8c978b2cc906cc6344c6286ac8866df05fa44bcd88c7652dec4eda2dbaac0302

Resubmissions

14/07/2026, 14:58

260714-sckg5sfs5n

14/07/2026, 14:56

260714-sa8f7ahx7w1

14/07/2026, 13:35

260714-qvwa9agw517

14/07/2026, 12:53

260714-p4rhzsfz218

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
599s
max time network
462s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-ja
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-jalocale:ja-jpos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
GapiUpdate.application
Size 15KB
Sample260714-p4rhzsfz21
SHA256 8c978b2cc906cc6344c6286ac8866df05fa44bcd88c7652dec4eda2dbaac0302
MD5 9f9511e18ec3e9ddc03fa843f0e56486
SHA1 9756b607de08e46f2e0b251c3ec23eaa806dcd97
SHA512 a7f142ee066cdc09163d06aaef096435e6cdb534b6320404ac89e194da20fdf53a47fe3fc2748a8dc154166bd25770285244f77e8d9810eab94bfe71c5b0bf52
SSDEEP 384:2ZKBQo+BQI4fajVoaXzX1mhLwaQdXUBX2JaW2pvvoSTA2px4/:w3oTI4iJoajXMLYdEBGYWivvoJ2o/
TLSH
T1C4727D9FCA907808B206F474EFE7A1422149B3B789DE445E9C557C0ACF09FE846752EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

Modifies registry class 27 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "MNEMOD0TAQAELBJA1VAKMJ7N"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\NonCanonicalData	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\gapi..tion_38ce3b33a131d = 68747470733a2f2f676170696472697665722e636f6d2f696e7374616c6c65722f476170695570646174652e6170706c69636174696f6e23476170695570646174652e6170706c69636174696f6e2c2056657273696f6e3d312e302e302e3138322c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d333863653362333361313331646361332c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\gapi..tion_38ce3b33a131d = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d002200680074007400700073003a002f002f0067006100700069006400720069007600650072002e0063006f006d002f0069006e007300740061006c006c00650072002f0047006100700069005500700064006100740065002e006100700070006c00690063006100740069006f006e00230047006100700069005500700064006100740065002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0031002e0030002e0030002e003100380032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0033003800630065003300620033003300610031003300310064006300610033002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f0047006100700069005500700064006100740065002e006500780065002c002000560065007200730069006f006e003d0031002e0030002e0030002e003100380032002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0033003800630065003300620033003300610031003300310064006300610033002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e00530065007400200055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d00220028006800740074007000730029003a002f002f0067006100700069006400720069007600650072005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300031003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\gapi..tion_38ce3b33a131d	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "7NLX159GRTGQ71A0EE93WC2W"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Assemblies	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Categories	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Applications	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "XDJE767ENLQZ82HQ20O6DN6A"	dfsvc.exe
Key deleted	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2148	dfsvc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 2148	4716	rundll32.exe	88

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\dfshim.dll",ShOpenVerbApplication C:\Users\Admin\AppData\Local\Temp\GapiUpdate.application
1⤵
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  PID:2148

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

6ZYHJM5J.V21.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\6P7XENHL.A7A\6ZYHJM5J.V21.application
Size 15KB
SHA256 8c978b2cc906cc6344c6286ac8866df05fa44bcd88c7652dec4eda2dbaac0302
MD5 9f9511e18ec3e9ddc03fa843f0e56486
SHA1 9756b607de08e46f2e0b251c3ec23eaa806dcd97
SHA512 a7f142ee066cdc09163d06aaef096435e6cdb534b6320404ac89e194da20fdf53a47fe3fc2748a8dc154166bd25770285244f77e8d9810eab94bfe71c5b0bf52
SSDEEP 384:2ZKBQo+BQI4fajVoaXzX1mhLwaQdXUBX2JaW2pvvoSTA2px4/:w3oTI4iJoajXMLYdEBGYWivvoJ2o/
TLSH
T1C4727D9FCA907808B206F474EFE7A1422149B3B789DE445E9C557C0ACF09FE846752EE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2148-15-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-48-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-3-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-4-0x0000028E9D460000-0x0000028E9D56E000-memory.dmp

Download

memory/2148-6-0x0000028E9D7B0000-0x0000028E9D8C2000-memory.dmp

Download

memory/2148-5-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-7-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-11-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-10-0x0000028E9D3F0000-0x0000028E9D440000-memory.dmp

Download

memory/2148-13-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-14-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-1-0x00007FFD8D29F000-0x00007FFD8D2A0000-memory.dmp

Download

memory/2148-2-0x0000028E9CFC0000-0x0000028E9D148000-memory.dmp

Download

memory/2148-16-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-29-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-21-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-22-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-24-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-0-0x0000028E82990000-0x0000028E82998000-memory.dmp

Download

memory/2148-28-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-46-0x0000028EA4240000-0x0000028EA43D2000-memory.dmp

Download

memory/2148-47-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-17-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-49-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-50-0x00007FFD8D110000-0x00007FFD8DAB4000-memory.dmp

Download

memory/2148-132-0x0000028EA40F0000-0x0000028EA4138000-memory.dmp

Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads