0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f

Analysis

max time kernel
128s
max time network
107s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
30/05/2023, 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Size

3.2MB
MD5

55a97017d35316e36fc5776e1272ffec
SHA1

da281f713fe5d753ebcc148a2ac7b99745abc051
SHA256

0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f
SHA512

dc697778f8ec022a520ca8529202d026eb8b20b7cbcd7c594d1118dcbf3de3613e61605acbc4c21dbc3820a6798a889f93dffd75eeebe26b67a15e88bb764907
SSDEEP

49152:o3C3EKGJxWmTtcckaI5uJz9lNi8txHM+5YjCpVJJJJDX3BG3UF2Ak:oE+VqElo0xHM+5YjIXpk

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FEIQ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe\" 1"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ImageOle.dll	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\feiq\FeiqCfg.xml	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Modifies registry class 53 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\ImageOle.dll, 102"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS\ = "0"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\Insertable	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ThreadingModel = "Apartment"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Programmable	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\ = "GifAnimator Class"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ = "GifAnimator Class"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Insertable	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Control	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\ = "GifAnimator Class"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID\ = "ImageOle.GifAnimator.1"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version\ = "1.0"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\ = "ImageOle 1.0 Type Library"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer\ = "ImageOle.GifAnimator.1"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID\ = "ImageOle.GifAnimator"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
1996	0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe

C:\Users\Admin\AppData\Local\Temp\0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe
"C:\Users\Admin\AppData\Local\Temp\0ada70d736eafdc3f005b40b2fe49f4c8d3d0315e8f19856e2e8ffadb2f1364f.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1996

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
memory/1996-68-0x0000000000400000-0x000000000074B000-memory.dmp

Filesize
3.3MB

Download
memory/1996-76-0x0000000000400000-0x000000000074B000-memory.dmp

Filesize
3.3MB

Download