9df41ebe1a2c61bbc382a85a7788e127e4dafada4955a1b6c3dfcaf460bd714f

Resubmissions

09/07/2024, 13:39

240709-qydwdayanf 7

09/07/2024, 07:52

09/07/2024, 06:42

09/07/2024, 06:34

09/07/2024, 05:47

Analysis

max time kernel
121s
max time network
163s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2024, 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

dcomcnfg.exe
Size

28KB
MD5

dfa0d5bcde97e541aae197b791b0bf77
SHA1

602883cd4308964a2e0fc74a561861908400144f
SHA256

893a6c696459fe6f44c5e71dba1f792df37ba765095548d125ba43aca4f47b18
SHA512

bf78cf1c20941f4735549c427a8295b7b2ea5756d1246b7530c0e1e55a9c1f28574d93a0de4faf2392df07940f2733208451130718150357efc390a09b75087c
SSDEEP

192:XJTPYfus5uLG27WxL3uX8E4+7L5Eyf9CseWEFCpt2cjIfWJfsW0EW:ZTAWsYcL3fEP7LGj7FCp6fWyW0EW

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\comexp.msc	mmc.exe
File opened for modification	C:\Windows\system32\MSDtc\MSDTC.LOG	msdtc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{90E5EACA-7441-4D99-A8AC-226BF6B330E1}.crmlog	dllhost.exe
File opened for modification	C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{90E5EACA-7441-4D99-A8AC-226BF6B330E1}.crmlog	dllhost.exe
File opened for modification	C:\Windows\DtcInstall.log	msdtc.exe

Suspicious use of AdjustPrivilegeToken 11 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2712	mmc.exe
Token: 33	2712	mmc.exe
Token: SeIncBasePriorityPrivilege	2712	mmc.exe
Token: 33	2712	mmc.exe
Token: SeIncBasePriorityPrivilege	2712	mmc.exe
Token: 33	2712	mmc.exe
Token: SeIncBasePriorityPrivilege	2712	mmc.exe
Token: 33	2712	mmc.exe
Token: SeIncBasePriorityPrivilege	2712	mmc.exe
Token: 33	2712	mmc.exe
Token: SeIncBasePriorityPrivilege	2712	mmc.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2712	mmc.exe
2712	mmc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 2712	3692	dcomcnfg.exe	90
PID 3692 wrote to memory of 2712	3692	dcomcnfg.exe	90

C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe
"C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Windows\system32\mmc.exe
  C:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc
  2⤵
  - Drops file in System32 directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:2712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4376,i,3027467512973953085,11878940668304988630,262144 --variations-seed-version --mojo-platform-channel-handle=1028 /prefetch:8
1⤵
PID:2080

C:\Windows\system32\dllhost.exe
C:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
1⤵
- Drops file in Windows directory
PID:1652

C:\Windows\System32\msdtc.exe
C:\Windows\System32\msdtc.exe
1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:3536

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2712-0-0x00007FFEDC1B3000-0x00007FFEDC1B5000-memory.dmp

Filesize
8KB

Download
memory/2712-1-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-2-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-3-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-4-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-5-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-6-0x00007FFEDC1B3000-0x00007FFEDC1B5000-memory.dmp

Filesize
8KB

Download
memory/2712-7-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-8-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-9-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download
memory/2712-10-0x00007FFEDC1B0000-0x00007FFEDCC71000-memory.dmp

Filesize
10.8MB

Download