026b87f6b50fa371a2103ba4a2526c7f343bfcd79517a2459810ab2c7cdafcf0

General

Target

382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Size

87KB
MD5

e08b4af3c3228b82d863efbf13292e34
SHA1

ae26ea2327aa3449b3b21d1d8ea90b6a92f9c70b
SHA256

382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42
SHA512

5b6b9ff5146aad6a1a3afcf1238430033deec95d813b03f68a5ba8c16077e4d4400a2ef295eb6679b465c45b592ad474de6908821e44c4bc9933c07c88cea6b4
SSDEEP

1536:2Xn1JYSnExFkcgKKjxfmqshiKW5Xs/iYQqQJtsWFcdfRMvb+xW5YD:ME3x5KBDYiKWm/iSw0fRMvygWD

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "0R467HQH3P6NTL1WMZDKYON3"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "WP3RA1KVEQYME91NPQCZ91HL"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "PRE7X58HV15VKR2ZCNPTB2Q7"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe

Modifies system certificate store 2 TTPs 6 IoCs

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D4D75FDE705713CC3D28AABB99DA6BA16B3DFCDE	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D4D75FDE705713CC3D28AABB99DA6BA16B3DFCDE\Blob = 030000000100000014000000d4d75fde705713cc3d28aabb99da6ba16b3dfcde20000000010000002c0500003082052830820410a0030201020210085dfb7228e907cf98022c52c511bc66300d06092a864886f70d01010b05003072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f0603550403132844696769436572742053484132204173737572656420494420436f6465205369676e696e67204341301e170d3139313032323030303030305a170d3232313032363132303030305a3065310b30090603550406130255533110300e06035504081307466c6f72696461310e300c0603550407130554616d706131193017060355040a1310436f6e6e656374576973652c204c4c433119301706035504031310436f6e6e656374576973652c204c4c4330820122300d06092a864886f70d01010105000382010f003082010a0282010100aff44932097c6f6581818041beb0983e68f9af594959e60adb9948991d0cb693bd3e6febc4e08d0895d3b77970b3ea171c377224b71a12b163385f1480f498cd0eae93b0e6eed61dbdbdfbfb5e3b4a9c7b63f52bf30e027cefe53b449160ea09969e6f474a3ba8b9ec92df855f3031f42eed4813cf5b31080f7677df2941be2157134683184629972bfaa24a8184e6aeee5f4485a4c86e1342118fd4d203c3537b91931279de62ddf5fc6f378f1371e0d987ce9a1daa873f8c9eac570f684cc150c11195f9e66ea6a7579574eaf1c635a247b19a74e9853ef8aeb2f9985e37a6591caae42453745c4e4f67d55472e67a8b4566913e978d351a9c53277a51a5ed0203010001a38201c5308201c1301f0603551d230418301680145ac4b97b2a0aa3a5ea7103c060f92df665750e58301d0603551d0e04160414a6b7faeec29169953f10837d11e48f3c596bd80b300e0603551d0f0101ff04040302078030130603551d25040c300a06082b0601050507030330770603551d1f0470306e3035a033a031862f687474703a2f2f63726c332e64696769636572742e636f6d2f736861322d617373757265642d63732d67312e63726c3035a033a031862f687474703a2f2f63726c342e64696769636572742e636f6d2f736861322d617373757265642d63732d67312e63726c304c0603551d2004453043303706096086480186fd6c0301302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f4350533008060667810c01040130818406082b0601050507010104783076302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304e06082b060105050730028642687474703a2f2f636163657274732e64696769636572742e636f6d2f446967694365727453484132417373757265644944436f64655369676e696e6743412e637274300c0603551d130101ff04023000300d06092a864886f70d01010b05000382010100693660b45165355d831c324c3ae47a4960602e321c9bd34546dd87d86d9af9e78d39bd42972273587ffa2ea32f4c7fd35d9a1b8c901a7422e322810e84e1bfda958363de1e32f4700d9b0867eadc5b018c71f5f2dd0238194e42f6d744c7f65f2eddb04740b85ad62f821ecc9c9ddb474b6ee71035ef99251518183e8cb0f7fab4bac08bbad55522b23ed20e065f917956f6b24df8f89af1a32901512db2fbe1783ea37b645aad71e15bd4e5522b83bae0696744f7ec21143befd856afca78c62f9d989a0bc67c1e33204a1ea4154940b7078de53fe15a71d6f0dea3957a099aa65c4c4c33f4316b2db58cb221d712d10c177cae393427529e04346d029b2d24	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Key created	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\92C1588E85AF2201CE7915E8538B492F605B80C6	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\92C1588E85AF2201CE7915E8538B492F605B80C6\Blob = 03000000010000001400000092c1588e85af2201ce7915e8538b492f605b80c62000000001000000340500003082053030820418a00302010202100409181b5fd5bb66755343b56f955008300d06092a864886f70d01010b05003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3133313032323132303030305a170d3238313032323132303030305a3072310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3131302f0603550403132844696769436572742053484132204173737572656420494420436f6465205369676e696e6720434130820122300d06092a864886f70d01010105000382010f003082010a0282010100f8d3b31c7f0e11af677707d30b314919cfd0fb4599b13adb44f57fe5a89ddb32d771ea769d052eb78ffa9243c0a5f989d43719d7b6aaf09c86a5d825ac0e79283a7ee9d167d3c6fb2927c7d37b2394e4912396907782f9a18423661254335074b12826bb2469c2c252f214678a8945d42da1a3e9882c2095ae1c4a8708df0cf5e24d6018beaac4b2ae70316633713eac70a2abce7fe97ccb92a1e53b311ccfeaf20ae457bb4ab5e974e62bfe6ccb7e7439360d90efe4b54ea4a9ea6a0aab84f3ac674eb5c4f78cd1202523eb08643e5296c1f20f12f4c58e0fc1a2e82c51f773bcbd85b1628373418207e4388b6a7320d00f64733c9e9fa633a9fd19df2593d10203010001a38201cd308201c930120603551d130101ff040830060101ff020100300e0603551d0f0101ff04040302018630130603551d25040c300a06082b06010505070303307906082b06010505070101046d306b302406082b060105050730018618687474703a2f2f6f6373702e64696769636572742e636f6d304306082b060105050730028637687474703a2f2f636163657274732e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e6372743081810603551d1f047a3078303aa038a0368634687474703a2f2f63726c342e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c303aa038a0368634687474703a2f2f63726c332e64696769636572742e636f6d2f4469676943657274417373757265644944526f6f7443412e63726c304f0603551d20044830463038060a6086480186fd6c000204302a302806082b06010505070201161c68747470733a2f2f7777772e64696769636572742e636f6d2f435053300a06086086480186fd6c03301d0603551d0e041604145ac4b97b2a0aa3a5ea7103c060f92df665750e58301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010b050003820101003eec0d5a24b3f322d115c82c7c252976a81d5d1c2d3a1ac4ef3061d77e0b60fdc33d0fc4af8bfdef2adf205537b0e1f6d192750f51b46ea58e5ae25e24814e10a4ee3f718e630e134badd75f4479f33614068af79c464e5cff90b11b070e9115fbbaafb551c28d24ae24c6c7272aa129281a3a7128023c2e91a3c02511e29c1447a17a6868af9ba75c205cd971b10c8fbba8f8c512689fcf40cb4044a513f0e6640c25084232b2368a2402fe2f727e1cd7494596e8591de9fa74646bb2eb6643dab3b08cd5e90dddf60120ce9931633d081a18b3819b4fc6931006fc0781fa8bdaf98249f7626ea153fa129418852e9291ea686c4432b266a1e718a49a6451ef	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\D4D75FDE705713CC3D28AABB99DA6BA16B3DFCDE	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
Key deleted	\REGISTRY\USER\S-1-5-21-3430344531-3702557399-3004411149-1000\Software\Microsoft\SystemCertificates\TrustedPublisher\Certificates\92C1588E85AF2201CE7915E8538B492F605B80C6	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1084	dfsvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1972 wrote to memory of 1084	1972	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe	27
PID 1972 wrote to memory of 1084	1972	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe	27
PID 1972 wrote to memory of 1084	1972	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe	27
PID 1972 wrote to memory of 1084	1972	382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe	27

C:\Users\Admin\AppData\Local\Temp\382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe
"C:\Users\Admin\AppData\Local\Temp\382720406918618afee7a0ee8b8493f7f325fe1379aebbe844645984463c4d42.exe"
1⤵
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1972
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1084

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

Modify Registry

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
e71c8443ae0bc2e282c73faead0a6dd3

SHA1
0c110c1b01e68edfacaeae64781a37b1995fa94b

SHA256
95b0a5acc5bf70d3abdfd091d0c9f9063aa4fde65bd34dbf16786082e1992e72

SHA512
b38458c7fa2825afb72794f374827403d5946b1132e136a0ce075dfd351277cf7d957c88dc8a1e4adc3bcae1fa8010dae3831e268e910d517691de24326391a6

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar5BEE.tmp

Filesize
161KB

MD5
be2bec6e8c5653136d3e72fe53c98aa3

SHA1
a8182d6db17c14671c3d5766c72e58d87c0810de

SHA256
1919aab2a820642490169bdc4e88bd1189e22f83e7498bf8ebdfb62ec7d843fd

SHA512
0d1424ccdf0d53faf3f4e13d534e12f22388648aa4c23edbc503801e3c96b7f73c7999b760b5bef4b5e9dd923dffe21a21889b1ce836dd428420bf0f4f5327ff

Download Submit
memory/1084-54-0x0000000000340000-0x0000000000348000-memory.dmp

Filesize
32KB

Download
memory/1084-55-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download
memory/1084-56-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download
memory/1084-125-0x000000001B040000-0x000000001B0C0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing