b5bda4e60f9cdae2ce01db011d0395661d1e53dc7a9d9f2c508023484cf0140a

Resubmissions

22/05/2024, 01:04

240522-be1hpsff2v 4

21/05/2024, 23:24

240521-3dwxnsde6v 4

Analysis

max time kernel
453s
max time network
490s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
21/05/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

Denetty_Driver PCIe NVMe/F6flpy-x64 (Non-Intel® VMD)/iaStorAfsService.exe
Size

2.8MB
MD5

807d034ac2abe270ffb216c6a0bc7991
SHA1

7d56a93984238cd8d40f9c89c98d7f24958ccc74
SHA256

6b171341fd3b7eab265495cd736b51c0dc050fba6329610b4c09dd889a68c8ac
SHA512

f9b02fa2864fb8ac5a4735722ce25778a93e0b3f5d09c5a447c1a04cb0602e4a3f2d85fedfc4b893ffa869778569811a45406edda71cc3bff26b9dffd69c5f6a
SSDEEP

49152:/rwFcmF0py/REogsrEUmmQTclDN3aGFSux8xaKAwesXok5MbB:zDmFPZAKEeQgl9dP

Score

4^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ = "\"c:\\Windows\\System32\\iaStorAfsService.exe\""	iaStorAfsService.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\Version	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\Version\ = "1.0"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0\win64	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0\win64\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\AppID = "{967291FE-41EB-4809-B62A-5E5EBC7F099C}"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\TypeLib\ = "{51C0003F-0741-4D1A-A612-891EB6928B5B}"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\FLAGS	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\HELPDIR	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\HELPDIR\ = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{967291FE-41EB-4809-B62A-5E5EBC7F099C}	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{967291FE-41EB-4809-B62A-5E5EBC7F099C}\LocalService = "iaStorAfsService"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ = "\"c:\\Windows\\System32\\iaStorAfsService.exe\""	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\ = "iaStorAfsServiceLib"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\FLAGS\ = "0"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\ = "Scheduler Class"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\TypeLib	iaStorAfsService.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Denetty_Driver PCIe NVMe\F6flpy-x64 (Non-Intel® VMD)\iaStorAfsService.exe
"C:\Users\Admin\AppData\Local\Temp\Denetty_Driver PCIe NVMe\F6flpy-x64 (Non-Intel® VMD)\iaStorAfsService.exe"
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:3096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads