aac79ebb59f9740ac1dad02a41ca181adfc4c5c21dcc5c5ece893498b3386ac8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 03:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c4df68fa8aedf498f650be83caf7b9bd.exe
Size

20KB
MD5

c4df68fa8aedf498f650be83caf7b9bd
SHA1

d2ac1ed37612a2e1a66509cd069401a8ce7169f6
SHA256

aac79ebb59f9740ac1dad02a41ca181adfc4c5c21dcc5c5ece893498b3386ac8
SHA512

38fabcd68721df1a6376323cbb84a9eb269d928fe305a66b5ab50bde8f19250996bb2278f8c71e24dfb45d7ba7a0e80b4a74ab4e8ab2de39056d00c8ba2b2055
SSDEEP

384:LiZ3L7q4Nt+m0kbKhJG5dLc/nmhF9shTEYb0bwu2Skg6fc2ukbNlZo63wG1uq8aq:LiNq4N2i0JGKnmSb0UfS76fc2u4lZ/38

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
4140	c4df68fa8aedf498f650be83caf7b9bd.exe
4140	c4df68fa8aedf498f650be83caf7b9bd.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\rfdswc.dll	c4df68fa8aedf498f650be83caf7b9bd.exe
File created	C:\Windows\SysWOW64\tf0	c4df68fa8aedf498f650be83caf7b9bd.exe
File opened for modification	C:\Windows\SysWOW64\rfdswc.dll.LoG	c4df68fa8aedf498f650be83caf7b9bd.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{461D2AB4-29A5-45C2-9134-D52272D3DE38}	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{461D2AB4-29A5-45C2-9134-D52272D3DE38}\InProcServer32	c4df68fa8aedf498f650be83caf7b9bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{461D2AB4-29A5-45C2-9134-D52272D3DE38}\InProcServer32\ThreadingModel = "Apartment"	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	c4df68fa8aedf498f650be83caf7b9bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION	c4df68fa8aedf498f650be83caf7b9bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{461D2AB4-29A5-45C2-9134-D52272D3DE38}\InProcServer32\ = "C:\\Windows\\SysWow64\\rfdswc.dll"	c4df68fa8aedf498f650be83caf7b9bd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{461D2AB4-29A5-45C2-9134-D52272D3DE38}\ = "MICROSOFT"	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	c4df68fa8aedf498f650be83caf7b9bd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER	c4df68fa8aedf498f650be83caf7b9bd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4140	c4df68fa8aedf498f650be83caf7b9bd.exe
4140	c4df68fa8aedf498f650be83caf7b9bd.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	4140	c4df68fa8aedf498f650be83caf7b9bd.exe
Token: SeRestorePrivilege	4140	c4df68fa8aedf498f650be83caf7b9bd.exe
Token: SeBackupPrivilege	4140	c4df68fa8aedf498f650be83caf7b9bd.exe
Token: SeRestorePrivilege	4140	c4df68fa8aedf498f650be83caf7b9bd.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
4140	c4df68fa8aedf498f650be83caf7b9bd.exe
4140	c4df68fa8aedf498f650be83caf7b9bd.exe
4140	c4df68fa8aedf498f650be83caf7b9bd.exe

C:\Users\Admin\AppData\Local\Temp\c4df68fa8aedf498f650be83caf7b9bd.exe
"C:\Users\Admin\AppData\Local\Temp\c4df68fa8aedf498f650be83caf7b9bd.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1416 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8
1⤵
PID:4952

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\rfdswc.dll

Filesize
252KB

MD5
f3be926388bbd7032cedfd55e0c7d443

SHA1
a69ce6d53c584ba4b45d88b0570788f799331ed6

SHA256
a4c6316a8a9d534c3efd274b946467b613a734bfaca2307635760b631b597281

SHA512
635f617694471ce10c8d5ac593e691f1e4bc06b4722bba93f16645ac30da8b1181cb5395bccb223e63a4d45ec6eddca90a8d09b6b5b84901dcbc0df169167608

Download Submit
memory/4140-4-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/4140-8-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download
memory/4140-9-0x00000000009C0000-0x00000000009CE000-memory.dmp

Filesize
56KB

Download