6ae7b5bcfa6ba4d0a3574ef98e1a8c712d3fdb9bc45acdbfe1ad1147ac47ee3a

Analysis

max time kernel
166s
max time network
180s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2023 19:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Size

3.2MB
MD5

aeaf0e76403bbded42db64d7173a6eb0
SHA1

b8da90a5312170684abfead14959bb6d6bd56acf
SHA256

6ae7b5bcfa6ba4d0a3574ef98e1a8c712d3fdb9bc45acdbfe1ad1147ac47ee3a
SHA512

0beb1a011c4dc7787df3a50e803dffed2823c7147a78b6a2a21ba36616be99b106a9e059dc3fb652837616826e69f972418e5d54e41d6abea8caa6f7cb73388c
SSDEEP

49152:p3C3EKGJxWmTtcckaI5uJz9lNi8txHM+5YaCpVJJJJD13BG3UF5Ak:pE+VqElo0xHM+5YaI1qk

Score

7^/10

persistence

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\FEIQ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe\" 1"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\ImageOle.dll	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Drops file in Program Files directory 1 IoCs

description	ioc	Process
File created	C:\Program Files\feiq\FeiqCfg.xml	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Modifies registry class 53 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\ = "GifAnimator Class"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer\ = "ImageOle.GifAnimator.1"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Programmable	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ThreadingModel = "Apartment"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ = "GifAnimator Class"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\FLAGS\ = "0"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\ = "ImageOle 1.0 Type Library"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\HELPDIR\ = "C:\\Windows\\SysWow64\\"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID\ = "ImageOle.GifAnimator"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version\ = "1.0"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID\ = "ImageOle.GifAnimator.1"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Version	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\VersionIndependentProgID	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\InprocServer32	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\Insertable	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CurVer	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Control	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ProxyStubClsid32	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ProgID	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\ToolboxBitmap32\ = "C:\\Windows\\SysWow64\\ImageOle.dll, 102"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\ = "IGifAnimator"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{710993A2-4F87-41D7-B6FE-F5A20368465F}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\ImageOle.dll"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}\TypeLib\Version = "1.0"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\ = "GifAnimator Class"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator.1\CLSID	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\Insertable	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{0C1CF2DF-05A3-4FEF-8CD4-F5CFC4355A16}	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\ImageOle.GifAnimator\CLSID\ = "{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{06ADA938-0FB0-4BC0-B19B-0A38AB17F182}\TypeLib\ = "{710993A2-4F87-41D7-B6FE-F5A20368465F}"	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Suspicious use of SendNotifyMessage 2 IoCs

pid	Process
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
1796	NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe

C:\Users\Admin\AppData\Local\Temp\NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.aeaf0e76403bbded42db64d7173a6eb0.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
C:\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit
C:\Windows\SysWOW64\ImageOle.dll

Filesize
69KB

MD5
c653904916e99c2653bf3b339c734f05

SHA1
6cb3cde5b5f7ffd76b0de150feb15801f705dd57

SHA256
a11cd7f420a737e8127012c24dc3fbce1b2e6c6c3425f2028c6171a7e8eb7785

SHA512
d4aa6713140d2391ee56352dc350e892ffc905843e74f1cdc99b0ce1645ec1d1ba4e990a8ee847928aabd10de0488f035c5df5e005ec7048c4f07d88d9082e6b

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads