142a4cb3edd1a257ae1eb8b3186dcb4ee7240447ccdb8fcdaf786d7f478e6c28

Analysis

max time kernel
160s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 20:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b8046c2e8182372b84e8d51a3068a2b3.exe
Size

26KB
MD5

b8046c2e8182372b84e8d51a3068a2b3
SHA1

81ace964a3e730253fcee9c07bd485ea73ce9f41
SHA256

142a4cb3edd1a257ae1eb8b3186dcb4ee7240447ccdb8fcdaf786d7f478e6c28
SHA512

957052420f4035552499fbae0cd51854c8fd17dedb935265510146038d6be3ed12d82f2470fa20898d6302513b699a912ad6a20b29fd4ec2716779f179b08921
SSDEEP

768:7qPJtecA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EwhSammh6:7q+cA6C1VqaqhtgVRNToV7TtRu8rM0w

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2544	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2544	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3045580317-3728985860-206385570-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	b8046c2e8182372b84e8d51a3068a2b3.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	b8046c2e8182372b84e8d51a3068a2b3.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3760 wrote to memory of 2544	3760	b8046c2e8182372b84e8d51a3068a2b3.exe	87
PID 3760 wrote to memory of 2544	3760	b8046c2e8182372b84e8d51a3068a2b3.exe	87
PID 3760 wrote to memory of 2544	3760	b8046c2e8182372b84e8d51a3068a2b3.exe	87

C:\Users\Admin\AppData\Local\Temp\b8046c2e8182372b84e8d51a3068a2b3.exe
"C:\Users\Admin\AppData\Local\Temp\b8046c2e8182372b84e8d51a3068a2b3.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3760
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
26KB

MD5
07ecd694e88f941e4551e7ca2254bbc9

SHA1
7942bf31c73195a811ad3dd387d30fda795af888

SHA256
5b80c2086f81cf3f69c08cc3d43793eae9c9889cb742240786c5aef23a972978

SHA512
6f13b8733bbade1c15d10bd27362236074effd1498336f2ece4df698db8274532d1dd48210c2d59aa44053027b28d49e7b6743234d69133641fdb7eff9be0761

Download Submit
memory/3760-0-0x0000000000400000-0x0000000000402000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads