Analysis
-
max time kernel
119s -
max time network
93s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11/07/2024, 23:48
Static task
static1
Behavioral task
behavioral1
Sample
17d554be99b24ae188fa69a4027bd950N.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
17d554be99b24ae188fa69a4027bd950N.exe
Resource
win10v2004-20240709-en
General
-
Target
17d554be99b24ae188fa69a4027bd950N.exe
-
Size
53KB
-
MD5
17d554be99b24ae188fa69a4027bd950
-
SHA1
111e69f20195abe30861ad6bfe1c17bd179671e9
-
SHA256
6cb4d7cbe577491e9a3f62363f778233a1e7af39a67051767bdc61074db4de08
-
SHA512
8824d7f68db609056661f032342dfe4119f72c1c983d2c6c6cc5634d777502ca1c719b54ddd91cd776fa42abcf92e81c378766808f7b7a58d845c4b4dbcaba71
-
SSDEEP
1536:NAo0Tj2d6rnJwwvl4ulkvsaLHtj+hzhMhyvtvDh:NAoglOwvl4ulkvsaLHtj+hzhMhyvtvDh
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 3168 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 3168 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 17d554be99b24ae188fa69a4027bd950N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 17d554be99b24ae188fa69a4027bd950N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4708 wrote to memory of 3168 4708 17d554be99b24ae188fa69a4027bd950N.exe 85 PID 4708 wrote to memory of 3168 4708 17d554be99b24ae188fa69a4027bd950N.exe 85 PID 4708 wrote to memory of 3168 4708 17d554be99b24ae188fa69a4027bd950N.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\17d554be99b24ae188fa69a4027bd950N.exe"C:\Users\Admin\AppData\Local\Temp\17d554be99b24ae188fa69a4027bd950N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:3168
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
53KB
MD5790998a012a64adffdf473a0e811c896
SHA141e8fe15f37c7b11d07367d1cbd9435fa492c1b8
SHA2561253a287f296ad12da6165f99638db5b842401fd4ef733ad93fcc936b429867c
SHA5129a7b2223f9b54d427b3c1a5383f753537b93ab77c0322d4151da7894e864c69e131728b02c0be94e0fdf27ce123d4b1f67c8ff528a72abbce2b5d9eab4c313d7