65b44ab06a930ae5c5850d8697d2c60e3a81d33d72acad60d393265f1e7b82b4

Analysis

max time kernel
117s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 00:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

46622c5a9457baf518e0e345b5727b8c.exe
Size

439KB
MD5

46622c5a9457baf518e0e345b5727b8c
SHA1

2f281612e60b6b3f209a39586b43077720ebcd97
SHA256

65b44ab06a930ae5c5850d8697d2c60e3a81d33d72acad60d393265f1e7b82b4
SHA512

e40fbe216e9a4b6ab84a52a6608e6ec174c9842c1736399832553388d4e38defd42663061e483cb0977311b650087c6b86c289014da730585aeba26ae3902331
SSDEEP

6144:Ze34OxBLV0X1KW2Rj9MXWf6ZrZ9UdMZBvhealxBMykSngMmefBYv/l9j+7ZA0Xyt:OxBiQplfaI8ZlGefGXXjaZCBD

Score

7^/10

adware discovery spyware stealer

Malware Config

Signatures

Loads dropped DLL 7 IoCs

pid	Process
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe
2084	46622c5a9457baf518e0e345b5727b8c.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Installs/modifies Browser Helper Object 2 TTPs 2 IoCs

BHOs are DLL modules which act as plugins for Internet Explorer.

stealer adware

Modify Registry

T1112

Browser Extensions

T1176

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\PricePeep\installer.ico	46622c5a9457baf518e0e345b5727b8c.exe
File created	C:\Program Files (x86)\PricePeep\pricepeep.crx	46622c5a9457baf518e0e345b5727b8c.exe
File created	C:\Program Files (x86)\PricePeep\pricepeep.dll	46622c5a9457baf518e0e345b5727b8c.exe
File created	C:\Program Files (x86)\PricePeep\uninstall.exe	46622c5a9457baf518e0e345b5727b8c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID\ = "PricePeep.PricePeepBho.1"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ThreadingModel = "Apartment"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ = "PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\ = "PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\VersionIndependentProgID\ = "PricePeep.PricePeepBho"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\TypeLib	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR\ = "C:\\Program Files (x86)\\PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ = "IHttpRequestEvent"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\Programmable	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0\win32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\ = "PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CLSID	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\0	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS\ = "0"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho\CurVer\ = "PricePeep.PricePeepBho.1"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\HELPDIR	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\ProgID	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}\InprocServer32\ = "C:\\Program Files (x86)\\PricePeep\\pricepeep.dll"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1\CLSID\ = "{FD6D90C0-E6EE-4BC6-B9F7-9ED319698007}"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\ = "IJigsawExternal"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{1B97A696-5576-43AC-A73B-E1D2C78F21E8}\TypeLib\Version = "1.0"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\ProxyStubClsid32	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\Version = "1.0"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\ = "PricePeep 1.0 Type Library"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\PricePeep.DLL\AppID = "{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}"	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\PricePeep.PricePeepBho.1	46622c5a9457baf518e0e345b5727b8c.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}\1.0\FLAGS	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{75BF416E-4326-45B5-8A2D-AE32D05B930B}\TypeLib\ = "{3BF3DED5-0FC8-4207-AC09-AA7B5AF4E408}"	46622c5a9457baf518e0e345b5727b8c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{38A066B0-DD5F-4226-AC4F-6A27C1BFB892}\ = "PricePeep"	46622c5a9457baf518e0e345b5727b8c.exe

C:\Users\Admin\AppData\Local\Temp\46622c5a9457baf518e0e345b5727b8c.exe
"C:\Users\Admin\AppData\Local\Temp\46622c5a9457baf518e0e345b5727b8c.exe"
1⤵
- Loads dropped DLL
- Installs/modifies Browser Helper Object
- Drops file in Program Files directory
- Modifies registry class
PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Browser Extensions

T1176

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Program Files (x86)\PricePeep\pricepeep.dll

Filesize
472KB

MD5
54544d9dc7f9254884f26eaa707786cd

SHA1
275917ea1fa7aed19ea52bfa6cd318f75116f014

SHA256
794096065f211134a1d3d6ae646430c59cdb029ba48ac13b90699968117ab866

SHA512
c676d4139bfc699aa1ce996163e3f7ba6e6abe91ea8b79740b5a88ad0bd8f9ad5afdc099395b3643f89cf0690e0bfa140b2e0fd7ebd553a183eb7e5ba2e7f08e

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8538.tmp\System.dll

Filesize
11KB

MD5
c17103ae9072a06da581dec998343fc1

SHA1
b72148c6bdfaada8b8c3f950e610ee7cf1da1f8d

SHA256
dc58d8ad81cacb0c1ed72e33bff8f23ea40b5252b5bb55d393a0903e6819ae2f

SHA512
d32a71aaef18e993f28096d536e41c4d016850721b31171513ce28bbd805a54fd290b7c3e9d935f72e676a1acfb4f0dcc89d95040a0dd29f2b6975855c18986f

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8538.tmp\UAC.dll

Filesize
17KB

MD5
88ad3fd90fc52ac3ee0441a38400a384

SHA1
08bc9e1f5951b54126b5c3c769e3eaed42f3d10b

SHA256
e58884695378cf02715373928bb8ade270baf03144369463f505c3b3808cbc42

SHA512
359496f571e6fa2ec4c5ab5bd1d35d1330586f624228713ae55c65a69e07d8623022ef54337c22c3aab558a9b74d9977c8436f5fea4194899d9ef3ffd74e7dbb

Download Submit
\Users\Admin\AppData\Local\Temp\nsj8538.tmp\inetc.dll

Filesize
20KB

MD5
4c01fdfd2b57b32046b3b3635a4f4df8

SHA1
e0af8e418cbe2b2783b5de93279a3b5dcb73490e

SHA256
b98e21645910f82b328f30c644b86c112969b42697e797671647b09eb40ad014

SHA512
cbd354536e2a970d31ba69024208673b1dc56603ad604ff17c5840b4371958fc22bafd90040ae3fb19ae9c248b2cfce08d0bc73cc93481f02c73b86dbc0697b2

Download Submit