Analysis
-
max time kernel
150s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
10/03/2024, 23:05
Static task
static1
Behavioral task
behavioral1
Sample
953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe
Resource
win10v2004-20240226-en
General
-
Target
953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe
-
Size
88KB
-
MD5
d1fe309e993e04c867a5118e5184e5cf
-
SHA1
e2590eddb15a796c311ba560fadf2555299ae282
-
SHA256
953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27
-
SHA512
86167a0ed24a40e1e761d2781ac49ea50e263d4c00ea2ca6bb85054cfd725c8ffbcbce5007391f7b20f7179578cbf639267653155c52ae18e147caf23cdab7ba
-
SSDEEP
1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1Rr:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuI
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 452 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 452 microsofthelp.exe -
Loads dropped DLL 1 IoCs
pid Process 452 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 452 microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4480 wrote to memory of 452 4480 953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe 88 PID 4480 wrote to memory of 452 4480 953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe 88 PID 4480 wrote to memory of 452 4480 953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe"C:\Users\Admin\AppData\Local\Temp\953a1c1eaf2c3aad452b6fe4449c0d7a2fbda2fe63edfca6c268b924c6691a27.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:452
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD54c0b9970f96300dfa1f45afc7539d35f
SHA1ebbb4ed2003662d78d1f32e7b6da1b6f504ae711
SHA2564e96660cc8be7171a79755a20860366987547322b3a809e78c9850f14c242262
SHA512579f8787b52bf62a0296d8a24753263201fbc84abec5927033e3c97576f965ead0f8422acd3f7af1345b0df0001b0cd68fa971062e21269f6940cf3e1508ca88
-
Filesize
88KB
MD557d16e2dea6f94695d15e7fee7d71583
SHA12e29a069c57d633549aadd197e353019dc9e162f
SHA256222f9b42c57f8080b030480e7a18a9278b2a72a7d7117db3bb63b17f62649084
SHA5128bf967e09c4eca8b03c2ed30d4148f7bd26cdeff3837c766a40823367d2268ca7590bbf3ca24cb82a17751926c2d39464590b65c7af4fbaca3786a47a8ddaed0