b5bda4e60f9cdae2ce01db011d0395661d1e53dc7a9d9f2c508023484cf0140a

Resubmissions

22/05/2024, 01:04

240522-be1hpsff2v 4

21/05/2024, 23:24

240521-3dwxnsde6v 4

Analysis

max time kernel
450s
max time network
452s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
21/05/2024, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Denetty_Driver PCIe NVMe/F6flpy-x64 (Intel® VMD)/iaStorAfsService.exe
Size

2.8MB
MD5

42dbdb0cdde6ac2f8ae9fe921f2eef44
SHA1

70ab0fc62524de3af256a7445fb7ecdb2239bcd9
SHA256

a96f1162fa152cc22c4489afaecb835ec73ed521fe24cd4791d027f1f99f6eaa
SHA512

34d2b15d50b0d67bc01f92b2f61087b10613218ebcbd13147c7f2dc7979147e03f90cf73367aeb52956b276f1f414266a83964a88a742f26ca356b002a1a37a7
SSDEEP

49152:arwFcmF0py/REogsrEUmmQTclDN3aGFSux8xaKAwesXok5Mbn:iDmFPZAKEeQgl9dR

Score

4^/10

persistence

Malware Config

Signatures

Registers COM server for autorun 1 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ = "\"c:\\Windows\\System32\\iaStorAfsService.exe\""	iaStorAfsService.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\Version	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\Version\ = "1.0"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\HELPDIR	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\TypeLib	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\ = "iaStorAfsServiceLib"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\FLAGS\ = "0"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\HELPDIR\ = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{967291FE-41EB-4809-B62A-5E5EBC7F099C}	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{967291FE-41EB-4809-B62A-5E5EBC7F099C}\LocalService = "iaStorAfsService"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\ = "Scheduler Class"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\AppID = "{967291FE-41EB-4809-B62A-5E5EBC7F099C}"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ = "\"c:\\Windows\\System32\\iaStorAfsService.exe\""	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0\win64	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\LocalServer32\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{D19AAF57-65A7-484B-9E7A-26C0E667DC66}\TypeLib\ = "{51C0003F-0741-4D1A-A612-891EB6928B5B}"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}	iaStorAfsService.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\0\win64\ServerExecutable = "c:\\Windows\\System32\\iaStorAfsService.exe"	iaStorAfsService.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{51C0003F-0741-4D1A-A612-891EB6928B5B}\1.0\FLAGS	iaStorAfsService.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\Denetty_Driver PCIe NVMe\F6flpy-x64 (Intel® VMD)\iaStorAfsService.exe
"C:\Users\Admin\AppData\Local\Temp\Denetty_Driver PCIe NVMe\F6flpy-x64 (Intel® VMD)\iaStorAfsService.exe"
1⤵
- Registers COM server for autorun
- Modifies registry class
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads