f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9

Analysis

max time kernel
44s
max time network
100s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
27/11/2022, 14:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Size

3.6MB
MD5

d9709e07bad3a51f74e405e7d205930e
SHA1

091e27f7b611d782fdca13fe4d596053b1a06d58
SHA256

f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9
SHA512

f3ba5333d9c76495d821ada26cb06688b227b01c9d0e26ad3ad32394403c308054de182402ccb3a6945478c67426d952c23a7875f8e7c6dc6463479c26770809
SSDEEP

49152:4c+vtjC4APehCOB8GznyXAsxzdmHsa4Oi2+Ua4/4EMFvBIPDIEdOMktcsA:lCNdAPiB8Hvxzisa4SPF/kkEEd

Score

8^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.x64.dll"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ThreadingModel = "Apartment"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32	regsvr32.exe

Loads dropped DLL 3 IoCs

pid	Process
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
604	regsvr32.exe
1948	regsvr32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Installs/modifies Browser Helper Object 2 TTPs 8 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\NoExplorer = "1"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess"	regsvr32.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\NoExplorer = "1"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Drops file in System32 directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Drops file in Program Files directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dat	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File opened for modification	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dll	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File opened for modification	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dll	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.tlb	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File opened for modification	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.tlb	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
File created	C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dat	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Modifies Internet Explorer settings 1 TTPs 8 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}	regsvr32.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	regsvr32.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Modifies registry class 64 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.dll"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\Programmable	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriiceLess"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}\Implemented Categories	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriiceLess"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.tlb"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.x64.dll"	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriiceLess"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\Programmable	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9"	regsvr32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess"	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\Programmable	regsvr32.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}	regsvr32.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\..9	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriiceLess"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ProgID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ProgID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriiceLess"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Token: SeDebugPrivilege	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 1628 wrote to memory of 604	1628	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe	28
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29
PID 604 wrote to memory of 1948	604	regsvr32.exe	29

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} = "1"	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID	f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe

C:\Users\Admin\AppData\Local\Temp\f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
"C:\Users\Admin\AppData\Local\Temp\f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe"
1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1628
- C:\Windows\SysWOW64\regsvr32.exe
  regsvr32.exe /s "C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:604
- - C:\Windows\system32\regsvr32.exe
    /s "C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll"
    3⤵
    - Registers COM server for autorun
    - Loads dropped DLL
    - Installs/modifies Browser Helper Object
    - Modifies Internet Explorer settings
    - Modifies registry class
    PID:1948

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Browser Extensions

T1176

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dat

Filesize
4KB

MD5
7d263b9d1465f19015c7a0e05e8d508a

SHA1
83a62159752e931dea0de6a9db0029e347732dd0

SHA256
de1d18e57b3f1f75f6b3aa3e9aa1c5e261c9f4b14790019b8995780b596edde4

SHA512
1d23dffd3ee98cbd074f33046e5bafbcf45834573770cbf1bd69f42c34e511f8c374b4d3a9bc9196d938bbc6c52a6877be27405805be5754f3c8caca3941365f

Download Submit
C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.tlb

Filesize
3KB

MD5
b85e28ebb05db1bc98791f4ca29f89c3

SHA1
35255fda88e100483eea0a4d11303f68e3e37dad

SHA256
0f60549d695da16be688d5e4ab87ae734788c08d115023a2795f299f2b443c20

SHA512
655a7f6cdb3ae49333d0fb7a3c0f8f216c278e021b94783e7d5ff3c5b8b88cdf72424621d4831b7a339163e4d23cf3b00b5d0bc0c6a1c5fcffb92cbf6ec9a02a

Download Submit
C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dll

Filesize
615KB

MD5
ff5e433c6f29178bac73bb59690388e9

SHA1
c1ffbcdf7bfc725cbfe6dca5920d88491ea445b0

SHA256
f628bed0e2bbba0d403442a9d4ec81b5836b41545498e0e9b6633ed40689c861

SHA512
10f18270ae3002f8c428c8937bc5f88a2d06c8973c74ef34bd5ae16b346d658d57944aed459eff154eb1942bded03cc248d706feb18975f5b8107dd640661be6

Download Submit
\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll

Filesize
694KB

MD5
295488797e3d9cc86059e14a22549c5b

SHA1
d01b332f2841a49dfc2bf37776921bc81de30bf2

SHA256
8a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2

SHA512
935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e

Download Submit
memory/1628-65-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-76-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-67-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-68-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-69-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-70-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-71-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-72-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-73-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-74-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-75-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-66-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-54-0x0000000075BE1000-0x0000000075BE3000-memory.dmp

Filesize
8KB

Download
memory/1628-64-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-63-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-62-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-55-0x0000000000200000-0x00000000002AB000-memory.dmp

Filesize
684KB

Download
memory/1628-60-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1628-61-0x0000000000812000-0x0000000000816000-memory.dmp

Filesize
16KB

Download
memory/1948-83-0x000007FEFBD41000-0x000007FEFBD43000-memory.dmp

Filesize
8KB

Download