c4a4833e667bbc39076ab6aaf101bbd61ef3d27d6e46a3d041431229a841912d

General

Target

tmp.exe
Size

388KB
MD5

cab5ccb26d34df87b3be0a7db64d7b61
SHA1

8a2a8b285463b52c72933df6d2839f29ace29369
SHA256

c4a4833e667bbc39076ab6aaf101bbd61ef3d27d6e46a3d041431229a841912d
SHA512

bf1f5e62d011ab820bbafbf6cee78a3cd6ed451d33a9c744c7b942bee7ea9d1ea42503ab951e7de62ee0c6a766eec570602498e568a1615b2f4b0b4678a19804
SSDEEP

6144:bqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3+ojDuUlXqeOl:b7IRWDvFa+nhmuF3Y0sc+eDuUlXHs

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "EBB2EAGDRCQRWPC18RY74V54"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "PKYAQR8T603805D49DC40JQP"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "W79429XN2XMMZD3R38PDN5ZD"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-511725148-388773979-2853099937-1000_CLASSES\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3056	dfsvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 3056	2352	tmp.exe	28
PID 2352 wrote to memory of 3056	2352	tmp.exe	28
PID 2352 wrote to memory of 3056	2352	tmp.exe	28
PID 2352 wrote to memory of 3056	2352	tmp.exe	28

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3056

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\CabB1A6.tmp

Filesize
62KB

MD5
3ac860860707baaf32469fa7cc7c0192

SHA1
c33c2acdaba0e6fa41fd2f00f186804722477639

SHA256
d015145d551ecd14916270efad773bbc9fd57fad2228d2c24559f696c961d904

SHA512
d62ad2408c969a95550fb87efda50f988770ba5e39972041bf85924275baf156b8bec309ecc6409e5acdd37ec175dea40eff921ab58933b5b5b5d35a6147567c

Download Submit
C:\Users\Admin\AppData\Local\Temp\Deployment\DMDE8XMR.N06\WXM63YGQ.4P0.application

Filesize
5KB

MD5
03f6ca987049a718436f8cb4f7edfd4e

SHA1
12d58cc1b5077b1ebc22c28b4e6fda9424f61d91

SHA256
7373217d328365d58ec05e440e0d668498fd87087b9affc2c5e7d047b1a04e68

SHA512
5104704aad7668ac5f19e702e52a2e849bff0f4bc56b62489bf00b32cca1debca701009a0e9ddd62329aa3f900136b7ee7dbb5287bf5fbf700c879d03b5bc777

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarB2E1.tmp

Filesize
164KB

MD5
4ff65ad929cd9a367680e0e5b1c08166

SHA1
c0af0d4396bd1f15c45f39d3b849ba444233b3a2

SHA256
c8733c93cc5aaf5ca206d06af22ee8dbdec764fb5085019a6a9181feb9dfdee6

SHA512
f530dc0d024a5a3b8903ffaaa41b608a5ccdd6da4ba1949f2c2e55a9fca475fec5c8d2119b5763cabe7ef1c3788fb9dcac621869db51d65b1d83cfe404fb4c27

Download Submit
memory/3056-57-0x0000000000250000-0x0000000000258000-memory.dmp

Filesize
32KB

Download
memory/3056-59-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/3056-66-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download
memory/3056-105-0x000000001B270000-0x000000001B2F0000-memory.dmp

Filesize
512KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads