8c16c68a308399eb7bdad88d6dd64ada0102a10d951dafe586c2222982c4fb40

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
13/07/2024, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2f9cbaed607419287f0168240d4a04e0N.exe
Size

30KB
MD5

2f9cbaed607419287f0168240d4a04e0
SHA1

3d58489f67dbe6e526537f66158123b244755143
SHA256

8c16c68a308399eb7bdad88d6dd64ada0102a10d951dafe586c2222982c4fb40
SHA512

bddad32c760b5b1e81495b3e8e453b639ca57ba8cd321d870a94c9fca520cd1fef8db522210600d80c025d29fa8f2838872bbb670f7cb3445c5ec9e79df1a90b
SSDEEP

768:oqPJt6A6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhx:oqaA6C1VqaqhtgVRNToV7TtRu8rM0wYR

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3100	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3100	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	2f9cbaed607419287f0168240d4a04e0N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	2f9cbaed607419287f0168240d4a04e0N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 3100	4564	2f9cbaed607419287f0168240d4a04e0N.exe	83
PID 4564 wrote to memory of 3100	4564	2f9cbaed607419287f0168240d4a04e0N.exe	83
PID 4564 wrote to memory of 3100	4564	2f9cbaed607419287f0168240d4a04e0N.exe	83

C:\Users\Admin\AppData\Local\Temp\2f9cbaed607419287f0168240d4a04e0N.exe
"C:\Users\Admin\AppData\Local\Temp\2f9cbaed607419287f0168240d4a04e0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
31KB

MD5
a2db498fcf2d2214e43f5d9da7cd15e7

SHA1
4749ad9d3f31c3c828ea73120c9c29999c3e5371

SHA256
af48a217cef0bc28865c5e56cf55ef3ccf50e2eef1c6e50474fb3af78a5b3990

SHA512
c8e9c490abfc864e51df01b7db9a4f9faef6273a44be6eb3b0164909b59d486d75b87925e9d2136e9c7b9d226197f82156c3decb90bfbe9da5e4676d9bfc248e

Download Submit
memory/4564-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4564-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads