8a33991d92d98aa05ce96a9d08341e34d6c496da049b9577ae63aa69443c0ddb

Analysis

max time kernel
149s
max time network
125s
platform
windows7_x64
resource
win7-20231025-en
resource tags

arch:x64arch:x86image:win7-20231025-enlocale:en-usos:windows7-x64system
submitted
13-11-2023 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NEAS.8f6128323940a3d383559bc0e24e8060.exe
Size

89KB
MD5

8f6128323940a3d383559bc0e24e8060
SHA1

8431a836b78f0588a4f469acde91bac7d70fc57e
SHA256

8a33991d92d98aa05ce96a9d08341e34d6c496da049b9577ae63aa69443c0ddb
SHA512

c18499b35c94f52d770a5f23e5440e4ee9386d23231e3f106f948bfc044b234b67b67d614cbdfa3b6bffdb33c604ed5db3182d1dacac3292f5996e342ce9a926
SSDEEP

1536:vAowfbJFgjQ284U+w2EwRzSIUqhwDKopH0njnIInjjnjjjjjjjnjjnRt89yES/f0:vAowVFgjQiUkEwtSXqhwDKopH0njnIIy

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2440	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2440	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1861898231-3446828954-4278112889-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	NEAS.8f6128323940a3d383559bc0e24e8060.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	NEAS.8f6128323940a3d383559bc0e24e8060.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3012 wrote to memory of 2440	3012	NEAS.8f6128323940a3d383559bc0e24e8060.exe	28
PID 3012 wrote to memory of 2440	3012	NEAS.8f6128323940a3d383559bc0e24e8060.exe	28
PID 3012 wrote to memory of 2440	3012	NEAS.8f6128323940a3d383559bc0e24e8060.exe	28
PID 3012 wrote to memory of 2440	3012	NEAS.8f6128323940a3d383559bc0e24e8060.exe	28

C:\Users\Admin\AppData\Local\Temp\NEAS.8f6128323940a3d383559bc0e24e8060.exe
"C:\Users\Admin\AppData\Local\Temp\NEAS.8f6128323940a3d383559bc0e24e8060.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
89KB

MD5
51905d5be53f93b995200f5cc2fa0202

SHA1
dbc17ebd011efb4d319814db48f0d1031c2733cf

SHA256
a5796fb9baac026a4f9ebb2f689f437780c5ccb3e6aa7749121f1734938bf9be

SHA512
7038c94c7d11bbe4da4b1a754e71d2f972945b539489b331543eb52ab21a5d7ff1755867db45cb033c182c881f8b1d459f657729623c4eb35a076ad740802a77

Download Submit
C:\Windows\microsofthelp.exe

Filesize
89KB

MD5
51905d5be53f93b995200f5cc2fa0202

SHA1
dbc17ebd011efb4d319814db48f0d1031c2733cf

SHA256
a5796fb9baac026a4f9ebb2f689f437780c5ccb3e6aa7749121f1734938bf9be

SHA512
7038c94c7d11bbe4da4b1a754e71d2f972945b539489b331543eb52ab21a5d7ff1755867db45cb033c182c881f8b1d459f657729623c4eb35a076ad740802a77

Download Submit
C:\Windows\microsofthelp.exe

Filesize
89KB

MD5
51905d5be53f93b995200f5cc2fa0202

SHA1
dbc17ebd011efb4d319814db48f0d1031c2733cf

SHA256
a5796fb9baac026a4f9ebb2f689f437780c5ccb3e6aa7749121f1734938bf9be

SHA512
7038c94c7d11bbe4da4b1a754e71d2f972945b539489b331543eb52ab21a5d7ff1755867db45cb033c182c881f8b1d459f657729623c4eb35a076ad740802a77

Download Submit
memory/2440-8-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2440-11-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3012-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3012-7-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/3012-9-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads