Analysis

  • max time kernel
    149s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240221-en
  • resource tags

    arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
  • submitted
    20/04/2024, 00:48

General

  • Target

    9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe

  • Size

    25KB

  • MD5

    43eff7f085bcff557feab59fe926b178

  • SHA1

    39db5de8bd316da543a7362d35ac94c4db5f6ef7

  • SHA256

    9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f

  • SHA512

    a01b9b00faf6e9563afe367a511be3638a6b2398bb1f2c27c9e399d78f56e051c65b3cd55b9d7c1dec30b5d2196ac929a8f0af3879cc9e6f503c513ab9e8da35

  • SSDEEP

    768:7qPJtecA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNi:7q+cA6C1VqaqhtgVRNToV7TtRu8rM0w3

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe
    "C:\Users\Admin\AppData\Local\Temp\9edd1093babb3310c43794a20b9425bda86a01a66748c35306f82d6e4facb17f.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:1592
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:1720

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\microsofthelp.exe

          Filesize

          25KB

          MD5

          be75e1a6b093204a0d3cef352e031e7c

          SHA1

          a2f36e08d5a34264bc997ff0ce7cf78215d4f6cd

          SHA256

          66c9025893d42f2b304153cb44d57d7496faebdc9e29377c25f4ae8965a9d497

          SHA512

          859e5b1f4e1687cac326a74e87b480ada4ce28605aa4aa444f160e151a4584e3d82be98b49c03b93b78b162f24cd6ea37303dffcaaa1109ee4692532bb1aa925

        • memory/1592-0-0x0000000000400000-0x0000000000402000-memory.dmp

          Filesize

          8KB

        • memory/1720-7-0x0000000000400000-0x0000000000402000-memory.dmp

          Filesize

          8KB