c37592cdb6143716562ceb41af932aba496ab68f4a574eb59ebd9cc0665659bf

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
27-11-2023 16:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a8485ca4d3ec0e8580405dbf384fee5a.exe
Size

6KB
MD5

a8485ca4d3ec0e8580405dbf384fee5a
SHA1

4fd14ec531551d188898f6953d7271f414ef0de8
SHA256

c37592cdb6143716562ceb41af932aba496ab68f4a574eb59ebd9cc0665659bf
SHA512

40f39c0589ff2e7d01f28a4519f61b77b9421ae6c1ee6c4c6f215ac9c3b4b94474776b0218e6df3bae3165771b75ab3c3421257e80dd6558dd4227df5a45685b
SSDEEP

96:hqQ+vpZKAsIgQ5PvKuFmXAvAvToM4wqEpAPF/EQja8ectS6Cxv:hRiPKu4dEM4NEqPF/EkecA6Cxv

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2676	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2676	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1873812795-1433807462-1429862679-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	a8485ca4d3ec0e8580405dbf384fee5a.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	a8485ca4d3ec0e8580405dbf384fee5a.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2012 wrote to memory of 2676	2012	a8485ca4d3ec0e8580405dbf384fee5a.exe	36
PID 2012 wrote to memory of 2676	2012	a8485ca4d3ec0e8580405dbf384fee5a.exe	36
PID 2012 wrote to memory of 2676	2012	a8485ca4d3ec0e8580405dbf384fee5a.exe	36

C:\Users\Admin\AppData\Local\Temp\a8485ca4d3ec0e8580405dbf384fee5a.exe
"C:\Users\Admin\AppData\Local\Temp\a8485ca4d3ec0e8580405dbf384fee5a.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2012
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
6KB

MD5
db39cf3be688fd5aad892b8a98e51403

SHA1
8bfa8b933786be8d4b3deb00f2cbce2c3011b9b4

SHA256
d9ac08b4eba357cb64ce39f0cca075452b1b771d88fa1574b30947e89db77705

SHA512
17b598ffffa55af829ee41e0bd272827a80717ecb3e2bc0a72fb7ddb42a3dfb44761fb38c80a1a82edea8ebe4e9767896bcabceb2d65385eb49a54da1ccf81fa

Download Submit
C:\Windows\microsofthelp.exe

Filesize
6KB

MD5
db39cf3be688fd5aad892b8a98e51403

SHA1
8bfa8b933786be8d4b3deb00f2cbce2c3011b9b4

SHA256
d9ac08b4eba357cb64ce39f0cca075452b1b771d88fa1574b30947e89db77705

SHA512
17b598ffffa55af829ee41e0bd272827a80717ecb3e2bc0a72fb7ddb42a3dfb44761fb38c80a1a82edea8ebe4e9767896bcabceb2d65385eb49a54da1ccf81fa

Download Submit
memory/2012-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads