37998d259832ac95e63948048219c90ff4965df44a4e4bfa782bd4e2b50e1d18

General

Target

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Size

1.0MB
MD5

0e255d8ffd81e9b66b65457fdd0df898
SHA1

0eab449df8e24c31b6f071f8b09621cd26256cb4
SHA256

37998d259832ac95e63948048219c90ff4965df44a4e4bfa782bd4e2b50e1d18
SHA512

9a2c7469797217c9cc1f6ae56cd699558b77f6e2d95496046e6a8b46ac8b5526688175a0013774b05e34430c6964275d93a74c8330e06ea80f1d59e34ad12261

Score

10^/10

discovery evasion persistence trojan

Malware Config

Signatures

Registers COM server for autorun 1 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Drops startup file 1 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.lnk	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

Modifies service 2 TTPs 1 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\GlobalMaxTcpWindowSize = "16777215"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1868 4644 WerFault.exe 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid	pid_target	process	target process
1868	4644	WerFault.exe	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

Modifies registry class 34 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Key created	\REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description pid process

Token: SeDebugPrivilege 4644 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid process

4644 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Suspicious use of SendNotifyMessage 1 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid process

4644 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
Suspicious use of SetWindowsHookEx 2 IoCs

Processes:

0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid process

4644 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
4644 0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

description	pid	process
Token: SeDebugPrivilege	4644	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid	process
4644	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid	process
4644	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

pid	process
4644	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
4644	0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe

C:\Users\Admin\AppData\Local\Temp\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe
"C:\Users\Admin\AppData\Local\Temp\0eab449df8e24c31b6f071f8b09621cd26256cb4.input.exe"
1⤵
- Drops startup file
- Checks whether UAC is enabled
- Modifies service
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4644