859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 23:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe
Size

39KB
MD5

2af244c483dd77b742e706faf5ac64d8
SHA1

f01259fc4937ca90e33e6e81072b4a0cc61d4cc8
SHA256

859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d
SHA512

83027f1376f6fbc742d1dec6b1dd7826dcc01005399c7d7998bff7f7f0fe38297c6e8209175be781e188f8f13e66a6245078bb4457de03ea82138804865a1c62
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhR:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYx

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2840	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2840	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1750093773-264148664-1320403265-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 2840	1792	859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe	84
PID 1792 wrote to memory of 2840	1792	859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe	84
PID 1792 wrote to memory of 2840	1792	859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe	84

C:\Users\Admin\AppData\Local\Temp\859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe
"C:\Users\Admin\AppData\Local\Temp\859b75bfb8ddcae9157583920a642e6076731564167721c3aeb44eb49d11a45d.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
b28ec298ac1265dc8b98e016a708599a

SHA1
0a7e28d58611ede5b17527d2c4e4fe5b37492908

SHA256
5c9e21be6180c931094f4cf4296e4eaaefa4ec3d75460b0d2805f604a520cadf

SHA512
250c3fa1683f682de0fe5bf010ee9e5c8598391a9bca7b0d24231909067e95934c99e2337a0c0c4c873364a4ea1079fd03d1076f4eb0b376e3ac46fd73e8dc56

Download Submit
memory/1792-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1792-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2840-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads