d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b

Analysis

max time kernel
13s
max time network
7s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
04/07/2023, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

challange_Benign_d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b.exe
Size

60KB
MD5

803f73d62a2fceb2df8df45e0eefd7f5
SHA1

ab1d54d77e28741058e24ff368bf12db82fb448a
SHA256

d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b
SHA512

97a2578dc2002479372792b999613600c341f3a0ac6f901e3809e443e5c4a5a8033e15034ad04967dcf30596427da63828232d73630963c9d7387cf60660b33e
SSDEEP

768:TqUMu52FUlBVrwo2YCRjqKv/R7cAI6tIyiKeY6GVrBQje25xEI:TqRu52ilBNB+jqtByilGTQn5xb

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "OTQTJ00367RY1RNAM4G528VC"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "DTVR494Q0RYD6Y7R18Q8GL2H"	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "7GAOELD0D2NAW6RL3C81JD48"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1420546310-613437930-2990200354-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1220	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 1220	4532	challange_Benign_d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b.exe	79
PID 4532 wrote to memory of 1220	4532	challange_Benign_d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b.exe	79

C:\Users\Admin\AppData\Local\Temp\challange_Benign_d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b.exe
"C:\Users\Admin\AppData\Local\Temp\challange_Benign_d33bf2d3e57e66002232f3cc91a899708e46cd51f855702c8410db357dfc123b.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:1220

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1220-133-0x000001F8D7110000-0x000001F8D7118000-memory.dmp

Filesize
32KB

Download
memory/1220-134-0x000001F8F1630000-0x000001F8F17B6000-memory.dmp

Filesize
1.5MB

Download
memory/1220-135-0x000001F8D74D0000-0x000001F8D74E0000-memory.dmp

Filesize
64KB

Download
memory/1220-137-0x000001F8D74D0000-0x000001F8D74E0000-memory.dmp

Filesize
64KB

Download
memory/1220-139-0x000001F8D74D0000-0x000001F8D74E0000-memory.dmp

Filesize
64KB

Download
memory/1220-140-0x000001F8D74D0000-0x000001F8D74E0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads