c4a4833e667bbc39076ab6aaf101bbd61ef3d27d6e46a3d041431229a841912d

General

Target

tmp.exe
Size

388KB
MD5

cab5ccb26d34df87b3be0a7db64d7b61
SHA1

8a2a8b285463b52c72933df6d2839f29ace29369
SHA256

c4a4833e667bbc39076ab6aaf101bbd61ef3d27d6e46a3d041431229a841912d
SHA512

bf1f5e62d011ab820bbafbf6cee78a3cd6ed451d33a9c744c7b942bee7ea9d1ea42503ab951e7de62ee0c6a766eec570602498e568a1615b2f4b0b4678a19804
SSDEEP

6144:bqIpd/w8ylWKxavR+dJ1oMBClrbMAo+nhmuFfvY0SHZvuD3+ojDuUlXqeOl:b7IRWDvFa+nhmuF3Y0sc+eDuUlXHs

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "DHQ9QDGW2MT4YQBX7ZLE1LXD"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "50QT7B0331LKR26PV4XQ5VGV"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "7OT85QMJHW05NML2VL6H55JM"	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3068	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3068	2176	tmp.exe	79
PID 2176 wrote to memory of 3068	2176	tmp.exe	79

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3068

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Deployment\H5704P6Q.WBW\XKO4MT2D.ELK.application

Filesize
5KB

MD5
03f6ca987049a718436f8cb4f7edfd4e

SHA1
12d58cc1b5077b1ebc22c28b4e6fda9424f61d91

SHA256
7373217d328365d58ec05e440e0d668498fd87087b9affc2c5e7d047b1a04e68

SHA512
5104704aad7668ac5f19e702e52a2e849bff0f4bc56b62489bf00b32cca1debca701009a0e9ddd62329aa3f900136b7ee7dbb5287bf5fbf700c879d03b5bc777

Download Submit
memory/3068-139-0x0000023BCC0E0000-0x0000023BCC0E8000-memory.dmp

Filesize
32KB

Download
memory/3068-140-0x0000023BE65C0000-0x0000023BE6746000-memory.dmp

Filesize
1.5MB

Download
memory/3068-142-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download
memory/3068-145-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download
memory/3068-146-0x0000023BE9840000-0x0000023BE9890000-memory.dmp

Filesize
320KB

Download
memory/3068-159-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download
memory/3068-160-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download
memory/3068-161-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download
memory/3068-162-0x0000023BE6590000-0x0000023BE65A0000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads