Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/04/2024, 21:59

General

  • Target

    664a5b96897f59dda95828636d26494826f5ea5f4351bcb05e2b1d17522c7df6.exe

  • Size

    31KB

  • MD5

    980cef1a713e80f1abf7601a6cd952be

  • SHA1

    5cf26101a663a547409e67b5eb0dcaaef1d5efeb

  • SHA256

    664a5b96897f59dda95828636d26494826f5ea5f4351bcb05e2b1d17522c7df6

  • SHA512

    4a21b28cadb3c33963464e68ecbcd9e2509e489ffe8eb9c860636bbc92f6152654becf4bc68355f72e877e7460dc53fe40978591a9acdeb75c1ead8e8f35a3f7

  • SSDEEP

    768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhD:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYj

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\664a5b96897f59dda95828636d26494826f5ea5f4351bcb05e2b1d17522c7df6.exe
    "C:\Users\Admin\AppData\Local\Temp\664a5b96897f59dda95828636d26494826f5ea5f4351bcb05e2b1d17522c7df6.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:752

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\microsofthelp.exe

          Filesize

          32KB

          MD5

          3cc4436c2d303dec0b97bd794d412447

          SHA1

          16231cf06fae7fbc3b5d49023859351f47365344

          SHA256

          fce41cad52f6ab81b044241c988d65a4b1434850c0990f78281ccbca907b13d7

          SHA512

          6a8417742cce762f0b6c7bc2d33bd872ca13c6700c38e7a1e9a6244ca72c41077a3163923c51e12aeda2cb46024fa923765d359bc947f20a7f3e383239821152

        • memory/752-6-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4248-0-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB

        • memory/4248-5-0x0000000000400000-0x0000000000403000-memory.dmp

          Filesize

          12KB