a0b7bac5
-
Filesize
889KB
MD5042040d8e80233e425b5c9e39da669a3
SHA1f4d544cc6f6979cdab77b0072642edb4824aac04
SHA256d5adc62ab4e22acf8f91d165bde2e398cec14e4424542e355bd07e54f6b2aed2
SHA512d127946ea1b7d08f184646a44ef6f8f59daa70c46b6e54638fa15b9c8a4dfcf62ed384c7961447070fbfb3875cecffc85c963752e0ac8b5cba430826a0b7bac5