dff3317950ddb7fa38c16208724d0d220c4af698d49b227da8dd006942184e17

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.exe
Size 484KB
Sample260722-w4rx3ssaph
SHA256 dff3317950ddb7fa38c16208724d0d220c4af698d49b227da8dd006942184e17
MD5 bef2d19528be0171469dfdf30a94d8b6
SHA1 6489facbfc5cdab03bfbe7fe20604483cd13a180
SHA512 dd503d13e35c2d03d6bab08837f0f83e43d71c036f2286770d55c30b8d3452ab51361c65fbba634afa1445c41b3f4bd0ec6936b4126318e28c6bff712786a489
SSDEEP 6144:RDYWR5J+Wnp8JZt1u3s+++yPmhbyonmqZ2TLdwMpvXVQF4WaoGq6os6uAQ77U:RDtPJKQ7v5yamCmwjf6oNPQ77U
TLSH
T164B4071267E85035F1B35B70AFB556B14BBABC616D75CE2E23C0090D09B7A81FD20BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Downloads MZ/PE file 6 IoCs

flow	pid	Process
21	5576	dfsvc.exe
21	5576	dfsvc.exe
21	5576	dfsvc.exe
21	5576	dfsvc.exe
21	5576	dfsvc.exe
21	5576	dfsvc.exe

Executes dropped EXE 1 IoCs

pid	Process
5416	SamplingStats.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe:Zone.Identifier	dfsvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe

Modifies registry class 64 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e\identity = 436f6d6d6f6e2c2056657273696f6e3d312e302e302e302c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d443246393745384333424645394538422c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54\identity = 53616d706c696e6753746174732c2056657273696f6e3d312e302e31342e3134372c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d443246393745384333424645394538422c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\VisibilityRoots	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a84578e3c4	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e\identity = 486f6e756154656b2e436f6d6d6f6e2c2056657273696f6e3d312e302e302e312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d443246393745384333424645394538422c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690\Files\HonuaTek.Common.UI.Buttons.dll_6d92dc1c66b = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{60051b8f-4f12-400a-8e50-dd05ebd438d1}\samp..tion_b5c5fc146e5e6c = 3c004100700070006c00690063006100740069006f006e00540072007500730074002000760065007200730069006f006e003d002200310022000d000a00460075006c006c004e0061006d0065003d00220068007400740070003a002f002f0068006f006e0075006100740065006b002e0063006f006d002f0073006f006600740077006100720065002f00730061006d0070006c0069006e006700730074006100740073002d00760031002f0069006e007300740061006c006c002f00530061006d0070006c0069006e006700530074006100740073002e006100700070006c00690063006100740069006f006e002300530061006d0070006c0069006e006700530074006100740073002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0031002e0030002e003100300031002e0031002c002000430075006c0074007500720065003d0065006e002d00550053002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0062003500630035006600630031003400360065003500650036006300370064002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530061006d0070006c0069006e006700530074006100740073002e006500780065002c002000560065007200730069006f006e003d0031002e0030002e003100300031002e0031002c002000430075006c0074007500720065003d0065006e002d00550053002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0062003500630035006600630031003400360065003500650036006300370064002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e003300320022000d000a00540072007500730074006500640054006f00520075006e003d002200740072007500650022000d000a0050006500720073006900730074003d002200740072007500650022003e000d000a003c00440065006600610075006c0074004700720061006e0074003e000d000a003c0050006f006c00690063007900530074006100740065006d0065006e0074002000760065007200730069006f006e003d002200310022003e000d000a003c005000650072006d0069007300730069006f006e005300650074002000760065007200730069006f006e003d002200310022000d000a0063006c006100730073003d002200530079007300740065006d002e00530065006300750072006900740079002e004e0061006d00650064005000650072006d0069007300730069006f006e0053006500740022000d000a004e0061006d0065003d0022004c006f00630061006c0049006e007400720061006e006500740022000d000a004400650073006300720069007000740069006f006e003d002200440065006600610075006c0074002000720069006700680074007300200067006900760065006e00200074006f0020006100700070006c00690063006100740069006f006e00730020006f006e00200074006800650020006c006f00630061006c00200069006e007400720061006e006500740022000d000a0055006e0072006500730074007200690063007400650064003d002200740072007500650022000d000a00490044003d00220043007500730074006f006d0022000d000a00530061006d00650053006900740065003d002200730069007400650022000d000a0078006d006c006e0073003a00610073006d00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600310022000d000a0078006d006c006e0073003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a00610073006d00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600320022000d000a0078006d006c006e0073003a007800730069003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300031002f0058004d004c0053006300680065006d0061002d0069006e007300740061006e006300650022000d000a0078006d006c006e0073003a0063006f002e00760031003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600310022000d000a0078006d006c006e0073003a00610073006d00760033003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a00610073006d002e007600330022000d000a0078006d006c006e0073003a0064007300690067003d00220068007400740070003a002f002f007700770077002e00770033002e006f00720067002f0032003000300030002f00300039002f0078006d006c006400730069006700230022000d000a0078006d006c006e0073003a0063006f002e00760032003d002200750072006e003a0073006300680065006d00610073002d006d006900630072006f0073006f00660074002d0063006f006d003a0063006c00690063006b006f006e00630065002e007600320022003e000d000a003c0049005000650072006d0069007300730069006f006e00200063006c006100730073003d002200530079007300740065006d002e004e00650074002e005700650062005000650072006d0069007300730069006f006e002c002000530079007300740065006d002c002000560065007200730069006f006e003d0032002e0030002e0030002e0030002c002000430075006c0074007500720065003d006e00650075007400720061006c002c0020005000750062006c00690063004b006500790054006f006b0065006e003d00620037003700610035006300350036003100390033003400650030003800390022000d000a00760065007200730069006f006e003d002200310022003e000d000a003c0043006f006e006e006500630074004100630063006500730073003e000d000a003c0055005200490020007500720069003d002200280068007400740070007c006800740074007000730029003a002f002f0068006f006e0075006100740065006b005c002e0063006f006d002f002e002a0022002f003e000d000a003c002f0043006f006e006e006500630074004100630063006500730073003e000d000a003c002f0049005000650072006d0069007300730069006f006e003e000d000a003c002f005000650072006d0069007300730069006f006e005300650074003e000d000a003c002f0050006f006c00690063007900530074006100740065006d0065006e0074003e000d000a003c002f00440065006600610075006c0074004700720061006e0074003e000d000a003c004500780074007200610049006e0066006f00200044006100740061003d00220030003000300031003000300030003000300030004600460046004600460046004600460030003100300030003000300030003000300030003000300030003000300030003000430030003200300030003000300030003000350037003500330037003900370033003700340036003500360044003200450035003700360039003600450036003400360046003700370037003300320045003400360036004600370032003600440037003300320043003200300035003600360035003700320037003300360039003600460036004500330044003300340032004500330030003200450033003000320045003300300032004300320030003400330037003500360043003700340037003500370032003600350033004400360045003600350037003500370034003700320036003100360043003200430032003000350030003700350036003200360043003600390036003300340042003600350037003900350034003600460036004200360035003600450033004400360032003300370033003700360031003300350036003300330035003300360033003100330039003300330033003400360035003300300033003800330039003000350030003100300030003000300030003000330030003500330037003900370033003700340036003500360044003200450035003300360035003600330037003500370032003600390037003400370039003200450035003000360046003600430036003900360033003700390032004500340031003700300037003000360043003600390036003300360031003700340036003900360046003600450035003400370032003700350037003300370034003400350037003800370034003700320036003100340039003600450036003600360046003000310030003000300030003000300031003800370032003600350037003100370035003600350037003300370034003700330035003300360038003600350036004300360043003400390036004500370034003600350036003700370032003600310037003400360039003600460036004500300030003000310030003200300030003000300030003000300031003000420022002f003e000d000a003c002f004100700070006c00690063006100740069006f006e00540072007500730074003e000d000a000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371c = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\docu..nxml_31bf3856ad364e35_0002.0005_none_fb7067c463476e0a\Files	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690\SizeOfStronglyNamedComponent = d164000000000000	dfsvc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\OnlineAppQuotaUsageEstimate = "0"	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54\lock!080000005bfe590e281500001c1100000000000000000000 = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\Gc_samp..tion_b58d5a62daf863c8\LastRunVersion = 687474703a2f2f686f6e756174656b2e636f6d2f736f6674776172652f73616d706c696e6773746174732d76312f696e7374616c6c2f53616d706c696e6753746174732e6170706c69636174696f6e2353616d706c696e6753746174732e6170706c69636174696f6e2c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2f53616d706c696e6753746174732e6578652c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54\DigestValue = d5cfdbbccd36689563199b48284a3955fe3eebaf	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a84578e3c4\Files\HonuaTek.Common.Logging.Controls.dll_31d71 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a84578e3c4\lock!060000005bfe590e281500001c1100000000000000000000 = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e\DigestMethod = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\lock!250000009afe590e281500001c11000000000000000000008435d = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Installations	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41\lock!160000007bfe590e281500001c110000000000000000000 = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\samp..tion_b5c5fc146e5e6c = 32003000320036002f00300037002f00320032002000310038003a00330030003a00300037000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e\Files\Common.dll_a10feb275bad8d0b = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tion_b5c5fc146e5e6c7d_0001.0000_en-us_6c5b98413c10e982\lock!04000000fafb590ec8150000b0060000000000000000000 = 30303030313563382c30316464316130376639303862343866	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_samp..tion_b5c5fc146e5e6c7d_b2265a21ea6b6992	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41\Applications\samp..tion_b5c5fc146e5e6c7d_0001.0 = 687474703a2f2f686f6e756174656b2e636f6d2f736f6674776172652f73616d706c696e6773746174732d76312f696e7374616c6c2f53616d706c696e6753746174732e6170706c69636174696f6e2353616d706c696e6753746174732e6170706c69636174696f6e2c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2f53616d706c696e6753746174732e6578652c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41\DigestValue = d73abead500bdcd47c5ecf73163571dbe2fdd52a	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e\identity = 486f6e756154656b2e436f6d6d6f6e2c2056657273696f6e3d312e302e302e312c2043756c747572653d6e65757472616c2c205075626c69634b6579546f6b656e3d443246393745384333424645394538422c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a845	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\Families\F_samp..tion_b5c5fc146e5e6c7d_b2265a21ea6b6992	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Visibility\samp..tion_b5c5fc146e5e6c7d_0001.0000_en-us_6c5b98413c10e982	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\samp..tion_b5c5fc146e5e6c = 68007400740070003a002f002f0068006f006e0075006100740065006b002e0063006f006d002f0073006f006600740077006100720065002f00730061006d0070006c0069006e006700730074006100740073002d00760031002f0069006e007300740061006c006c002f00530061006d0070006c0069006e006700530074006100740073002e006100700070006c00690063006100740069006f006e002300530061006d0070006c0069006e006700530074006100740073002e006100700070006c00690063006100740069006f006e002c002000560065007200730069006f006e003d0031002e0030002e003100300031002e0031002c002000430075006c0074007500720065003d0065006e002d00550053002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0062003500630035006600630031003400360065003500650036006300370064002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002f00530061006d0070006c0069006e006700530074006100740073002e006500780065002c002000560065007200730069006f006e003d0031002e0030002e003100300031002e0031002c002000430075006c0074007500720065003d0065006e002d00550053002c0020005000750062006c00690063004b006500790054006f006b0065006e003d0062003500630035006600630031003400360065003500650036006300370064002c002000700072006f0063006500730073006f0072004100720063006800690074006500630074007500720065003d006d00730069006c002c00200074007900700065003d00770069006e00330032000000	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tion_b5c5fc146e5e6c7d_0001.0000_en-us_6c5b98413c10e982	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c\lock!1e0000007bfe590e281500001c1100000000000000000000 = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e\Transform = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c\SizeOfStronglyNamedComponent = 9e3f000000000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\appid = 687474703a2f2f686f6e756174656b2e636f6d2f736f6674776172652f73616d706c696e6773746174732d76312f696e7374616c6c2f53616d706c696e6753746174732e6170706c69636174696f6e2353616d706c696e6753746174732e6170706c69636174696f6e2c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2f53616d706c696e6753746174732e6578652c2056657273696f6e3d312e302e3130312e312c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c2c20747970653d77696e3332	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\docu..nxml_31bf3856ad364e35_0002.0005_none_fb7067c463476e0a\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\docu..nxml_31bf3856ad364e35_0002.0005_none_fb7067c463476e0a\lock!100000005bfe590e281500001c1100000000000000000000 = 30303030313532382c30316464316130383166396664656130	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41	SamplingStats.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\ComponentStore_RandomString = "08LM93BXK9BNER82N0APK4QV"	dfsvc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager\StateStore_RandomString = "5MRAYJHNKJLHYEOZDJGRR02K"	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\samp..tion_b5c5fc146e5e6c = 68007400740070003a002f002f0068006f006e0075006100740065006b002e0063006f006d002f0073006f006600740077006100720065002f00730061006d0070006c0069006e006700730074006100740073002d00760031002f0069006e007300740061006c006c002f004100700070006c00690063006100740069006f006e00250032003000460069006c00650073002f00530061006d0070006c0069006e006700530074006100740073005f0031005f0030005f003100300031005f0031002f00530061006d0070006c0069006e006700530074006100740073002e006500780065002e006d0061006e00690066006500730074000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\samp..tion_b5c5fc146e5e6c = 54007200750065000000	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690\Transform = 01	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54	SamplingStats.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c\DigestMethod = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\PackageMetadata\{2ec93463-b0c3-45e1-8364-327e96aea856}_{3f471841-eef2-47d6-89c0-d028f03a4ad5}\samp..tion_b5c5fc146e5e6c = 53616d706c696e6753746174732e6170706c69636174696f6e2c2043756c747572653d656e2d55532c205075626c69634b6579546f6b656e3d623563356663313436653565366337642c2070726f636573736f724172636869746563747572653d6d73696c	dfsvc.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Marks\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54\Files\SamplingStats.exe_f21fc6d398f3c124 = 01	dfsvc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\Components\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e\SizeOfStronglyNamedComponent = 26a40b0000000000	dfsvc.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54\SamplingStats.exe\:Zone.Identifier:$DATA	dfsvc.exe
File created	C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe:Zone.Identifier	dfsvc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5576	dfsvc.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4460 wrote to memory of 5576	4460	setup.exe	89
PID 5576 wrote to memory of 5416	5576	dfsvc.exe	91

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  - Downloads MZ/PE file
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5576
- - C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\SamplingStats.exe
    "C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\samp..tion_b5c5fc146e5e6c7d_0001.0000_cd919601e3887deb\SamplingStats.exe"
    3⤵
    - Executes dropped EXE
    - Modifies registry class
    PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\common_d2f97e8c3bfe9e8b_0001.0000_none_c34ebcdf20d39c6e.cdf-ms
Size 2KB
SHA256 931829456ed70410a7174cc40e4eb1eeca6d37fa1b4d51a27d41641de330e341
MD5 511afb6154a216c6cbc14c6aba335945
SHA1 d11879c71bef542916dc8638012fa2f51e48eacc
SHA512 9d3a7a69a03c152e39551986d74cb8e939d9d5b14941bdf17824e6a87e1a1500cbfb320fee92c559f9b89120187fd9f10b8959c7d9c966bd7022899c362a0998
TLSH
T1B451AA017280DA53C5AD4633ACD6D6ED72767E83EF43430B30D4BB2F3A322995602225
MD5 SHA1 SHA512 TLSH

Submit Download

docu..nxml_31bf3856ad364e35_0002.0005_none_fb7067c463476e0a.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\docu..nxml_31bf3856ad364e35_0002.0005_none_fb7067c463476e0a.cdf-ms
Size 3KB
SHA256 dd2354ea8df2779d164bdc3d016307111869ed3931bccf968dbdeeb8b6eeddd7
MD5 b48d3e96a00b97a188a2361ca0ef2b12
SHA1 5c8ed97b3fa677682bef9727c74917d2b765a961
SHA512 38f3879bbde0277ef963202882c15b3d3bb41d441f13100436fe6ac512aa164463ac7d087dfea1a01d1b59522538bfd8b087c18c0ac27253bc619f7f02250d0f
TLSH
T13781FE027340CE53D9BA06736CA9C2DE67A97DC3DE425707B4C87F2F79329A56501354
MD5 SHA1 SHA512 TLSH

Submit Download

honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\honu..ging_d2f97e8c3bfe9e8b_0001.0000_none_249864371cfdf62c.cdf-ms
Size 2KB
SHA256 90fb0f9e700d20aab30f9ef65fe901ee356942df0fb525d78c9067bbe83cd385
MD5 dfa4cac697b7477dec59f027d7ede5d6
SHA1 01bad2c507f9e063f1b49868e0f2e759a6f0e799
SHA512 d80688913e8f22e2305f7089c2dcc41396d86a75eee0ec99e646285541659d7f5cacc4a8c88e8a687e9c5b3373b4562826e4497dd1266cab47a82a7ef4ce043a
TLSH
T155519745B680DA57D16A4673ACE6C7D973B67E83DF06470B70D0BB2F3A326EA4502062
MD5 SHA1 SHA512 TLSH

Submit Download

honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\honu..mmon_d2f97e8c3bfe9e8b_0001.0000_none_289a89619f08451e.cdf-ms
Size 6KB
SHA256 6340dc028081b5c10c3ef3cf37c8958bbdd8c63e55ed68052386c17739cf8bd9
MD5 3f37204c8063506a2e3369402fb984d1
SHA1 c655cfb4430486e4e05a06f2b0103f14a6ab2982
SHA512 e71eac9f749f17d8ebedffe395cf6d6b491c6bbb8c025c395a70868c9d5addbc8d460a33970cd930ebd1f85f14a2569afed0b085157e19c5a505dc67854222de
SSDEEP 96:hu//AeV+Wwml+/Rlh15GqNzcthdAKCkvOm2RK6Ge/j1N/P0PgQbJx4:qJy3hesEpO/RN/Mc
TLSH
T132E18602B240DE57C4785672ACA9C7ED73A87E86DE434B0B70C8FF5F3B326A62512151
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a84578e3c4.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\honu..rols_d2f97e8c3bfe9e8b_0001.0000_none_402134a84578e3c4.cdf-ms
Size 4KB
SHA256 9ef70fc6d684253a0bdfadfcb8e40fc9cb9ffd75498740bf699b944359d0f98c
MD5 9fa5e990bf3e5faf1dfce72b83eabdae
SHA1 f7f41b4eff4614b1267d9960efda707c58a025c4
SHA512 d6ac14120cb27f18ce0f0a8517b7b9b32e1854aaeee859d614824f60b658e749815707ea97f7486b53a16337a8eb899703e024b9371b05a022d795ff3b5d7f90
SSDEEP 48:cyKqD4JxFoEQgFQe6S+9owe7gBYQpSWGKCuBuDuA5fFFkV0cgHolaUf:cO46eV+Wwe07PuDuudFkV0TuaUf
TLSH
T1E1910146B290DD2BD4A94273ACD5CBED676A7D83CE024F4B30C4BF5F3A321D61612101
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\honu..tons_d2f97e8c3bfe9e8b_0001.0000_none_eddfdce20cbb1690.cdf-ms
Size 3KB
SHA256 e0371da1041f17496be9a1ffd72f64775a0f93ec0fe99c555668411b9eec190f
MD5 c1163f691af68c3061a0a1fd49adf601
SHA1 8336649dbdf34ad18488cf2c9873c58eaa6a9fbf
SHA512 35a9077b48f4745fcee93c194b521fa91f6d67fbaa9d124a9bd2abce62599fb9ea9dd47dd1c102ca34e69c17961cd42709ca59a5cce25cc4795aac6a9fb82b0e
TLSH
T1A88154417300CE57E87A0BB26CA5C3CEA3A97D83CE024747B4C47FAF7A762666521359
MD5 SHA1 SHA512 TLSH

Submit Download

samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\samp...exe_b5c5fc146e5e6c7d_0001.0000_en-us_d30ced3e6cdc3c41.cdf-ms
Size 29KB
SHA256 829bae55948625f9fbecbb4e2ec496cdc7a5060a09d88b17cdeec5203441bc4d
MD5 7ae17d24d3faf387d6ecc5a0c836966a
SHA1 ea43f654e3015b476bf58affad48d69430f03013
SHA512 a5561939b26ad08968e24387f46654280c39717e5578716af3b93580a7166b73e439e6687fcc7275d1c6d2ebb88d4104f86884911332da29a06e45cbb3673915
SSDEEP 384:3wMP+7MRFMTWqkuEf5AdsdYhX71hHluOiLWs79s8J9:jJOKruE6sdMX7p7BsRz9
TLSH
T19ED2C545BBD0D92BD2028633DCEADBE03276FE858E93575B30017B5EA9307C99C23599
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\samp..tats_d2f97e8c3bfe9e8b_0001.0000_none_73581f2a7e941f54.cdf-ms
Size 9KB
SHA256 56aac89bdc14a26886a7177592da9339f1aaf0c2a0f5296d7bbf8a049c67fed8
MD5 76107e77c2419af1165c4f27578a430e
SHA1 af5a474804b893361910095ef9b98ae1ba406c93
SHA512 67bf276b95bec6d6e14f8af165ad09304e5f456c9e1520c17352a6b4db313ebfeaba2721209d15706159fb05555920c4ceb830b683795e49507535f301d23ddf
SSDEEP 96:DtrmzEsHxGHeV+Ww8PhuM+cELubHkko2oQzj6kpFsEerE8D4ykdqI:Riz5kgJhuMpE8chU6Anew8D4
TLSH
T1C21275027291DD97D4A85A73AC9AC7ED63AA7E83DE43474B71C0FF4F36726EA1212041
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

samp..tion_b5c5fc146e5e6c7d_0001.0000_en-us_6c5b98413c10e982.cdf-ms

Path C:\Users\Admin\AppData\Local\Apps\2.0\08LM93BX.K9B\NER82N0A.PK4\manifests\samp..tion_b5c5fc146e5e6c7d_0001.0000_en-us_6c5b98413c10e982.cdf-ms
Size 19KB
SHA256 71f9667191253ca01539581851c46517f701e4f38ae409f48a331e1ad99e1217
MD5 7a2359714a54b02bc2f75664de8951f9
SHA1 ae7574e968203b1026ab3e16d6c5df5ea32fa85f
SHA512 d249daff83671353f3f949a6b85fba9a670b8df89cdda2228dec20d14c0e85e62f2ec65e625b8d674f1cb4909d059d9a1fa68762d900b6120b17dd17bb201a82
SSDEEP 384:072AplqkuEf5AdsdIYFVspNeeMbUFdVRHra1KlTyBKGZBcR:ajlruE6sdIYFK0eUUFdVRD2BHzcR
TLSH
T137924A8AFB10E507D52BAB71DCE7E3820A64BE421DD0805774C4776D897694EAC137CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RRQLV2DQ.N34.application

Path C:\Users\Admin\AppData\Local\Temp\Deployment\8YMMVYT4.14D\RRQLV2DQ.N34.application
Size 16KB
SHA256 ec9fea5f99cd861c9fffb0328a9070cadb49e3739d461e3a27a02f4219b7e729
MD5 4d25ab780500a407fb3828d8fb272954
SHA1 fe79a8c99ce68810507ab2cef78e2e317d06da75
SHA512 94395a68bd6e848878122b6102b891a712bdc49ec71e3da6653c1c244c08b33b6192e59eb9080c03fc17465f9f029c5aeb98a1c1fc2a7eeac6129566a5a54902
SSDEEP 384:HgoOqkuEfHAdsdSYFVspNeeMbUFdVRHra1KlTi:AoOruEosdSYFK0eUUFdVRDm
TLSH
T1ED725C5EC9C4B806B217DA60FED3A14318546B6398EC44A27CD8685FDB0AED9E4433DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

S2v2-48x48.ico

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\Assets\Resources\S2v2-48x48.ico
Size 1KB
SHA256 25bf9edfff6e91bb5056757b931c8dac7a05858956fa5d4cc2f89c2974883142
MD5 ddddf3ef0db8bfe07c50b781bb0caae4
SHA1 650231591f342bb520df8cf76e73fcdfc3782c68
SHA512 006ec426338d3cc370c35604f92a33540f61d1b3956b967b20753f0714c6c284287343bc268b1a312576dd3f9b603b30c9727de368719c849185158011530283
TLSH
T1F331A911B25EE959E19840B1CC83C5EC2B54CD76CE904D0B36D3774E77723C99E881E8
MD5 SHA1 SHA512 TLSH

Submit Download

Common.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\Common.dll
Size 5KB
SHA256 0ccbe532e63390b9bd3434ecc8c9cc4d816a045237a6beafba7c487c3f487079
MD5 a381e5f6c876ccfa147ff90b5dffd208
SHA1 34fd6095beab720fac12e069ecd616d989e1c22e
SHA512 ae7ba74c74864949864d407ac435d8344246744de5fec57f24f809ff74e466ae1e875a3395168ce047bd7813d02bcfe56ddbb7dce4e61543656bc92964159fbc
SSDEEP 48:6j00VjniHuUBWuJUQeKo6icMApyZquwl1whXo3hF:j0VjniORYo6pMAUcS
TLSH
T152B1861563DC4337DCBB4BB6A8B3535211B8F710CEA7A76E54CA420A5C5B7280E22B31
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Common.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\Common.dll.genman
Size 824B
SHA256 366bef327bb006b6c2a123e2acf16ea41438a0aacaeee0a54e7e5a9ad7b403e9
MD5 1b172fa40f188000aad07607d266a092
SHA1 0a83489d1fc150ba2db0deb3ad6b3b313c1285f4
SHA512 7ede276127a01f8a563d9d48a54ab358f61751dd02c3d6a5cca157ec2b172c751133c459001301ad7379155de5726e29361b47ef1d75ab867f9454b9f4386237
TLSH
T1F801890081C8F92A1B3341E1BEEBE461535E232718CD098AB0B96C9F9B0AED68647073
MD5 SHA1 SHA512 TLSH

Submit Download

DocumentFormat.OpenXml.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\DocumentFormat.OpenXml.dll
Size 5.5MB
SHA256 40f293a772b3017814557bfb6ffd0077c7b81dc4fdc1caa7498db64c38dcc25f
MD5 8bf2d98eb3cea4e624fbff8e6aec7c8f
SHA1 8604a515b29a6db99230e5d72e6ef0924afbbfec
SHA512 8ca3882076d50c24926a179ff87c5708040a46aee33b5edad392bef9d357bf803837f47fa6c73178ebf9c0ac189dad79ce777fb76170e8cb91818eae458540ae
SSDEEP 98304:IB0KAzH2oNrN7NjNwOsO7mUdh5Ga7hNePb01LBH:fzWh0BH
TLSH
T18F46E5457B98BF2AEF5D8572E475A7A15F60E01D3784A3D34B34D839BC2BB8089123B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DocumentFormat.OpenXml.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\DocumentFormat.OpenXml.dll.genman
Size 1KB
SHA256 529e7c6d493e7ed441cef470d8da5ca7ddb318b966817b3f48a61d4bd97e636f
MD5 577b0151103315e105ddcfe0c6085e98
SHA1 50b3c758c43ffb32abb2d7e0a8ef44c39e0d2309
SHA512 ee555612f8f2647a9c8bbd8080283c8f179f04caf1f0e065ec8965ef6625cd32a770e89d29acf0d787912322267e92c7c78191536c685507a071f0b08248cff6
TLSH
T1A021360180C8FA260B3306D1BEEBE430874E473718CE1E47B4A9699FCB2DE964647177
MD5 SHA1 SHA512 TLSH

Submit Download

HonuaTek.Common.Logging.Controls.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.Logging.Controls.dll
Size 12KB
SHA256 fe5da518711b98679716b99cd1862d7d153c814ea56d211a8a01f1a653b98b09
MD5 987a52bb6b098ce926e7f4334c0322de
SHA1 3ec6c4d4ea3953776d7b824f2925e3ec145c3005
SHA512 0a14630fa9db2a9cee3c49dbe965f33a19cabdf2e984440bdf7e7e1e1b3a1e8fb113b790b4de8df07f907a3f619f6479c049bf515aa3d09a66a5c85c708e5733
SSDEEP 384:hLExroZjX8WxrHVqrAC724WBWPYvDSYdKE0n/:hrD8uAAq2zSYdP0n/
TLSH
T12C42F96967BC2379DD230B7658A7864127BCFF45D945DF0F2812A41C98E62138B32BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HonuaTek.Common.Logging.Controls.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.Logging.Controls.dll.genman
Size 1KB
SHA256 38a12477596cc4576fbb709257d7fb00ef0aa2389e78c7add7a36b4f78ae5430
MD5 e65ef3b713a1d4ee58a0c03c8a5749fc
SHA1 4f5c4e506fec25f568d61aec8ce756474846c800
SHA512 22d3ddec24fd2085abe104af8e9b3db7170b58e998457e3e23d45a7e79850c02ad98c5c0b14f41d995dd8c969969fcc3b59a7db6dc9896c73d5966257927e49e
TLSH
T15E31F70580C4FA760B3346E1BEEBE830D79E5723198E1D477069A99F8B2DAA74747037
MD5 SHA1 SHA512 TLSH

Submit Download

HonuaTek.Common.Logging.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.Logging.dll
Size 12KB
SHA256 ff770e892c58a7933ab801716a4cd0acfb2cf0268128b4d104407ada92f75cf5
MD5 830344404a54fc003de1ef49988dfa4f
SHA1 e6c256f3f560c4cd454503ec345fcd38b2b12cf0
SHA512 20059d76de843eedfb45887804e3e3b98ee1e980f2a3fce6882e19e26be1fd33c6cbd89625cfbfbbbf300b5aeeb7bd053f1151ab232f014f0e4aa8b679109f6b
SSDEEP 192:lloK5kf4rFBnjeNpeqmrpaj40dkYx6Byz:PeqFBnjepeqmrpMPdk08I
TLSH
T1B642E985E7FC0A59ECBD9F79E8B203012776F701CD22DA0E09C8529E2C63354D521BA7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HonuaTek.Common.Logging.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.Logging.dll.genman
Size 1KB
SHA256 93233d5cb780cd37b8c32e1e75913fd80b7095272ee40b19a21ad3cc7dbc0afc
MD5 cb9053dcc085835298dff78a0601c318
SHA1 1309569ec8ef3ce2427b19a763a41cd8e52e2bef
SHA512 c86ff636054b730017f33ff08bd1ffbd4712643f5ba745ef1488a8d4992b96d14e9d01a96994c09c4c5575df7923dab2d828f9b48e86d44afc086c8b3cc78615
TLSH
T1CA119E0180C4FA2A1F3346D1BEE7E421935D572304CD094A74A9685F8B2DAE64603073
MD5 SHA1 SHA512 TLSH

Submit Download

HonuaTek.Common.UI.Buttons.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.UI.Buttons.dll
Size 20KB
SHA256 66fe55400e2b5658b690909b8c2f380ad648e3d49e136ccc7d604a794b7d9412
MD5 82e259e0bab80a54f3394150f0695a42
SHA1 da1bf97090d67b76a843fcf5d075ca293ecd75f9
SHA512 b221fce375897e914f79f185a931831ca36bd58159e354d618aa0fabf5e4e83c9922f65f67a2536b6b836feb00a6f95ae9bfd4310ff1c33d04a7c9dcbf63cf17
SSDEEP 384:cUk6+ocIEhxrw3vdNf7fO/3+Z9pHGOXWtn+rppftFdG31y:fv6/3sGOX0Upt61y
TLSH
T19C92EBA4A21C0734EF5FDFF8AC63800C032CA514F87ED639391B155CE4E629747A6B66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HonuaTek.Common.UI.Buttons.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.UI.Buttons.dll.genman
Size 1KB
SHA256 2243d2660dadb32c507af161ded29fb8de2a45f11e22bf1749377e9a28feeee0
MD5 4f5e920ed58d30281905ce0714c17367
SHA1 e2e9e79d43f5b26f4ef09fb7fb2fdc74eba34f4b
SHA512 48ce67faedf005a96f11473c3f71a8152e0b6b96c09b4f38f4632e98cf9fc705ac2702de4e62fd5f35309bb768db497bc86baf81808a6db6cb0f1b72859c67ad
TLSH
T19C213A0580C4FA650B3349E2BEEBE430C79E4333198E1E47B069A99F9B2DA974647037
MD5 SHA1 SHA512 TLSH

Submit Download

HonuaTek.Common.dll

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.dll
Size 735KB
SHA256 3a40b0bc5cae1f1e26f4bff10578dd321ee22fde022237ddd60ee9188d39ed77
MD5 f7730ee2d58a660739ba8c63acfb150e
SHA1 030282c90ab3c05c838530501df73f5d9f8f8845
SHA512 2437a85d184d2924816d39c32fc3ffbbe88e2f8278544a7c6b9aa4e85a6770c34be1fc79e0ab7373d58f28b604eb03bc025ca4221c4034118ad92e83db241d3e
SSDEEP 6144:WsnRP4XOGq0pNO0YjGWefeR7zT+cLuMCgfth61drMBYm1:zHGq0pOPFfq1drMBx
TLSH
T180F44C0943FCC258E67F4778D435884473FDB907E68AE71F6192A89C2CEAB628944773
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HonuaTek.Common.dll.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\HonuaTek.Common.dll.genman
Size 2KB
SHA256 b296f963a0a5274cd655d2e732f5bafa2d8d2aec2c4e14313207ff96c7237fb5
MD5 b6ea4ba557f65b7ed25147345ebc7b62
SHA1 e7fc993ceb193ef27142c47f2dd89a4afd92ec2e
SHA512 b72e4a0349fcfa86ea073c6c043e407dee60b1179be8bcd049d67f4a82b0e7fe796404eb94698137be2a2524bb938cf97ffa6f43a2e54a13b33264814961ebe1
TLSH
T1D451950680C4FA650B3306D1BEEBE470D78E5723598E1E47B069A99B8F2DA96474B037
MD5 SHA1 SHA512 TLSH

Submit Download

SamplingStats.exe

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe
Size 1.5MB
SHA256 5849493afc6f5929af31b4222dc77c9767a42fb767244bc41c7a0ea22a294265
MD5 7067303a90a490aeff557288ac55e25c
SHA1 d5cfdbbccd36689563199b48284a3955fe3eebaf
SHA512 8d6b77840f38a7b77f4c3eba18739129f04875b805abee4ce81e6c2d2d64437fadeb52d4aee40dd9385ba0431edf14a1da31048787035cba36727a022299ab79
SSDEEP 49152:0Xnnp2cOmcuS98mQbXAkgjRQwkRx0OuB+YZ1+6ZSY0LnYVFBYkFneL8r+04rfYD7:kUGHG
TLSH
T16C759D1872A85604D93E57B9E47EC11467BC2C07BD9ECB0E3563BA8D2DF2393894A353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SamplingStats.exe.config

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe.config
Size 167B
SHA256 7d9cb382e601cfdbdfac46341b7e84fbe3ae6e40e1634e8bba4ed385d0e0f428
MD5 87e4fdd106d71ec796e94c3b0ef5fe0d
SHA1 e119d2d76850064eb4c9a7c64053fefc32a030a4
SHA512 f26d60d3580bae6b55f4cf5456112373e3754bd5cf91e0ebf03cdce81bb9f46c4f50c93842fff5dd80854a1eb5f26fae6ea11cb7c9c0f7eda07f6888e832341e
TLSH
T192C04C5985ACBD2A9C334F5366408953FFB04392A064110CF05FB7570B3155D465736A
MD5 SHA1 SHA512 TLSH

Submit Download

SamplingStats.exe.genman

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe.genman
Size 3KB
SHA256 eea72828246dcdec28e7a98a187c2c9ba49b1f672f5f299f644a7a1ee4d9b4b1
MD5 129cdd2cd4a8662fd05c4c9ad71a129f
SHA1 3522fea9718a028f1ac5587e413b93cfb0857e2b
SHA512 7445c2f1fdbae8a658b35a5c4b4b2835238d68e7b356f932c9d01156aaf830902003a369fcd9448195cbffdc6e168894cfbffa03b21fb8a88dc1930c8dcf5870
TLSH
T1E571930680C4EB650F3706D1BEEBE470C78E5723558E1E47B059AA8F8F2DAA6474B027
MD5 SHA1 SHA512 TLSH

Submit Download

SamplingStats.exe.manifest

Path C:\Users\Admin\AppData\Local\Temp\Deployment\EHBA9ZKG.WYK\JV0EEGOJ.VEW\SamplingStats.exe.manifest
Size 23KB
SHA256 507c862d193e4ec45dd441b4a6b8332b7994ce2f5bb00ceee45a0251559a5d2a
MD5 99840fb29116ba36a4f6734d435a74eb
SHA1 d73abead500bdcd47c5ecf73163571dbe2fdd52a
SHA512 44314df59f1681067df4b1faebed2a25082025d57018645672ac8e6e3954e6c0553065591c15cd825862a9068e15f99b210f58c8f311d22c3272c8bf472fabbb
SSDEEP 384:vU05tIeJ+3NeBbUCciivF6JPfOqkuEfHAdsdChX71hHluOiR:vU05tIeUvc9OruEosdSX7p7y
TLSH
T1AAB24A9AC8C07D215337C1D0BEE39A12AE053B2345ED40DA7C8D299BDF69A48C6931F7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5416-342-0x000000001FE00000-0x000000001FE08000-memory.dmp

Download

memory/5416-344-0x000000001F850000-0x000000001F85E000-memory.dmp

Download

memory/5416-343-0x000000001F880000-0x000000001F8BE000-memory.dmp

Download

memory/5416-339-0x0000000000190000-0x000000000031C000-memory.dmp

Download

memory/5416-341-0x000000001CE90000-0x000000001CE98000-memory.dmp

Download

memory/5576-16-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-91-0x000001F266BE0000-0x000001F266BEA000-memory.dmp

Download

memory/5576-84-0x000001F27F920000-0x000001F27F9DE000-memory.dmp

Download

memory/5576-78-0x000001F27FFB0000-0x000001F28013C000-memory.dmp

Download

memory/5576-73-0x000001F266BE0000-0x000001F266BEC000-memory.dmp

Download

memory/5576-66-0x000001F2803B0000-0x000001F280940000-memory.dmp

Download

memory/5576-61-0x000001F266BE0000-0x000001F266BEA000-memory.dmp

Download

memory/5576-55-0x000001F266BE0000-0x000001F266BE8000-memory.dmp

Download

memory/5576-38-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-20-0x000001F27F470000-0x000001F27F4C0000-memory.dmp

Download

memory/5576-17-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-4-0x00007FFEF6B8F000-0x00007FFEF6B90000-memory.dmp

Download

memory/5576-15-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-14-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-13-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-12-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-11-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-10-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-9-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-8-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-6-0x00007FFEF6A00000-0x00007FFEF73A4000-memory.dmp

Download

memory/5576-5-0x000001F27F560000-0x000001F27F6E8000-memory.dmp

Download

memory/5576-3-0x000001F264DF0000-0x000001F264DF8000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads