c6a1437c67946e2b4050826bf03690b020fbb74d18e474f09c3d9a3d2037bd2a

Analysis

max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ET Series Setup 1.0/setup.exe
Size 666KB
Sample260420-plc8msh13m
SHA256 c6a1437c67946e2b4050826bf03690b020fbb74d18e474f09c3d9a3d2037bd2a
MD5 1ef3560ded47c3f1d9e64c14ecd659ea
SHA1 d233e200540c8c34ab72db7fb83e29ed76540b66
SHA512 50776330f7381f893f242c06dfa85c6292c11be1301db9859f1f8037e4f3976195277588b9bbed27a9461e40a49c0c09dc024fb704b6f7bd3bc406e50893a1ab
SSDEEP 6144:TXaNjt6LuPHmLyiBvuJiFkJ+2Qw+MMq6FlOUeKJ6qjaUojDuUlOR1H:zYYuUx65QwDMq6TOUZeDuUlOTH
TLSH
T179E4642556E8A139F3F79A70BFF45023AA65BC622A34CC9F11D5134D0A62E52ED6033F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
5088	ET Series Setup.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File created	C:\Windows\assembly\Desktop.ini	dfsvc.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dfsvc.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\assembly	dfsvc.exe
File created	C:\Windows\assembly\Desktop.ini	dfsvc.exe
File opened for modification	C:\Windows\assembly\Desktop.ini	dfsvc.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "RN047408HX8MOXM0NMRVCZC7"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08e = 660069006c0065003a002f002f002f0043003a002f00550073006500720073002f00410064006d0069006e002f0041007000700044006100740061002f004c006f00630061006c002f00540065006d0070002f00450054002500320030005300650072006900650073002500320030005300650074007500700025003200300031002e0030002f0045005400250032003000530065007200690065007300250032003000530065007400750070002e006100700070006c00690063006100740069006f006e000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08e = 0000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\etse..etup_none_0001.0000_none_c2579ddebd59a5ff\Files	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\PreparedForExecution = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\implication!etse..tion_309f33586a0b08ee_0001.0000_cbf04e0bb = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\SubstructureCreated = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_etse..tion_309f33586a0b08ee_ed9afec6ade69d39	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\etse..tion_309f33586a0b08e	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_etse..tion_309f33586a0b08ee_533d4962e2aa5d5f	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\HasRunBefore = 01	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\etse..etup_none_0001.0000_none_c2579ddebd59a5ff	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\identity = 4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gi_etse..tion_309f33586a0b08ee_533d4962e2aa5d5f\LastRunVersion = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!060000004e50580e880800005412000000000000000000007 = 30303030303838382c30316463643063316631316335376532	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\identity = 4554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\identity = 4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08e = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\Applications\etse..tion_309f33586a0b08ee_0001.000 = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\appid = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2f4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\Applications	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\lock!04000000ea50580ee01300009001000000000000000000005 = 30303030313365302c30316463643063316637373564353661	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\etse..tion_309f33586a0b08e = 660069006c0065003a002f002f002f0043003a002f00550073006500720073002f00410064006d0069006e002f0041007000700044006100740061002f004c006f00630061006c002f00540065006d0070002f00450054002500320030005300650072006900650073002500320030005300650074007500700025003200300031002e0030002f004100700070006c00690063006100740069006f006e00250032003000460069006c00650073002f0045005400250032003000530065007200690065007300250032003000530065007400750070005f0031005f0030005f0030005f0034002f0045005400250032003000530065007200690065007300250032003000530065007400750070002e006500780065002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	ET Series Setup.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\implication!etse..tion_309f33586a0b08ee_0001.0000_cbf0 = 66696c653a2f2f2f433a2f55736572732f41646d696e2f417070446174612f4c6f63616c2f54656d702f45542532305365726965732532305365747570253230312e302f455425323053657269657325323053657475702e6170706c69636174696f6e234554205365726965732053657475702e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_etse..tion_309f33586a0b08ee_ed9afec6ade69d39	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204\lock!02000000ea50580ee01300009001000000000000000000005 = 30303030313365302c30316463643063316637373564353661	ET Series Setup.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_cbf04e0bb39cded6\reference!S_{3f471841-eef2-47d6-89c0-d028f03a4ad5}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed\identity = 4554205365726965732053657475702e6578652c2056657273696f6e3d312e302e302e342c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333039663333353836613062303865652c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\etse..etup_none_0001.0000_none_c2579ddebd59a5ff\identi = 4554205365726965732053657475702c2056657273696f6e3d312e302e302e302c2043756c747572653d6e65757472616c2c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-721190819-434563495-2007910846-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\lock!070000004e50580e8808000054120000000000000000000078bf72 = 30303030303838382c30316463643063316631316335376532	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2184	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4552 wrote to memory of 2184	4552	setup.exe	84
PID 2184 wrote to memory of 5088	2184	dfsvc.exe	85

C:\Users\Admin\AppData\Local\Temp\ET Series Setup 1.0\setup.exe
"C:\Users\Admin\AppData\Local\Temp\ET Series Setup 1.0\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4552
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Drops desktop.ini file(s)
  - Drops file in Windows directory
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Users\Admin\AppData\Local\Apps\2.0\64BK6TQG.QAP\L1DMCB6K.DD4\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\ET Series Setup.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\64BK6TQG.QAP\L1DMCB6K.DD4\etse..tion_309f33586a0b08ee_0001.0000_92c57c18f7548a31\ET Series Setup.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\64BK6TQG.QAP\L1DMCB6K.DD4\manifests\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.cdf-ms
Size 10KB
SHA256 c67a730ab65937cc0ce6878c43ee47984cc1232d3b4954b0201478a5cc08af96
MD5 07b4ed8966e417019a06f4e90077b62d
SHA1 66ac3c3ed70e1c0e460512888ab64d9e5e96ccda
SHA512 16383bd1eba9165c812cfae5613578dda69733aca69accbf2bbf4ec4821ee9e51cb8cef50a40bda4d17653e022a744d96d0263a91be84f565f3001cdcb6fba6d
SSDEEP 96:z1hmnv+FEW0/8RRnUWJtSyn5kmcJsI+ngH7ypS0iYyFjGPwpdi7JsErFf3v8LPbE:z1hmvg3LxymcGAr9Dd6JsKxv8LjjqZ
TLSH
T185320700BAA0D957D2505733ECE6C3E07272BDD24E53178B740ABB0FBE317D5A8022A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.manifest

Path C:\Users\Admin\AppData\Local\Apps\2.0\64BK6TQG.QAP\L1DMCB6K.DD4\manifests\etse...exe_309f33586a0b08ee_0001.0000_none_b5a279b05a9c10ed.manifest
Size 7KB
SHA256 531c70f7aab8dd9079472769688ddd1f01785633dc7ce8d30ce76b9f44df5d00
MD5 2129e3917c7dc8dab171661c91ee1d34
SHA1 ac6527773ebc7eb5810f5ed1316d44d9f16e7cc2
SHA512 2b4c9eb39349037b339a543ccec2d22c9181f85ebe82059d27ab6145de6b17863373dcf8620c5b6371703341f6f4bbfcd393245e9ab0256fe4f714ca8575e3ff
SSDEEP 96:xWt41jhwOL/1tYcAe3Syj2NknndJHkmOz8A++bEoYkQ0iYyFj5BDA:oM7rYcAehdnd1ORtYbr9bA
TLSH
T1A4E1C65AC4C8E811A32296903EF3D613AB5A23A344ED18C9FD6D994FEF186D581433B7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\64BK6TQG.QAP\L1DMCB6K.DD4\manifests\etse..tion_309f33586a0b08ee_0001.0000_none_243b46fc209be204.cdf-ms
Size 8KB
SHA256 142909921210a53a31071f798d79e45c27085d8747568fa35d8450b69809d524
MD5 df9179b07d56bdf4ee2d1a3531f95239
SHA1 6d33c7658f9d577be95e6a2e313caff24ddb827e
SHA512 c5e106a2221d85c69b747f6cb4c27876e3349a0b2be90fd2234dd60b0f08488717ae5eb6f5bd690dff38fdd4d8f27a7bc596609ff659921020ef9b8b1524a3c7
SSDEEP 96:k2FbtEW05R5onUm7cTtkVSYL+nguDy1jQ0iYyFjomS+8xAZ6pskbe:kOVH97jVSLr9s5e
TLSH
T195F11A41BA61C803D2056633ACE2C7E27372BDD24E57934B74557F0FBD307989A43666
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ET Series Setup.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\305OZZHG.830\8VLKD2V7.6VB\ET Series Setup.exe
Size 89KB
SHA256 1a340f33e0f5fee36feb347862e38217cc8d262ec28c8c25e69d1c073a6872d2
MD5 52d736bd1be7ad27e5091c81f826e5a5
SHA1 21817ca676f529f8fa9e0d35b9ec3e27a4cf19e6
SHA512 83d9e3670e7416a7f4bd0432d7081ccb91760aa8d1c97e0c3e83deace73570aa785ac7cda5f4deb7c45013562fbe5cbd201727a866c81733a7677c981a2d1909
SSDEEP 768:ag3JVfUqROc78CbA/+feqVMZLJDxB9LandoAyN0da4r5Yidxsu/zDr/E:ag5FDFACbA/+feq69woAFaC5pdx5zDg
TLSH
T11793973036AAA119D93957B00D79E2C153767A7EBF14CB6E2895024CEE637134B01FBB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

PDCGPZTL.MZN.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\PV1P2X9C.AZJ\PDCGPZTL.MZN.application
Size 5KB
SHA256 83ba06273ad0992942d90f8df0575bc14e67515d0318b3256bf402988d9002ff
MD5 68ad161a71e27ccf2f560b206a611177
SHA1 e060bf752055a4341af3dbd2af55ce42f47eb9de
SHA512 3dcb5fc050279b4a98f1af418d59abbcbb37bc77f9ca2dec9dd0354b14f34bea87a4c755c67df6f18290683fa56dccf8020b13a482c1a59cbdc10c832bd964d1
SSDEEP 96:xWtZq1jeaboH5SkMmSYZkmOMVa+bEQj+kQ0iYyFj5BDA:o95tSmZ0br9bA
TLSH
T1C0B1A559C8C9D802F305E6707AF2D5032A9927B340FC84C8BDB55C9EEF546E981023BB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2184-32-0x000002166DC70000-0x000002166DD18000-memory.dmp

Download

memory/2184-7-0x0000021651B90000-0x0000021651BE0000-memory.dmp

Download

memory/2184-22-0x00007FF8DAF15000-0x00007FF8DAF16000-memory.dmp

Download

memory/2184-21-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-23-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-24-0x00007FF8DAC60000-0x00007FF8DB601000-memory.dmp

Download

memory/2184-27-0x000002166DBC0000-0x000002166DBC8000-memory.dmp

Download

memory/2184-28-0x00007FF8DAC60000-0x00007FF8DB601000-memory.dmp

Download

memory/2184-29-0x00007FF8DAC60000-0x00007FF8DB601000-memory.dmp

Download

memory/2184-30-0x000002166DE90000-0x000002166E152000-memory.dmp

Download

memory/2184-31-0x000002166DD00000-0x000002166DE36000-memory.dmp

Download

memory/2184-0-0x00000216375E0000-0x00000216375E8000-memory.dmp

Download

memory/2184-11-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-20-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-110-0x00007FF8DAF15000-0x00007FF8DAF16000-memory.dmp

Download

memory/2184-2-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-1-0x0000021651C20000-0x0000021651DA6000-memory.dmp

Download

memory/2184-37-0x000002166DC00000-0x000002166DC1C000-memory.dmp

Download

memory/2184-35-0x0000021639130000-0x000002163913C000-memory.dmp

Download

memory/2184-108-0x0000021651F80000-0x0000021651F90000-memory.dmp

Download

memory/2184-106-0x00007FF8DAC60000-0x00007FF8DB601000-memory.dmp

Download

memory/4552-4-0x0000000002DB0000-0x0000000002E83000-memory.dmp

Download

memory/5088-107-0x000000001C080000-0x000000001C11C000-memory.dmp

Download

memory/5088-105-0x000000001BA10000-0x000000001BEDE000-memory.dmp

Download

memory/5088-109-0x0000000000B30000-0x0000000000B38000-memory.dmp

Download

memory/5088-112-0x0000000000D40000-0x0000000000D4C000-memory.dmp

Download

memory/5088-113-0x000000001CB20000-0x000000001CCC9000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads