fe658bfa35746debb348dbcea5f6d93d22df9211ca340ac21f756a955a9be481

General

Target

SecuriteInfo.com.FileRepMalware.17500.exe
Size

546KB
MD5

5e79d7640c021dc7c8e18d25c4985f69
SHA1

0d6e64814944ca0f29937edb2ff2f7cd4a506794
SHA256

fe658bfa35746debb348dbcea5f6d93d22df9211ca340ac21f756a955a9be481
SHA512

89ff2eccf9af148ea73d737669796945d523c0569c1ce2f248dc759bcb02d67023811308bb41aff14e3c8429f52dc29d89ead688446d282c5091a3e9df442638
SSDEEP

12288:yubj5je69oqAmj5oMqKyKAuqOAP0wuTeMb01JQntLOCIXo0H:yqhe29AmjkKuuTemIXx

Score

1^/10

Malware Config

Signatures

Modifies registry class 21 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "7AP677JMM693P1T5AQK1DZAJ"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "1JGX7LT0T4ZRKTYBPJB3DNJR"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "0LALBTAXC5WC29X9QDVJVG35"	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000_Classes\Software	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3032	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3032	4736	SecuriteInfo.com.FileRepMalware.17500.exe	88
PID 4736 wrote to memory of 3032	4736	SecuriteInfo.com.FileRepMalware.17500.exe	88

C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.17500.exe
"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.FileRepMalware.17500.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:3032

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Deployment\JVLTYMLA.Q56\RRB9TPPO.W8L.application

Filesize
12KB

MD5
582bace4b0d5f20e194103cd2e6e273b

SHA1
640c4dc6948bf65ed25cb9540387c08ebe6a4e70

SHA256
12fe9fa538de1027e006ca7dd4916013d823a6d9207bd189dac78d9f3a97b506

SHA512
d096ec8fe35c1f6d493ef7ecb69b94f8a518b45ef6e2b183a11712167c064817bd54d58a3cefa1c106ac54d4592dc6de80e71c99f66b14ce0578d9b37f98b586

Download Submit
memory/3032-12-0x000001EBD20F0000-0x000001EBD20F8000-memory.dmp

Filesize
32KB

Download
memory/3032-13-0x000001EBEC7D0000-0x000001EBEC956000-memory.dmp

Filesize
1.5MB

Download
memory/3032-14-0x00007FF8BD110000-0x00007FF8BDBD1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-15-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download
memory/3032-17-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download
memory/3032-20-0x000001EBEFE20000-0x000001EBEFE70000-memory.dmp

Filesize
320KB

Download
memory/3032-38-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download
memory/3032-39-0x00007FF8BD110000-0x00007FF8BDBD1000-memory.dmp

Filesize
10.8MB

Download
memory/3032-40-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download
memory/3032-41-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download
memory/3032-42-0x000001EBD3F30000-0x000001EBD3F40000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads