154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00

Analysis

max time kernel
118s
max time network
142s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
13-10-2023 22:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Size

3.2MB
MD5

45c1cee141c004e65e1b29860429b109
SHA1

1b760c483ba1850079caee358de5f7cf57a8c80f
SHA256

154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00
SHA512

5b60fa32b6a894ebf174f669645eb0d64c1662076ec417155c89acdef5c21830cd67ce9a5421f8aa171c6ca51c7432bfedca6071da9fa5617c7e6c0718ba6bb9
SSDEEP

49152:03C3EKGJxWmTtcckaI5uJz9lNi8txHM+5YjCpVJJJJDX3BG3UF2Ak:0E+VqElo0xHM+5YjIXpk

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FEIQ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe\" 1"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ImageOle.dll	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\feiq\FeiqCfg.xml	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Modifies registry class 53 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Insertable	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID\ = "ImageOle.GifAnimator.1"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\ImageOle.dll, 102"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ThreadingModel = "Apartment"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID\ = "ImageOle.GifAnimator"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\ = "ImageOle 1.0 Type Library"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS\ = "0"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Programmable	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\Insertable	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\ = "GifAnimator Class"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\ = "GifAnimator Class"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer\ = "ImageOle.GifAnimator.1"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ = "GifAnimator Class"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version\ = "1.0"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Control	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
2776	154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe

C:\Users\Admin\AppData\Local\Temp\154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe
"C:\Users\Admin\AppData\Local\Temp\154c36da32c7fa542904e8bf8ebd3a803a442439149e1b28a2756f0c5af77f00.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
memory/2776-0-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download
memory/2776-30-0x0000000000400000-0x000000000073C000-memory.dmp

Filesize
3.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads