d1090547d5a24e7a86d708a601a8a06f2a249f92223d307d8d3fea5694c7f488

Analysis

max time kernel
170s
max time network
133s
platform
windows7_x64
resource
win7-20231023-en
resource tags

arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system
submitted
03-11-2023 05:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe
Size

94KB
MD5

11a40dc1859a4eefe65008c177e596d0
SHA1

1c501ea823cf5b3065fe171dca941bf51ac66dfe
SHA256

d1090547d5a24e7a86d708a601a8a06f2a249f92223d307d8d3fea5694c7f488
SHA512

92714eca9db6a46c5c34a69004e045a80998088e2067f9830a524b91edfee5ac5e7d9305c4d249509d73934a564121d480dee3fb2271ca7cad8d75f3476e2119
SSDEEP

1536:/Ao0+j2d6rnJqlIUSJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct016:/AoVl4lXinJBSX1nV1b1N1Il1k1YFI1z

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1368	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1368	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3425689832-2386927309-2650718742-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2184 wrote to memory of 1368	2184	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe	27
PID 2184 wrote to memory of 1368	2184	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe	27
PID 2184 wrote to memory of 1368	2184	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe	27
PID 2184 wrote to memory of 1368	2184	NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe	27

C:\Users\Admin\AppData\Local\Temp\NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.11a40dc1859a4eefe65008c177e596d0_JC.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2184
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
94KB

MD5
ca377374bfdcc27f28a046df29578117

SHA1
24b2f60144e703878bf420113902af79ee85d163

SHA256
adb07b7042ffa0e87e098123aea603ba127761b82f8f45cad072a998cb5c297a

SHA512
d7656101a7ea3683106eac7fc924d75fac94102aa46964d45ed8353671db373d7c712e3e8b58ac742742b668dc0c792d8f9ca3e6ccdc9933e6c55e736906f711

Download Submit
C:\Windows\microsofthelp.exe

Filesize
94KB

MD5
ca377374bfdcc27f28a046df29578117

SHA1
24b2f60144e703878bf420113902af79ee85d163

SHA256
adb07b7042ffa0e87e098123aea603ba127761b82f8f45cad072a998cb5c297a

SHA512
d7656101a7ea3683106eac7fc924d75fac94102aa46964d45ed8353671db373d7c712e3e8b58ac742742b668dc0c792d8f9ca3e6ccdc9933e6c55e736906f711

Download Submit
C:\Windows\microsofthelp.exe

Filesize
94KB

MD5
ca377374bfdcc27f28a046df29578117

SHA1
24b2f60144e703878bf420113902af79ee85d163

SHA256
adb07b7042ffa0e87e098123aea603ba127761b82f8f45cad072a998cb5c297a

SHA512
d7656101a7ea3683106eac7fc924d75fac94102aa46964d45ed8353671db373d7c712e3e8b58ac742742b668dc0c792d8f9ca3e6ccdc9933e6c55e736906f711

Download Submit
memory/1368-8-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1368-10-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2184-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/2184-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads