Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    15/07/2024, 12:13

General

  • Target

    d6c76ad4feae66d438c107543d715d90N.exe

  • Size

    39KB

  • MD5

    d6c76ad4feae66d438c107543d715d90

  • SHA1

    23aec32de3b695a0ea1c32e1d9521868217b09c4

  • SHA256

    47411c4508903ce82c06eaa0653d3517d04e1ab6d95c3a4f32a122cc1fd5ca3b

  • SHA512

    46005b9bf89184d3a8962f49ffdc113b72fd4d847ea7a0f3175c302bc0fc952c2928dab9584b0b4c7f6412aa71e84a1f2ce49bc7fd8a0ff44a8a6d64c3d167dc

  • SSDEEP

    768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhR:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYx

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d6c76ad4feae66d438c107543d715d90N.exe
    "C:\Users\Admin\AppData\Local\Temp\d6c76ad4feae66d438c107543d715d90N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of WriteProcessMemory
    PID:2072
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:236

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    39KB

    MD5

    a38d2357c9394950bf12d2d3b078c276

    SHA1

    180f2bc8077ce471e388a6c818acf22de97f9108

    SHA256

    4270549ee406986fca3ff1b1d19bb74e1aa1e3214f64ca6f7b43a2f3aacaac3c

    SHA512

    72eb687947dcd42724ce9d40fd71c4dcba1dab2032e2bdbb034283d47916c03938d662655f14651e7bfea1bedb6a6c34d1ca91b59668ab01ff682d26f84e1d19

  • memory/236-8-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2072-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2072-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB