afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043

Analysis

max time kernel
149s
max time network
150s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
15-03-2024 22:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe
Size

70KB
MD5

4f26c9462220d31f48aac4829e58c297
SHA1

6f677c05e21a2425f8ab7dac5f1c674a930c6826
SHA256

afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043
SHA512

1b07e667bf4b1a24128187944740b7c3a994468d83cd8a4bc30c860a189d7f8d18c28c20015de8c454695f820a1ff35a4fe203f2d2c9e7c1dfa92806fcced4ed
SSDEEP

1536:NDj2d6rnJbJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nsqnl1RY:FlnnJBSX1nV1b1N1Il1k1YFI1x1J1MuX

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2472	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2472	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2472	microsofthelp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2292 wrote to memory of 2472	2292	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe	28
PID 2292 wrote to memory of 2472	2292	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe	28
PID 2292 wrote to memory of 2472	2292	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe	28
PID 2292 wrote to memory of 2472	2292	afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe	28

C:\Users\Admin\AppData\Local\Temp\afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe
"C:\Users\Admin\AppData\Local\Temp\afd73c03119533d78e08cbaa12eaa536726a9ad639613d7b4809d454fb06f043.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of SetWindowsHookEx
  PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
70KB

MD5
e514ee990a0618acc635627518e4967d

SHA1
ce85c9284fccc75a64b73a896f0eadc1e804f6bf

SHA256
28d4a2e88c46a888a94544b5360f4e4d6c8ad86bfd1602ac962a63743c6d32c3

SHA512
4db8703b16d3d02e7ec3ac8091ede075d36b1b06943ddd0ef0d3243703bb962e6ce7a465df6a3af5a4a1ccb81804060b38f9ea545bb8870bd9ace3da13ca5313

Download Submit
memory/2292-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2292-7-0x0000000000020000-0x000000000002C000-memory.dmp

Filesize
48KB

Download
memory/2292-6-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2472-9-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download
memory/2472-13-0x0000000010000000-0x0000000010005000-memory.dmp

Filesize
20KB

Download
memory/2472-14-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads