7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7e

Analysis

max time kernel
95s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 19:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Size

839KB
MD5

fc4a05c0e0245dc948dbad9422713f00
SHA1

1ab43660006b8dec1d7ea6a5bdb563900b893106
SHA256

7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7e
SHA512

55e09b78b53a7c38fff1cf10acc6bedc917de9621f2efb1464f83c64d908909e6d703acdadeb2a6a4e43673edcbd8274b756e036464248b4077319f9c218f8f2
SSDEEP

12288:ESnEGNawIRDW0Q8IxoJqXvTcQHfeXG5e6vYXJCts678sOgHZrGqN840g:ESn/NrGC00oJEvTcQHgGeADIg5r3N8Zg

Score

7^/10

discovery evasion persistence privilege_escalation trojan

Malware Config

Signatures

Event Triggered Execution: Component Object Model Hijacking 1 TTPs
Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
persistence privilege_escalation

Component Object Model Hijacking
T1546.015

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe

Modifies registry class 34 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version\ = "1.0"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Programmable	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\ = "JSIELib"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\Version	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\Version = "1.0"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ProxyStubClsid32	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\TypeLib\ = "{157B1AA6-3E5C-404A-9118-C1D91F537040}"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\TypeLib\ = "{7E77E9F2-D76B-4D54-B515-9A7F93DF03DF}"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}\ = "ITinyJSObject"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\FLAGS\ = "0"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{157B1AA6-3E5C-404A-9118-C1D91F537040}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{3B3F3AAD-FB97-49FF-BFEE-D22869AC4326}	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Key created	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\ = "TinyJSObject Class"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000_Classes\WOW6432Node\CLSID\{F28C2F70-47DE-4EA5-8F6D-7D1476CD1EF5}\LocalServer32\ServerExecutable = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe"	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
812	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
812	7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe

C:\Users\Admin\AppData\Local\Temp\7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe
"C:\Users\Admin\AppData\Local\Temp\7743584a5c872b0c634dba6a440b7c33d88064699ea6a9422d593c1c96136d7eN.exe"
1⤵
- Checks whether UAC is enabled
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Privilege Escalation

Event Triggered Execution

T1546

Component Object Model Hijacking

T1546.015

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/812-10-0x0000000002D60000-0x0000000002EE4000-memory.dmp

Filesize
1.5MB

Download
memory/812-11-0x0000000002D60000-0x0000000002EE4000-memory.dmp

Filesize
1.5MB

Download
memory/812-9-0x0000000002D60000-0x0000000002EE4000-memory.dmp

Filesize
1.5MB

Download
memory/812-2-0x0000000002D60000-0x0000000002EE4000-memory.dmp

Filesize
1.5MB

Download
memory/812-12-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download
memory/812-20-0x0000000001300000-0x0000000001301000-memory.dmp

Filesize
4KB

Download