Analysis
-
max time kernel
64s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 21:13
Static task
static1
Behavioral task
behavioral1
Sample
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
Resource
win10v2004-20220812-en
General
-
Target
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe
-
Size
42KB
-
MD5
43045aaeb2c5c2f821a4dd27514498f8
-
SHA1
4342bf5e5fc36e0727da72d13a2748dd3e208a93
-
SHA256
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
-
SHA512
62ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
-
SSDEEP
768:1qVXHWSJvoqzewxRha5ONYHPHAqqoecDyhKJE4OVR7NB6DyT6t1zzzzJrzzzzzg0:QV3WSNoqtSHPH4o3DyAO3JBAyTizzzz3
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
WinHelp32.exepid process 1608 WinHelp32.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1532 cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exepid process 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe -
Drops file in System32 directory 3 IoCs
Processes:
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exeWinHelp32.exedescription ioc process File created C:\Windows\SysWOW64\WinHelp32.exe c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe File opened for modification C:\Windows\SysWOW64\WinHelp32.exe c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe File created C:\Windows\SysWOW64\WinHelp32.exe WinHelp32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exeWinHelp32.exedescription pid process Token: SeIncBasePriorityPrivilege 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe Token: SeIncBasePriorityPrivilege 1608 WinHelp32.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exeWinHelp32.exedescription pid process target process PID 1880 wrote to memory of 1608 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe WinHelp32.exe PID 1880 wrote to memory of 1608 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe WinHelp32.exe PID 1880 wrote to memory of 1608 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe WinHelp32.exe PID 1880 wrote to memory of 1608 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe WinHelp32.exe PID 1880 wrote to memory of 1532 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe cmd.exe PID 1880 wrote to memory of 1532 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe cmd.exe PID 1880 wrote to memory of 1532 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe cmd.exe PID 1880 wrote to memory of 1532 1880 c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe cmd.exe PID 1608 wrote to memory of 1644 1608 WinHelp32.exe cmd.exe PID 1608 wrote to memory of 1644 1608 WinHelp32.exe cmd.exe PID 1608 wrote to memory of 1644 1608 WinHelp32.exe cmd.exe PID 1608 wrote to memory of 1644 1608 WinHelp32.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe"C:\Users\Admin\AppData\Local\Temp\c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\WinHelp32.exe"C:\Windows\system32\WinHelp32.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Windows\SysWOW64\WINHEL~1.EXE > nul3⤵PID:1644
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\C2DDC4~1.EXE > nul2⤵
- Deletes itself
PID:1532
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\WinHelp32.exeFilesize
42KB
MD543045aaeb2c5c2f821a4dd27514498f8
SHA14342bf5e5fc36e0727da72d13a2748dd3e208a93
SHA256c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
SHA51262ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
-
C:\Windows\SysWOW64\WinHelp32.exeFilesize
42KB
MD543045aaeb2c5c2f821a4dd27514498f8
SHA14342bf5e5fc36e0727da72d13a2748dd3e208a93
SHA256c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
SHA51262ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
-
\Windows\SysWOW64\WinHelp32.exeFilesize
42KB
MD543045aaeb2c5c2f821a4dd27514498f8
SHA14342bf5e5fc36e0727da72d13a2748dd3e208a93
SHA256c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
SHA51262ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
-
\Windows\SysWOW64\WinHelp32.exeFilesize
42KB
MD543045aaeb2c5c2f821a4dd27514498f8
SHA14342bf5e5fc36e0727da72d13a2748dd3e208a93
SHA256c2ddc4692c36691169e00b533593275632924ede9abc2dec72080c7872aad384
SHA51262ff3a719fb25c167a4cc7af77b19409e11d8dcc3c2cf1e78ce9e81a81cde39c822475dc75ed37f85a3752141d85150c4c0d32d88890f369b3c8aee436a5199e
-
memory/1532-61-0x0000000000000000-mapping.dmp
-
memory/1608-59-0x0000000000000000-mapping.dmp
-
memory/1608-64-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1608-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1644-66-0x0000000000000000-mapping.dmp
-
memory/1880-57-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1880-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1880-63-0x0000000000220000-0x0000000000232000-memory.dmpFilesize
72KB
-
memory/1880-54-0x0000000075201000-0x0000000075203000-memory.dmpFilesize
8KB