fe4ac8a0f5bf158c80854e69bb95c14c9be002644e0688a47e03c1e02174197d

Analysis

max time kernel
157s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2023, 18:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b61daa750dd690496a4d78d5519971f_JC.exe
Size

61KB
MD5

4b61daa750dd690496a4d78d5519971f
SHA1

b44b09d6af948c61c7c4986816e3a5cc65502c79
SHA256

fe4ac8a0f5bf158c80854e69bb95c14c9be002644e0688a47e03c1e02174197d
SHA512

02ef7bdf29c5ce677e3b93d7ffa2a4174fc2ee26c0eac005dbc177557151f70c3ea637e9b8bb6f242b0d2e0c4aad5da3d7afb415b60dccf01ff4ff01553e6c7e
SSDEEP

1536:/Ao0zj2d6rnJYulBJnDQEEa1EfBE+1EC1p1E1aE1E1EEE1+BX1EE9h1EJvY1kwvM:/AoAliulHnDQEEa1EfBE+1EC1p1E1aEJ

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4776	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1926387074-3400613176-3566796709-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	4b61daa750dd690496a4d78d5519971f_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	4b61daa750dd690496a4d78d5519971f_JC.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 4776	1520	4b61daa750dd690496a4d78d5519971f_JC.exe	91
PID 1520 wrote to memory of 4776	1520	4b61daa750dd690496a4d78d5519971f_JC.exe	91
PID 1520 wrote to memory of 4776	1520	4b61daa750dd690496a4d78d5519971f_JC.exe	91

C:\Users\Admin\AppData\Local\Temp\4b61daa750dd690496a4d78d5519971f_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4b61daa750dd690496a4d78d5519971f_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1520
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
62KB

MD5
bf7d8ce9f8b2f484a17db14327e25979

SHA1
bfe625a2af7b9e3d572c549422b31d09bcea1ef6

SHA256
c731a0dcae00564aa0b1fc912a34afaa5df3a1dcf0a7c8a3dd2aa97b21a61541

SHA512
e195022aa4fe1693726b499c2eec3ff00cc295d8cdfd4b0edbe4d3524bb40d5e47a31a9daab53fc481fddf23a5bb9b69954ac3a34c0e87f63dbcf72423c31b84

Download Submit
C:\Windows\microsofthelp.exe

Filesize
62KB

MD5
bf7d8ce9f8b2f484a17db14327e25979

SHA1
bfe625a2af7b9e3d572c549422b31d09bcea1ef6

SHA256
c731a0dcae00564aa0b1fc912a34afaa5df3a1dcf0a7c8a3dd2aa97b21a61541

SHA512
e195022aa4fe1693726b499c2eec3ff00cc295d8cdfd4b0edbe4d3524bb40d5e47a31a9daab53fc481fddf23a5bb9b69954ac3a34c0e87f63dbcf72423c31b84

Download Submit
memory/1520-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1520-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4776-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads