Analysis
-
max time kernel
22s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
06/07/2023, 05:59
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230705-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20230703-en
General
-
Target
tmp.exe
-
Size
388KB
-
MD5
cab5ccb26d34df87b3be0a7db64d7b61
-
SHA1
8a2a8b285463b52c72933df6d2839f29ace29369
-
SHA256
c4a4833e667bbc39076ab6aaf101bbd61ef3d27d6e46a3d041431229a841912d
-
SHA512
bf1f5e62d011ab820bbafbf6cee78a3cd6ed451d33a9c744c7b942bee7ea9d1ea42503ab951e7de62ee0c6a766eec570602498e568a1615b2f4b0b4678a19804
-
SSDEEP
6144:bqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3+ojDuUlXqeOl:b7IRWDvFa+nhmuF3Y0sc+eDuUlXHs
Malware Config
Signatures
-
Modifies registry class 21 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "DHQ9QDGW2MT4YQBX7ZLE1LXD" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide dfsvc.exe Key deleted \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "50QT7B0331LKR26PV4XQ5VGV" dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0 dfsvc.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft dfsvc.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "7OT85QMJHW05NML2VL6H55JM" dfsvc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3068 dfsvc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2176 wrote to memory of 3068 2176 tmp.exe 79 PID 2176 wrote to memory of 3068 2176 tmp.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2176 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:3068
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD503f6ca987049a718436f8cb4f7edfd4e
SHA112d58cc1b5077b1ebc22c28b4e6fda9424f61d91
SHA2567373217d328365d58ec05e440e0d668498fd87087b9affc2c5e7d047b1a04e68
SHA5125104704aad7668ac5f19e702e52a2e849bff0f4bc56b62489bf00b32cca1debca701009a0e9ddd62329aa3f900136b7ee7dbb5287bf5fbf700c879d03b5bc777