cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683

Analysis

max time kernel
36s
max time network
91s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 08:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Size

878KB
MD5

c5cb18ff1e1bae70e585af3d3704c6aa
SHA1

39eca56130f891b052b7925e6643aca6cd78390f
SHA256

cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683
SHA512

e628762c6564ad40700a14b1bc7f5716f2f2f8430176848d037c6d114178008c84cc278f353fbbccad91ea4e340c47d10f4ec3c9f8b9586ac064ccc10edf9387
SSDEEP

24576:m7lzI0DAQb5+KoJdTUjwrflt5czXULUDR0693AyC1uAin:mRzzDodTiwr9nUqi1Cghn

Score

8^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe

Modifies registry class 31 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
Key created	\REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Wow6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe

C:\Users\Admin\AppData\Local\Temp\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe
"C:\Users\Admin\AppData\Local\Temp\cfe3b14d44b843f9301b72e79e82526c845e09acafa186cf0617b74ab4900683.exe"
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:2028

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2028-54-0x0000000075811000-0x0000000075813000-memory.dmp

Filesize
8KB

Download
memory/2028-55-0x0000000002100000-0x0000000002245000-memory.dmp

Filesize
1.3MB

Download
memory/2028-64-0x0000000002100000-0x0000000002245000-memory.dmp

Filesize
1.3MB

Download
memory/2028-63-0x0000000002100000-0x0000000002245000-memory.dmp

Filesize
1.3MB

Download
memory/2028-62-0x0000000002100000-0x0000000002245000-memory.dmp

Filesize
1.3MB

Download