7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13

Analysis

max time kernel
149s
max time network
122s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
09/06/2024, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe
Size

94KB
MD5

cbb0dd93aaa8412734674d21281c17d5
SHA1

0e69166f0f97db8f94e19c4046710a3ed57b9f1a
SHA256

7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13
SHA512

24dcaefe6089f1c4f9e9025ddb35ea0a8400db398a1f14cfa81bc5040a12be0585a3fb47db75a268724e859130d72731275e4495c6bcad1ef1506df290c37ca7
SSDEEP

1536:YAowfUJFgjT284U+w2EwRz6OlvaeEpIao/6NXznCCh+61CXCCCC9yttattvtHtgh:YAowyFgjTiUkEwt6OlvaeEpIao/6NDn9

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1448	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1448	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1448	2040	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe	28
PID 2040 wrote to memory of 1448	2040	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe	28
PID 2040 wrote to memory of 1448	2040	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe	28
PID 2040 wrote to memory of 1448	2040	7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe	28

C:\Users\Admin\AppData\Local\Temp\7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe
"C:\Users\Admin\AppData\Local\Temp\7b74f8aff7529a89cafd62e77c1e2e39c563baa4bfa8cd10bfb8357dfd5ead13.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
94KB

MD5
86d3ec4af69a1a0d85e7f573ff7aaaee

SHA1
8605053eb5fd40369b9d42693a01f20c71144616

SHA256
080d1e8ed54b7f811650c1fa99bad591986a57ebc1cb434f64ba29ecbe8a0ff1

SHA512
fda651effcd5fe4ab216f9c55f346033ed044a9ef55881fa59bc9079d8222bf3be8dbf340a01fe2c8fe00f439e3d044f520168bc06ebc92f318c8dd137a087dd

Download Submit
memory/1448-10-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/1448-12-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2040-0-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2040-4-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download
memory/2040-9-0x0000000000400000-0x0000000000410000-memory.dmp

Filesize
64KB

Download
memory/2040-7-0x0000000000220000-0x0000000000230000-memory.dmp

Filesize
64KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads