fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77

Analysis

max time kernel
44s
max time network
110s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
02/10/2022, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Size

3.2MB
MD5

e58ae79005ab6aa5521be632f41f6cd1
SHA1

8fc726ffa90cd641e20d66d53c9ea329de10df2f
SHA256

fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77
SHA512

e95365349bcf49393fd22fcc8287976bf694581e40ff67bd2d6d3b0469adb7969360c8929c6d1d316b3a5508b2e42c4c18c78d1747e32a2f7465787cac4e9287
SSDEEP

49152:13C3EKGJxWmTtcckaI5uJz9lNi8txHM+5YjCpVJJJJDX3BG3UF2Ak:1E+VqElo0xHM+5YjIXpk

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FEIQ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe\" 1"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ImageOle.dll	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\feiq\FeiqCfg.xml	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\ = "GifAnimator Class"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\ImageOle.dll, 102"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ = "GifAnimator Class"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\Insertable	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID\ = "ImageOle.GifAnimator"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\ = "GifAnimator Class"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\ = "ImageOle 1.0 Type Library"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version\ = "1.0"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ThreadingModel = "Apartment"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS\ = "0"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Programmable	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID\ = "ImageOle.GifAnimator.1"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Insertable	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Control	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer\ = "ImageOle.GifAnimator.1"	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
1752	fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe

C:\Users\Admin\AppData\Local\Temp\fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe
"C:\Users\Admin\AppData\Local\Temp\fb21b9ab80c5d094c58b1b0bb281e1d18b58497605ceda400389fcd393c71e77.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1752

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
memory/1752-54-0x0000000075111000-0x0000000075113000-memory.dmp

Filesize
8KB

Download