e52ee576ff2fc625efcee1cfa902bbf7417e912464c56944a2ec51ac89076d1c

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 18:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe
Size

68KB
MD5

cbe13f21a1e0c5ddddb94af92bbe75e0
SHA1

7201edd128e33aa62febd83b839ed0b688a4dea2
SHA256

e52ee576ff2fc625efcee1cfa902bbf7417e912464c56944a2ec51ac89076d1c
SHA512

573ef3bb1049173fbad1eea952809a2c86d5b82d64a8cb16043daff1e0faa5182bffef9d81736fda05978fe5356deec16d2d3088656b3107dbbb6504e756e32a
SSDEEP

1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIaCtwUaSvcmGCCCCCCC+EaEAEtHjCCCCt/:YAowyFgjTiUkEwt6OlvaeEpIaCtwUaSB

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4944	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4944	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-919254492-3979293997-764407192-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4944	3556	NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe	83
PID 3556 wrote to memory of 4944	3556	NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe	83
PID 3556 wrote to memory of 4944	3556	NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe	83

C:\Users\Admin\AppData\Local\Temp\NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.cbe13f21a1e0c5ddddb94af92bbe75e0.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4944

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
68KB

MD5
231aa1f5295ea8d70e251f51f0b4c845

SHA1
64769027457597fdccb2513f0900f6f321dc0c68

SHA256
eb91a57a2167051b14d23756d39121b2bc9ba5f3c9617ca530c82c75b9b73a09

SHA512
3b37541a4257ce4b4eab60a44017bdd5f1284bff6b1076ffdcd31100497781a5041a9e818d0f7ca24fcafcaaa07e2978cf3e21e406741dd0fb90b31601fe436d

Download Submit
C:\Windows\microsofthelp.exe

Filesize
68KB

MD5
231aa1f5295ea8d70e251f51f0b4c845

SHA1
64769027457597fdccb2513f0900f6f321dc0c68

SHA256
eb91a57a2167051b14d23756d39121b2bc9ba5f3c9617ca530c82c75b9b73a09

SHA512
3b37541a4257ce4b4eab60a44017bdd5f1284bff6b1076ffdcd31100497781a5041a9e818d0f7ca24fcafcaaa07e2978cf3e21e406741dd0fb90b31601fe436d

Download Submit
memory/3556-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3556-5-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/4944-6-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads