Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 15:06
Static task
static1
Behavioral task
behavioral1
Sample
bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe
-
Size
4.0MB
-
MD5
6f123c94ae74a44dddbab0b9e523caa5
-
SHA1
1518ffb5bb71641f2bbeb481c243622e30100cc8
-
SHA256
bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58
-
SHA512
7c8414e0dbce799c22b701bffdf0960607cb54226954a841fb8092e4da99e3db874da2f6f60f1cdaaa5667a7e0b9408564b5900f983322eb812a8f3f1a7a48ae
-
SSDEEP
98304:RS5tXfs4xrC6DpIHq73aj9EnL6F5a+OTCoofFLpVT:Ry9r0uXotz
Score
8/10
Malware Config
Signatures
-
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32\ = "C:\\Program Files (x86)\\TTInyWalleett\\mX2JzD9h7gGJpN.x64.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32 regsvr32.exe -
Loads dropped DLL 3 IoCs
pid Process 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 1760 regsvr32.exe 2024 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\acogojnfblabnmeaibninledofdkgfcd\1.0\manifest.json bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Users\Administrator\AppData\Local\Google\Chrome\User Data\Default\Extensions\acogojnfblabnmeaibninledofdkgfcd\1.0\manifest.json bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Users\Guest\AppData\Local\Google\Chrome\User Data\Default\Extensions\acogojnfblabnmeaibninledofdkgfcd\1.0\manifest.json bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
Installs/modifies Browser Helper Object 2 TTPs 8 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ = "TTInyWalleett" regsvr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\NoExplorer = "1" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ = "TTInyWalleett" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\NoExplorer = "1" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\System32\GroupPolicy bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Windows\SysWOW64\GroupPolicy\gpt.ini bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
Drops file in Program Files directory 8 IoCs
description ioc Process File created C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.dat bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.dat bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.x64.dll bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.x64.dll bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.dll bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.dll bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File created C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.tlb bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe File opened for modification C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.tlb bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007E32BC-246D-4968-B8B7-6A1C49FA4D53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007E32BC-246D-4968-B8B7-6A1C49FA4D53} regsvr32.exe Key deleted \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration regsvr32.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} regsvr32.exe -
Modifies registry class 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ = "IPlaghinMein" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ProgID\ = ".9" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32\ThreadingModel = "Apartment" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007E32BC-246D-4968-B8B7-6A1C49FA4D53}\Implemented Categories regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS\ = "0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID\ = "{007e32bc-246d-4968-b8b7-6a1c49fa4d53}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CurVer bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ = "TTInyWalleett" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\TTInyWalleett" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007E32BC-246D-4968-B8B7-6A1C49FA4D53}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID\ bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\ = "IEPluginLib" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.\CLSID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ProgID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\Programmable bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007E32BC-246D-4968-B8B7-6A1C49FA4D53}\Implemented Categories\{59FB2056-D625-48D0-A944-1A85B5AB2640} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\FLAGS bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0\0\win32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\ProxyStubClsid32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{007e32bc-246d-4968-b8b7-6a1c49fa4d53}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\. bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007E32BC-246D-4968-B8B7-6A1C49FA4D53}\Implemented Categories bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{E2343056-CC08-46AC-B898-BFC7ACF4E755}\1.0 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.\ = "TTInyWalleett" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007E32BC-246D-4968-B8B7-6A1C49FA4D53} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\VersionIndependentProgID\ regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\ = "{E2343056-CC08-46AC-B898-BFC7ACF4E755}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\TypeLib\Version = "1.0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\CLSID\ = "{007e32bc-246d-4968-b8b7-6a1c49fa4d53}" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53}\ProgID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF} bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{9B41579A-1996-42F9-8F84-7B7786818CEF}\TypeLib\Version = "1.0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{7041156A-0D2B-4DCD-A8EE-D0608BFCB2D0}\ = "ILocalStorage" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{EAF749DC-CD87-4B04-B22A-D4AC3FBCB2BC}\TypeLib\Version = "1.0" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\..9\ = "TTInyWalleett" regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Token: SeDebugPrivilege 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 364 wrote to memory of 1760 364 bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe 27 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 PID 1760 wrote to memory of 2024 1760 regsvr32.exe 28 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Ext\CLSID\{007e32bc-246d-4968-b8b7-6a1c49fa4d53} = "1" bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe"C:\Users\Admin\AppData\Local\Temp\bc313b0f2ab37c9c5acb7a1aaa8f24b8c0b8d1ca5f3484a0ace24eb8c6098c58.exe"1⤵
- Loads dropped DLL
- Drops Chrome extension
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:364 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32.exe /s "C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.x64.dll"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\system32\regsvr32.exe/s "C:\Program Files (x86)\TTInyWalleett\mX2JzD9h7gGJpN.x64.dll"3⤵
- Registers COM server for autorun
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Modifies Internet Explorer settings
- Modifies registry class
PID:2024
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
MD5328e8f664a703e666f767977090be67a
SHA153f2c5dc9f8e2792e684a312dc9c1bd536d480b7
SHA256130fc6b46c8d1af9546c4a5a15992a156b3223ac97e332fb9ff7d7e444dedeea
SHA51297903d46557241c1307714f80cf97544da77cf13fca46aef0b8cc00399c55dec483eb2f07f394e784ad7317d678ea9dca24e94fd5872af3fcc0967a624711d97
-
Filesize
3KB
MD5f97b95a2c07b6c926106d4e9e110f93b
SHA16b76b71705374f84d81add54fad98b6fccd78c69
SHA2563dca6f9ef4c0fa2d4511ee991298a97b5847720161efb3388b5dfe28694a0a97
SHA5128d2b262861d126af9874c63e890b7f963a5823825ac4479e7ea917bf6ba1bbc49ec5d7da1c0cfa79deac6ae763be38799b99e76cbe744efd9d4cc018549f225c
-
Filesize
701KB
MD5b30d08f15639c7642e6bba8187911fe9
SHA16f79350773fde83fef1b82607da0835d01a27e2a
SHA256e13f07d2edc163c163511604bd7e94068839f8b39f1f14f2ed048b84a2a47954
SHA512a1c350a84992d9d7ca245a0cb06150b4fddadcca3c4d9a80368c07454c35972a5beea5fb8fcecafbdf2ad9f694b68d85724c3b7476c2c52280832f35b06d852a
-
Filesize
622KB
MD58a05c343e6e5fed3c750b3d9d0066ebb
SHA122d39fe1637510c4468e9c69081f288a107b8da1
SHA2564acb52ac42bd0fd0e98752d4b0c24f1922f7baf7449b88c3c431958c374b8392
SHA51235e3eecbb0dbc125e0dace43cba58151b5fbb6bc627075674195ca7fe2a577f3662fc969e9b1eb3aed1ca2028c16ef36b95dec27b4fe44e7f8ded1d3d78e12d1
-
Filesize
701KB
MD5b30d08f15639c7642e6bba8187911fe9
SHA16f79350773fde83fef1b82607da0835d01a27e2a
SHA256e13f07d2edc163c163511604bd7e94068839f8b39f1f14f2ed048b84a2a47954
SHA512a1c350a84992d9d7ca245a0cb06150b4fddadcca3c4d9a80368c07454c35972a5beea5fb8fcecafbdf2ad9f694b68d85724c3b7476c2c52280832f35b06d852a
-
Filesize
701KB
MD5b30d08f15639c7642e6bba8187911fe9
SHA16f79350773fde83fef1b82607da0835d01a27e2a
SHA256e13f07d2edc163c163511604bd7e94068839f8b39f1f14f2ed048b84a2a47954
SHA512a1c350a84992d9d7ca245a0cb06150b4fddadcca3c4d9a80368c07454c35972a5beea5fb8fcecafbdf2ad9f694b68d85724c3b7476c2c52280832f35b06d852a