8bd227785a2fca5a81b7ba343e6edc9463dee9e4103e997dc1a15bf9409492aa

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
16-07-2024 01:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

45433bf65477f4718a4a14e346fd4b30N.exe
Size

37KB
MD5

45433bf65477f4718a4a14e346fd4b30
SHA1

8662460e02609133bc5f37510e5a5d35c7f0cf26
SHA256

8bd227785a2fca5a81b7ba343e6edc9463dee9e4103e997dc1a15bf9409492aa
SHA512

6ec5ddb61dd0a74d2f99f48726de0f5fb5fad141e545b1ce3cefbe47dc152b87a5b4b44b23e7384aba6b7e2f14980ec61d4c00b7b85c5546c4b09c3eee4ade19
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh2:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYW

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2560	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2560	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	45433bf65477f4718a4a14e346fd4b30N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	45433bf65477f4718a4a14e346fd4b30N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 2560	2256	45433bf65477f4718a4a14e346fd4b30N.exe	29
PID 2256 wrote to memory of 2560	2256	45433bf65477f4718a4a14e346fd4b30N.exe	29
PID 2256 wrote to memory of 2560	2256	45433bf65477f4718a4a14e346fd4b30N.exe	29
PID 2256 wrote to memory of 2560	2256	45433bf65477f4718a4a14e346fd4b30N.exe	29

C:\Users\Admin\AppData\Local\Temp\45433bf65477f4718a4a14e346fd4b30N.exe
"C:\Users\Admin\AppData\Local\Temp\45433bf65477f4718a4a14e346fd4b30N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2560

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
37KB

MD5
04c12daeb64b949a422d273c3f062dba

SHA1
ee6f29d7cdd3f50f42187915ed9c1de098c23667

SHA256
ad533492ad5102325c979c05c583d54829d960ce8f8ffd96a84a1c9c84a617fd

SHA512
f794d978317833221d20308f92abc00c8abe881c796727e1b2d554ab608eb83941905d38ef579686e364fbf71577b15521f5310fc6829f9c6dd2bd7d996e135d

Download Submit
memory/2256-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2256-3-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads