2 process(es) observed

Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean.

No operations match your filter.

Hash lookups only - the sample itself is never uploaded to any third party.

The analysis of the sample indicates that it was successfully executed within the sandbox environment. The following behaviors were observed, which can be categorized into various stages of the kill chain: 1. **Initial Access**: The sample appears to have been executed successfully, but specific details regarding the method of initial access are not provided in the analysis data. 2. **Execution**: The sample executed under the process `dfsvc.exe`, which is part of the Windows Deployment Services. This process was responsible for creating multiple directories and files within the user's AppData and Temp directories, indicating that the sample was actively performing operations. 3. **Persistence**: The sample created registry keys related to deployment and tracing, suggesting an attempt to establish persistence. Specifically, it created keys under `Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide`, which could be used to maintain its presence on the system. 4. **Defense Evasion**: The sample demonstrated potential defense evasion techniques by modifying registry values related to tracing and logging, specifically disabling console and file tracing for the `dfsvc` process. This could hinder detection by security monitoring tools. 5. **Command and Control (C2)**: The analysis includes several indicators of potential C2 communication, such as URLs and IP addresses associated with `digicert.com`. These may indicate attempts to connect to external servers, although no direct evidence of successful communication was observed during the analysis. 6. **Impact**: The impact of the sample is not explicitly detailed in the analysis. However, the creation of files and registry modifications suggests that it may have been designed to perform further actions or maintain a foothold on the system. In summary, the sample exhibited behaviors consistent with a potentially malicious application, including file and registry modifications indicative of persistence and defense evasion. The presence of C2 indicators further suggests that it may have been designed to communicate with external servers. The overall verdict is that the sample demonstrates malicious capabilities, warranting further investigation.

The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

title: Auto-generated registry behavior rule (sandbox scan 2379)
id: sandbox-auto-2379-reg
status: experimental
description: Auto-generated from sandbox scan 2379
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\SystemCertificates\TrustedPublisher'
            - '\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0'
            - '\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000_Classes'
            - '\REGISTRY\USER\S-1-5-21-3020052414-521178761-3546482252-1000_Classes\Software\Microsoft\Windows\CurrentVersion\Deployment\SideBySide\2.0\StateManager'
            - 'Software\Microsoft\Tracing'
            - 'Software\Microsoft\Tracing\dfsvc_RASAPI32'
            - 'Software\Microsoft\Tracing\dfsvc_RASMANCS'
            - 'SOFTWARE\Policies\Microsoft\Windows\TenantRestrictions\Payload'
    condition: selection
level: medium

alert ip any any -> 192.159.99.221 any (msg:"sandbox auto scan 2379 C2 IP 192.159.99.221"; sid:15977152; rev:1;)
alert http any any -> any any (msg:"sandbox auto scan 2379 C2 URL"; http.uri; content:"/Bin/ScreenConnect.Client.application?h=192.159.99.221&p=8041&k=BgIAAACkAABSU0ExAAgAAAEAAQCdHAZwdFs5izzPrR71vPKZVSvJA16Y"; sid:15977153; rev:1;)

rule auto_file_2379_yara
{
    meta:
        description = "Auto-generated from scan 2379"
        author = "sandbox auto-generator"
        imphash = "c2fe6927e1db8cf00400dbef9e5d35be"
        anchors = "5 independent regions"
    strings:
        $s0 = "C:\\builds\\cc\\cwcontrol\\Product\\ClickOnceRunner\\Release\\ClickOnceRunner.pdb" ascii fullword
        $s1 = "GetFileInformationByHandleEx" ascii fullword
        $s2 = "InitializeCriticalSectionEx" ascii fullword
        $s3 = "SystemFunction036" ascii fullword
        $s4 = "ShOpenVerbApplicationW" ascii fullword
    condition:
        uint16(0) == 0x5a4d and filesize < 1250112 and all of them
}

The report downloads - PCAP and the SIEM/TIP exports - are a paid-plan feature. Sign in with a paid plan to export this report.

An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).