b3f3225c2f98abcc8efe3bbb16a32a783e7c39fd6e8ae8477dcdec140ca15594

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
26-04-2024 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7f4942789ff7cd22ec45e333f562ba6.exe
Size

30KB
MD5

c7f4942789ff7cd22ec45e333f562ba6
SHA1

e9eb2abda644a749f4d9853d349cc74f47567101
SHA256

b3f3225c2f98abcc8efe3bbb16a32a783e7c39fd6e8ae8477dcdec140ca15594
SHA512

2be6cedb79e801cf5f0ffafc598edae14dd8f9399949543e89d8e9f93e5ab3c58144da0c29087dfc5f8c9029ecd179db40cd6d3c76eb281110c7df2a9a445ae4
SSDEEP

768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhe:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wY+

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3040	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3040	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	c7f4942789ff7cd22ec45e333f562ba6.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	c7f4942789ff7cd22ec45e333f562ba6.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 3040	2944	c7f4942789ff7cd22ec45e333f562ba6.exe	28
PID 2944 wrote to memory of 3040	2944	c7f4942789ff7cd22ec45e333f562ba6.exe	28
PID 2944 wrote to memory of 3040	2944	c7f4942789ff7cd22ec45e333f562ba6.exe	28
PID 2944 wrote to memory of 3040	2944	c7f4942789ff7cd22ec45e333f562ba6.exe	28

C:\Users\Admin\AppData\Local\Temp\c7f4942789ff7cd22ec45e333f562ba6.exe
"C:\Users\Admin\AppData\Local\Temp\c7f4942789ff7cd22ec45e333f562ba6.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
30KB

MD5
e23897899778c53350d7bcb62e737b02

SHA1
89eebe1b899f39569a8719450e5d8785f1780d97

SHA256
43a78c66b1aea2094f1d4393150bdc0873c40110332fc6c90af7d3d70d9c8f08

SHA512
70ed1c64c7208f4746ee3fac074eca0d32708fb094cc90e0ce8c190c7b302773fcd12e03881940a0f61a813693da81df34dd4aa323cbd997be630c1319a1c451

Download Submit
memory/2944-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2944-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2944-3-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/3040-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads