af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed

Analysis

max time kernel
144s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
04/12/2022, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Size

681KB
MD5

1e61eb848786b4d2285da8cf0bdb2bfc
SHA1

8045da8ab2c14da0ba724592f9046bec2d3cc1d0
SHA256

af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed
SHA512

3f94345f471d77ec85abe0dc5b63192ddf539a72d9bd90170d9293259132e333a7b8dfdbee3a4ab2bacb691e94a932d17efbafb6cbc9cc6dcb72e1e946b9c2fb
SSDEEP

12288:xgM0xX/tdDZxZi/WARQQfvZeBG72lD/y0CIhPUW2HwuMg4IZXfO34NENPRH8V97X:xgdNi/WhkRn72B/y0CsUwcBO3oEN5H+X

Score

8^/10

discovery evasion persistence trojan

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe

Modifies registry class 34 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4796	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4796	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
4796	af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe

C:\Users\Admin\AppData\Local\Temp\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe
"C:\Users\Admin\AppData\Local\Temp\af3abd2ef2f378a8f5d8c5d452d768fe4ad8c15b0ef4f97b6af6dbc2524809ed.exe"
1⤵
- Registers COM server for autorun
- Checks whether UAC is enabled
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4796

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4796-132-0x0000000001380000-0x0000000001501000-memory.dmp

Filesize
1.5MB

Download