Overview
overview
5Static
static
3chkdsk.exe
windows10-2004-x64
1chkntfs.exe
windows10-2004-x64
1choice.exe
windows10-2004-x64
1cipher.exe
windows10-2004-x64
1cleanmgr.exe
windows10-2004-x64
1cliconfg.exe
windows10-2004-x64
1clip.exe
windows10-2004-x64
1cmd.exe
windows10-2004-x64
1cmdkey.exe
windows10-2004-x64
1cmdl32.exe
windows10-2004-x64
1cmmon32.exe
windows10-2004-x64
1cmstp.exe
windows10-2004-x64
1cofire.exe
windows10-2004-x64
1colorcpl.exe
windows10-2004-x64
1comp.exe
windows10-2004-x64
1compact.exe
windows10-2004-x64
1conhost.exe
windows10-2004-x64
1consent.exe
windows10-2004-x64
1control.exe
windows10-2004-x64
3convert.exe
windows10-2004-x64
1convertvhd.exe
windows10-2004-x64
1coredpussvr.exe
windows10-2004-x64
1credwiz.exe
windows10-2004-x64
1cscript.exe
windows10-2004-x64
1ctfmon.exe
windows10-2004-x64
1cttune.exe
windows10-2004-x64
1cttunesvr.exe
windows10-2004-x64
1curl.exe
windows7-x64
1curl.exe
windows10-2004-x64
1dasHost.exe
windows10-2004-x64
1dccw.exe
windows10-2004-x64
1dcomcnfg.exe
windows10-2004-x64
5Resubmissions
23/08/2024, 16:00
240823-tf47dsteqe 623/08/2024, 15:32
240823-sy293sseld 423/08/2024, 15:18
240823-sp1d5athqk 823/08/2024, 14:12
240823-rjcv7sydnd 723/08/2024, 02:33
240823-c17dta1cpd 723/08/2024, 02:11
240823-cmbpzszelg 423/08/2024, 02:00
240823-ce59mazbnh 423/08/2024, 01:37
240823-b1992a1dmm 523/08/2024, 01:24
240823-bsm5jazhpp 523/08/2024, 00:51
240823-a7p21awhld 6Analysis
-
max time kernel
140s -
max time network
159s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
23/08/2024, 01:37
Static task
static1
Behavioral task
behavioral1
Sample
chkdsk.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral2
Sample
chkntfs.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral3
Sample
choice.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral4
Sample
cipher.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral5
Sample
cleanmgr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral6
Sample
cliconfg.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral7
Sample
clip.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral8
Sample
cmd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral9
Sample
cmdkey.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral10
Sample
cmdl32.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral11
Sample
cmmon32.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral12
Sample
cmstp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral13
Sample
cofire.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral14
Sample
colorcpl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral15
Sample
comp.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral16
Sample
compact.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral17
Sample
conhost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral18
Sample
consent.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral19
Sample
control.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral20
Sample
convert.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral21
Sample
convertvhd.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral22
Sample
coredpussvr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral23
Sample
credwiz.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral24
Sample
cscript.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral25
Sample
ctfmon.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral26
Sample
cttune.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral27
Sample
cttunesvr.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral28
Sample
curl.exe
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
curl.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral30
Sample
dasHost.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral31
Sample
dccw.exe
Resource
win10v2004-20240802-en
Behavioral task
behavioral32
Sample
dcomcnfg.exe
Resource
win10v2004-20240802-en
General
-
Target
dcomcnfg.exe
-
Size
28KB
-
MD5
dfa0d5bcde97e541aae197b791b0bf77
-
SHA1
602883cd4308964a2e0fc74a561861908400144f
-
SHA256
893a6c696459fe6f44c5e71dba1f792df37ba765095548d125ba43aca4f47b18
-
SHA512
bf78cf1c20941f4735549c427a8295b7b2ea5756d1246b7530c0e1e55a9c1f28574d93a0de4faf2392df07940f2733208451130718150357efc390a09b75087c
-
SSDEEP
192:XJTPYfus5uLG27WxL3uX8E4+7L5Eyf9CseWEFCpt2cjIfWJfsW0EW:ZTAWsYcL3fEP7LGj7FCp6fWyW0EW
Malware Config
Signatures
-
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\system32\comexp.msc mmc.exe File opened for modification C:\Windows\system32\MSDtc\MSDTC.LOG msdtc.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F4167BCB-4550-4F5E-9CBC-AA7A6ACF5BB0}.crmlog dllhost.exe File opened for modification C:\Windows\Registration\{02D4B3F1-FD88-11D1-960D-00805FC79235}.{F4167BCB-4550-4F5E-9CBC-AA7A6ACF5BB0}.crmlog dllhost.exe File opened for modification C:\Windows\DtcInstall.log msdtc.exe -
Suspicious use of AdjustPrivilegeToken 11 IoCs
description pid Process Token: SeSecurityPrivilege 4488 mmc.exe Token: 33 4488 mmc.exe Token: SeIncBasePriorityPrivilege 4488 mmc.exe Token: 33 4488 mmc.exe Token: SeIncBasePriorityPrivilege 4488 mmc.exe Token: 33 4488 mmc.exe Token: SeIncBasePriorityPrivilege 4488 mmc.exe Token: 33 4488 mmc.exe Token: SeIncBasePriorityPrivilege 4488 mmc.exe Token: 33 4488 mmc.exe Token: SeIncBasePriorityPrivilege 4488 mmc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4488 mmc.exe 4488 mmc.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2836 wrote to memory of 4488 2836 dcomcnfg.exe 89 PID 2836 wrote to memory of 4488 2836 dcomcnfg.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe"C:\Users\Admin\AppData\Local\Temp\dcomcnfg.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\system32\mmc.exeC:\Windows\system32\mmc.exe C:\Windows\system32\comexp.msc2⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4488
-
-
C:\Windows\system32\dllhost.exeC:\Windows\system32\dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}1⤵
- Drops file in Windows directory
PID:3512
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2516