Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
22-05-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe
Resource
win10v2004-20240508-en
General
-
Target
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe
-
Size
36KB
-
MD5
ac9b9ead617475d9d0f468829451d8eb
-
SHA1
bf643e05145b2175893c5d08564549bc6a3f7218
-
SHA256
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d
-
SHA512
d96d20eaf0bb6ad110b005b78f84beb4cb20d03811abc3d63a8102afb47e18df3ef4fd485324d88866f2ee65655d397c1d6f7558bfb0e91cffdf14ac18708dff
-
SSDEEP
768:/qPJtHA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhK:/qnA6C1VqaqhtgVRNToV7TtRu8rM0wYq
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
microsofthelp.exepid process 1612 microsofthelp.exe -
Executes dropped EXE 1 IoCs
Processes:
microsofthelp.exepid process 1612 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe -
Drops file in Windows directory 1 IoCs
Processes:
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exedescription ioc process File created C:\Windows\microsofthelp.exe 7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exedescription pid process target process PID 4004 wrote to memory of 1612 4004 7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe microsofthelp.exe PID 4004 wrote to memory of 1612 4004 7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe microsofthelp.exe PID 4004 wrote to memory of 1612 4004 7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe microsofthelp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe"C:\Users\Admin\AppData\Local\Temp\7be9a7abf8a9063a2567937df525bdfaee175782cdd2c70ee218a3a1f07e148d.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\microsofthelp.exeFilesize
36KB
MD5492c0cf6344dd2c8218a1827be82119c
SHA14a33a069ad5d248c314810b63d34041ca9a3063a
SHA25680a18f877875ab6a2b904732584e8451c44f5136dad88c01a55a4400af6b4a4a
SHA512570a08bf6833ae0b8d8e15ed91e6d28ee37417f6b98f153635b7cc9182d62135d3881dadaa6fbb3505e92bf4d55e8e6580304f69abb562aa3e8b637688ff66a5
-
memory/1612-6-0x0000000000400000-0x0000000000403000-memory.dmpFilesize
12KB
-
memory/4004-0-0x0000000000400000-0x0000000000403000-memory.dmpFilesize
12KB
-
memory/4004-4-0x0000000000400000-0x0000000000403000-memory.dmpFilesize
12KB