ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f

Analysis

max time kernel
130s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
28/11/2022, 00:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Size

684KB
MD5

1dbc3d977d77938e623e7cafac224a35
SHA1

45ff047892c4ee28364ce26744fa8ad19a3f858c
SHA256

ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f
SHA512

313e76075ce3bb5dddc8e04629217074a45301f4f887459e71929cd7654bdb436839ccf14bf3acf1db68b21543710f4ddb835fcf0a0b369d020e4201cc69ed33
SSDEEP

12288:4/ZqsC9Pa6P8Xu+Y0+4Kk3R61B0iYWfJWCMQHxvZj3uHcwTIfM1GjT9AlZ:4sD18Xa1A3YBZffJWCNhjeFTIfMUvOlZ

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
Key created	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4708	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4708	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
4708	ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe

C:\Users\Admin\AppData\Local\Temp\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe
"C:\Users\Admin\AppData\Local\Temp\ada98fd03de5b92e55a2400bbf3d5494d0415ae983e0f5abcefcf5a7e390696f.exe"
1⤵
- Registers COM server for autorun
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4708

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4708-132-0x0000000001120000-0x00000000012A0000-memory.dmp

Filesize
1.5MB

Download