Analysis
-
max time kernel
149s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
20/04/2024, 00:48
Static task
static1
Behavioral task
behavioral1
Sample
9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe
Resource
win10v2004-20240226-en
General
-
Target
9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe
-
Size
25KB
-
MD5
43eff7f085bcff557feab59fe926b178
-
SHA1
39db5de8bd316da543a7362d35ac94c4db5f6ef7
-
SHA256
9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f
-
SHA512
a01b9b00faf6e9563afe367a511be3638a6b2398bb1f2c27c9e399d78f56e051c65b3cd55b9d7c1dec30b5d2196ac929a8f0af3879cc9e6f503c513ab9e8da35
-
SSDEEP
768:7qPJtecA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNi:7q+cA6C1VqaqhtgVRNToV7TtRu8rM0w3
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1720 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 1720 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1592 wrote to memory of 1720 1592 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe 28 PID 1592 wrote to memory of 1720 1592 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe 28 PID 1592 wrote to memory of 1720 1592 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe 28 PID 1592 wrote to memory of 1720 1592 9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe"C:\Users\Admin\AppData\Local\Temp\9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1592 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
PID:1720
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD5be75e1a6b093204a0d3cef352e031e7c
SHA1a2f36e08d5a34264bc997ff0ce7cf78215d4f6cd
SHA25666c9025893d42f2b304153cb44d57d7496faebdc9e29377c25f4ae8965a9d497
SHA512859e5b1f4e1687cac326a74e87b480ada4ce28605aa4aa444f160e151a4584e3d82be98b49c03b93b78b162f24cd6ea37303dffcaaa1109ee4692532bb1aa925