5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35

Analysis

max time kernel
149s
max time network
51s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/06/2024, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe
Size 91KB
Sample240611-2et9ssvalj
SHA256 5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35
MD5 4dd0e1f885f12a4a8ad522674a5e66a8
SHA1 52f631ef5e7e8bb843d3a39e5a8b15ea834da3fd
SHA512 033d4cda9e9b8ba4d434f80a4525efe90b52927a257aaba25f109e7bc4b5885385f6723aae7a6ae3ee4c28a57850d85c39a19e493b99d8ce03cd0afd54325d1a
SSDEEP 1536:vAowfbJFgjQ284U+w2EwRz/IUqX514n2222n2n2LIEHuIUH7NOE96td0zuvHEUEU:vAowVFgjQiUkEwt/XqX514n2222n2n27
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1224	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1224	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3404 wrote to memory of 1224	3404	5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe	81
PID 3404 wrote to memory of 1224	3404	5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe	81
PID 3404 wrote to memory of 1224	3404	5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe	81

C:\Users\Admin\AppData\Local\Temp\5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe
"C:\Users\Admin\AppData\Local\Temp\5e969ff67c75c44629760cc24f9ae573dfb624660097268bec7d08225f048d35.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:3404
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 91KB
SHA256 61a3f4f8e034cc6c3b983c093912da8b2145b84a5a1381a1caaa582aa2ab3236
MD5 96552d83c57d88292402aff173a9e9ca
SHA1 69d66512be62da6878fe5eee3c58d3602cc74c04
SHA512 6ed92dcf8d934da24bec48e0e18659912d4bb152b16a77f5ad5374b1c45a7509c9152561dffd1f1844d11f20a5fb777c6b3ad64223eb79d4117c55ff978b6a51
SSDEEP 1536:vAowfbJFgjQ284U+w2EwRz/IUqX514n2222n2n2LIEHuIUH7NOE96td0zuvHEUE4:vAowVFgjQiUkEwt/XqX514n2222n2n2b
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-6-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/1224-7-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3404-0-0x0000000000400000-0x0000000000410000-memory.dmp

Download

memory/3404-4-0x0000000000400000-0x0000000000410000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads