Analysis

  • max time kernel
    132s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-05-2024 15:18

General

  • Target

    ByteFence.exe

  • Size

    3.8MB

  • MD5

    b821cd61e2d66b1ca5c795230f6b1b8e

  • SHA1

    a2e0cea3af916f98233ad73992cbac1dea55b234

  • SHA256

    16e0d6966e98794aa18719606e41f4d4ae74683d652e81374717282fc8b3239e

  • SHA512

    6f88f403aadb97612bb409bae098bfba28d863a97c4fdb5a69431732251d7a91d3bc76750d30e30db38df1e7d4cf2f633c2b5a09cfef08437d5d1a6cfd55ebd7

  • SSDEEP

    98304:YXrXAQnL22v90UxMwbV1J29H0SF8A9q4er:YTL2mewhn2ddrur

Score
6/10

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Modifies data under HKEY_USERS 1 IoCs
  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 48 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\ByteFence.exe
    "C:\Users\Admin\AppData\Local\Temp\ByteFence.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1648
    • \??\c:\users\admin\appdata\local\temp\ByteFenceService.exe
      "c:\users\admin\appdata\local\temp\ByteFenceService.exe" /i
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3824
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
      dw20.exe -x -s 1444
      2⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of AdjustPrivilegeToken
      PID:1916
  • \??\c:\users\admin\appdata\local\temp\ByteFenceService.exe
    "c:\users\admin\appdata\local\temp\ByteFenceService.exe"
    1⤵
    • Modifies data under HKEY_USERS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3008

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\ByteFenceService.InstallLog

    Filesize

    278B

    MD5

    6eaa1926a6ef20c0742b1344bf1d8a14

    SHA1

    a9ba7268b609d64e0434d9a8f3f78d2371a2ac1d

    SHA256

    119aacf78c0083c15adc496df961bb78fe33efac6d3f41227d903f6c63b3ee28

    SHA512

    f4fef01bcded694a182440501f7a0dd47d6441e2558f1df26d019697a2f9372fd0f0e6ba8e1bb2b30b4fe34f53eefbc439e7ead6f1d726fd465543c9fccc9889

  • \??\c:\users\admin\appdata\local\temp\Errors.dat

    Filesize

    1003B

    MD5

    8271812779c55482a4686d02abaa2623

    SHA1

    08208f134e21937f3f3ef92034d898359cf60e64

    SHA256

    23a949ad6e2d756068f9246ba261ad6862fac44fdf6c8044d9f68575f52becab

    SHA512

    247f1074ca378e63c69063018a2d1faa2b42e221f1e80a5ff1d5065bcd03c6bd338126925697380f36ec9c8d7975fb4ce0dd103d74c19217de33af120c4c2724

  • \??\c:\users\admin\appdata\local\temp\Logs\err.dat

    Filesize

    1KB

    MD5

    c5c01f18fdc256f97f5d15bfa55215c2

    SHA1

    59563f3dd8ba98eecc48d1a7b7806011506828af

    SHA256

    0a09b8134aea506ee622c6f0e25fb7a7d952636ec1665c2020a2b7eaf6b3445c

    SHA512

    0440cd3e5347d23035d763d85fab1ce6e88c6e0338bb45e39b5286bb6330e7ed171a7c756493615fb97058dfd5917501032b1a884cdcea7431ee6031e13bfb0d

  • \??\c:\users\admin\appdata\local\temp\rsEngine.config

    Filesize

    344B

    MD5

    56471e1d552cf365892a221059747376

    SHA1

    89cb5955b2ea777edd6366c5139029946310bafd

    SHA256

    d71574e62332c8ba76faf56f14de7357b6b2eba1d6c2e41dd140170a7b729d50

    SHA512

    a5be82b7a7940a60e5febf5458237fcfa4b1a06188604529089b711b802c0fee7bad700a368830737e78d0c32431cc8baa13cb65f1c320cf14943be7d8e46972

  • memory/1648-57-0x000000001CC10000-0x000000001CC7A000-memory.dmp

    Filesize

    424KB

  • memory/1648-62-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-6-0x000000001E940000-0x000000001EE0E000-memory.dmp

    Filesize

    4.8MB

  • memory/1648-48-0x00007FFE5FDD5000-0x00007FFE5FDD6000-memory.dmp

    Filesize

    4KB

  • memory/1648-8-0x000000001C450000-0x000000001C48C000-memory.dmp

    Filesize

    240KB

  • memory/1648-9-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-11-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-13-0x000000001C6E0000-0x000000001C700000-memory.dmp

    Filesize

    128KB

  • memory/1648-1-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-74-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-65-0x0000000020BF0000-0x0000000020D6C000-memory.dmp

    Filesize

    1.5MB

  • memory/1648-64-0x000000001C540000-0x000000001C546000-memory.dmp

    Filesize

    24KB

  • memory/1648-63-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-19-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-61-0x000000001C4A0000-0x000000001C4A8000-memory.dmp

    Filesize

    32KB

  • memory/1648-4-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-5-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-60-0x000000001CBA0000-0x000000001CBF2000-memory.dmp

    Filesize

    328KB

  • memory/1648-7-0x000000001C3B0000-0x000000001C44C000-memory.dmp

    Filesize

    624KB

  • memory/1648-2-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-51-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-0-0x00007FFE5FDD5000-0x00007FFE5FDD6000-memory.dmp

    Filesize

    4KB

  • memory/1648-55-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/1648-3-0x000000001D090000-0x000000001D5E4000-memory.dmp

    Filesize

    5.3MB

  • memory/3008-52-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-56-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-50-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-49-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3008-75-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-20-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-18-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-15-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-16-0x000000001B0B0000-0x000000001B0C8000-memory.dmp

    Filesize

    96KB

  • memory/3824-17-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-23-0x000000001BD80000-0x000000001BDA4000-memory.dmp

    Filesize

    144KB

  • memory/3824-47-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB

  • memory/3824-14-0x00007FFE5FB20000-0x00007FFE604C1000-memory.dmp

    Filesize

    9.6MB