Analysis
-
max time kernel
151s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 14:34
Static task
static1
Behavioral task
behavioral1
Sample
f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
-
Size
3.6MB
-
MD5
d9709e07bad3a51f74e405e7d205930e
-
SHA1
091e27f7b611d782fdca13fe4d596053b1a06d58
-
SHA256
f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9
-
SHA512
f3ba5333d9c76495d821ada26cb06688b227b01c9d0e26ad3ad32394403c308054de182402ccb3a6945478c67426d952c23a7875f8e7c6dc6463479c26770809
-
SSDEEP
49152:4c+vtjC4APehCOB8GznyXAsxzdmHsa4Oi2+Ua4/4EMFvBIPDIEdOMktcsA:lCNdAPiB8Hvxzisa4SPF/kkEEd
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
pid Process 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 3672 regsvr32.exe 3128 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 5 IoCs
description ioc Process File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Users\WDAGUtilityAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Users\DefaultAccount\AppData\Local\Google\Chrome\User Data\Default\Extensions\jacohkcoiimkdbojbfpdkoihgiiepppc\5.2\manifest.json f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\NoExplorer = "1" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\NoExplorer = "1" regsvr32.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.tlb f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.tlb f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dat f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dat f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File created C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dll f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe File opened for modification C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.dll f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\MICROSOFT\INTERNET EXPLORER\APPROVEDEXTENSIONSMIGRATION\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PriiceLess" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ProgID\ = ".9" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ProgID f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriiceLess" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.dll" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32\ = "C:\\Program Files (x86)\\PriiceLess\\txDyo9Y5LyQOTt.tlb" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "PriiceLess" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer\ = ".9" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\InprocServer32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\Programmable f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\VersionIndependentProgID f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{76D6CDB9-4798-4BB7-BDE9-1D443F68AB4F} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriiceLess" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ = "IRegistry" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "PriiceLess" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f}\ = "PriiceLess" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe Token: SeDebugPrivilege 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 2360 wrote to memory of 3672 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 87 PID 2360 wrote to memory of 3672 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 87 PID 2360 wrote to memory of 3672 2360 f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe 87 PID 3672 wrote to memory of 3128 3672 regsvr32.exe 90 PID 3672 wrote to memory of 3128 3672 regsvr32.exe 90 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{76d6cdb9-4798-4bb7-bde9-1d443f68ab4f} = "1" f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe"C:\Users\Admin\AppData\Local\Temp\f73ca1f6605d938ddd8576c78ffa87520088f62cef0d33bee2309e510c43f0a9.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2360 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\PriiceLess\txDyo9Y5LyQOTt.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:3128
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵PID:3592
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵PID:3664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD57d263b9d1465f19015c7a0e05e8d508a
SHA183a62159752e931dea0de6a9db0029e347732dd0
SHA256de1d18e57b3f1f75f6b3aa3e9aa1c5e261c9f4b14790019b8995780b596edde4
SHA5121d23dffd3ee98cbd074f33046e5bafbcf45834573770cbf1bd69f42c34e511f8c374b4d3a9bc9196d938bbc6c52a6877be27405805be5754f3c8caca3941365f
-
Filesize
615KB
MD5ff5e433c6f29178bac73bb59690388e9
SHA1c1ffbcdf7bfc725cbfe6dca5920d88491ea445b0
SHA256f628bed0e2bbba0d403442a9d4ec81b5836b41545498e0e9b6633ed40689c861
SHA51210f18270ae3002f8c428c8937bc5f88a2d06c8973c74ef34bd5ae16b346d658d57944aed459eff154eb1942bded03cc248d706feb18975f5b8107dd640661be6
-
Filesize
3KB
MD5b85e28ebb05db1bc98791f4ca29f89c3
SHA135255fda88e100483eea0a4d11303f68e3e37dad
SHA2560f60549d695da16be688d5e4ab87ae734788c08d115023a2795f299f2b443c20
SHA512655a7f6cdb3ae49333d0fb7a3c0f8f216c278e021b94783e7d5ff3c5b8b88cdf72424621d4831b7a339163e4d23cf3b00b5d0bc0c6a1c5fcffb92cbf6ec9a02a
-
Filesize
694KB
MD5295488797e3d9cc86059e14a22549c5b
SHA1d01b332f2841a49dfc2bf37776921bc81de30bf2
SHA2568a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2
SHA512935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e
-
Filesize
694KB
MD5295488797e3d9cc86059e14a22549c5b
SHA1d01b332f2841a49dfc2bf37776921bc81de30bf2
SHA2568a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2
SHA512935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e
-
Filesize
694KB
MD5295488797e3d9cc86059e14a22549c5b
SHA1d01b332f2841a49dfc2bf37776921bc81de30bf2
SHA2568a1af1647f2f95af8c953ac621629af8ffb860b4230fabef216bed97a6f897d2
SHA512935f1f26a198cea3c2554405e3253cd28b9ffeb5faeebcd2eff3e2ac951c2339d2fafff561a6b175d7ccff4259ae62df99503ed66e418e5a10e0a12357eae75e