cc35c69f09dd53064e095e84694df49355f9e9200a98b397171099eb94335543

Analysis

max time kernel
144s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
04/11/2023, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.2fc3864502040a6077025e3cb040bf30.exe
Size

121KB
MD5

2fc3864502040a6077025e3cb040bf30
SHA1

686bcfa236c308cde2e4c2a3ec53ce4d633445de
SHA256

cc35c69f09dd53064e095e84694df49355f9e9200a98b397171099eb94335543
SHA512

d87d59db212b6531967b4b8a04c876c132996f5e2987c06b89ab7a1a3cb25921e517e661f02c8268e6ddbc28dc7afc0946406fe3b23834a0923f667ff0ee2c4b
SSDEEP

3072:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nbnl1RRhCHODpOJO:zw6P

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2384	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2384	microsofthelp.exe

Loads dropped DLL 1 IoCs

pid	Process
2384	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3350690463-3549324357-1323838019-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	NEAS.2fc3864502040a6077025e3cb040bf30.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	NEAS.2fc3864502040a6077025e3cb040bf30.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2384	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 2384	3484	NEAS.2fc3864502040a6077025e3cb040bf30.exe	86
PID 3484 wrote to memory of 2384	3484	NEAS.2fc3864502040a6077025e3cb040bf30.exe	86
PID 3484 wrote to memory of 2384	3484	NEAS.2fc3864502040a6077025e3cb040bf30.exe	86

C:\Users\Admin\AppData\Local\Temp\NEAS.2fc3864502040a6077025e3cb040bf30.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.2fc3864502040a6077025e3cb040bf30.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\HidePlugin.dll

Filesize
5KB

MD5
4c0b9970f96300dfa1f45afc7539d35f

SHA1
ebbb4ed2003662d78d1f32e7b6da1b6f504ae711

SHA256
4e96660cc8be7171a79755a20860366987547322b3a809e78c9850f14c242262

SHA512
579f8787b52bf62a0296d8a24753263201fbc84abec5927033e3c97576f965ead0f8422acd3f7af1345b0df0001b0cd68fa971062e21269f6940cf3e1508ca88

Download Submit
C:\Windows\microsofthelp.exe

Filesize
121KB

MD5
26d83cab879aadca469f2b0eb3cbfba6

SHA1
aab50429cf55595a5088e721417d1a78990269cb

SHA256
8e663584e9c375e5e0eac3eb3949d3091baaa3509b647c2f47c32089bb0f2030

SHA512
eac55d340cd949462e9f8b4951bbe77f7903a802b86fe26372c1c6c23f3f8417a7a5b60cb5b823d017c394010c7fc3e242335fcde35bbfd7209bd1d1eed70afc

Download Submit
C:\Windows\microsofthelp.exe

Filesize
121KB

MD5
26d83cab879aadca469f2b0eb3cbfba6

SHA1
aab50429cf55595a5088e721417d1a78990269cb

SHA256
8e663584e9c375e5e0eac3eb3949d3091baaa3509b647c2f47c32089bb0f2030

SHA512
eac55d340cd949462e9f8b4951bbe77f7903a802b86fe26372c1c6c23f3f8417a7a5b60cb5b823d017c394010c7fc3e242335fcde35bbfd7209bd1d1eed70afc

Download Submit
memory/2384-10-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2384-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3484-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/3484-5-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads