Analysis
- max time kernel
107s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system - submitted
13/10/2023, 02:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe
Resource
win7-20230831-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe
- Size 3.2MB
- Sample231013-c2964acg92
- SHA256 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f
- MD5 b7081a3ab67440d149bc9ee3f6d97daf
- SHA1 b8fc9d76683e11a1d13ba2b33835e213cd632c5d
- SHA512 f47941286331cfd48b78575ab4d4e704b3beafaad6a9bb3001b9bbc615511c6ab8f5d09b7d58fc5f0349b03d4dd3a2baedfbe89b811a5311895c427b72827884
- SSDEEP 49152:g3C3EKGJxWmTtcckaI5uJz9lNi8qxHM+5YjCpVJJJJDX3BG3UF2Ak:gE+VqElovxHM+5YjIXpk
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 2 IoCs
pid Process 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FEIQ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe\" 1" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ImageOle.dll 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\Program Files\feiq\FeiqCfg.xml 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\win.ini 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Modifies registry class 53 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\ = "GifAnimator Class" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\Insertable 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Insertable 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\ImageOle.dll, 102" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Programmable 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer\ = "ImageOle.GifAnimator.1" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ = "GifAnimator Class" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ThreadingModel = "Apartment" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F} 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\ = "GifAnimator Class" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16} 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID\ = "ImageOle.GifAnimator.1" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\ = "ImageOle 1.0 Type Library" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ImageOle.dll" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version\ = "1.0" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID\ = "ImageOle.GifAnimator" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Control 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182} 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ = "C:\\Windows\\SysWow64\\ImageOle.dll" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16} 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS\ = "0" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\" 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe 3852 8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe"C:\Users\Admin\AppData\Local\Temp\8250ce586130a0ec9dc6874cbf2c3a1a626bbe41373c31f6465c851fb60bcd7f.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3852
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\ImageOle.dll
- Size 69KB
- SHA256 a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785
- MD5 c653904916e99c2653bf3b339c734f05
- SHA1 6cb3cde5b5f7ffd76b0de150feb15801f705dd57
- SHA512 d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b
- SSDEEP 1536:8pSQIUqw5u9lxvSsjgXmq3Wtzml5iJ6EfFHbYAgcIYNg2HRX:8PIdwRsjgXmcWtzml5HEfFHbYAgcIYNd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ImageOle.dll
- Size 69KB
- SHA256 a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785
- MD5 c653904916e99c2653bf3b339c734f05
- SHA1 6cb3cde5b5f7ffd76b0de150feb15801f705dd57
- SHA512 d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b
- SSDEEP 1536:8pSQIUqw5u9lxvSsjgXmq3Wtzml5iJ6EfFHbYAgcIYNg2HRX:8PIdwRsjgXmcWtzml5HEfFHbYAgcIYNd
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ImageOle.dll
- Size 69KB
- SHA256 a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785
- MD5 c653904916e99c2653bf3b339c734f05
- SHA1 6cb3cde5b5f7ffd76b0de150feb15801f705dd57
- SHA512 d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b
- SSDEEP 1536:8pSQIUqw5u9lxvSsjgXmq3Wtzml5iJ6EfFHbYAgcIYNg2HRX:8PIdwRsjgXmcWtzml5HEfFHbYAgcIYNd
- MD5 SHA1 SHA512 SSDEEP