c2624b1664b5da45601a92a525ceeaa6f2330c400b3ba63a4f2a41c4c46d0cce

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
22-07-2024 01:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

42c06c5195de8b490a3e5c2eb2b81b90N.exe
Size

42KB
MD5

42c06c5195de8b490a3e5c2eb2b81b90
SHA1

17ff680803b2b392415b85d59a8e6d2f42d5ae58
SHA256

c2624b1664b5da45601a92a525ceeaa6f2330c400b3ba63a4f2a41c4c46d0cce
SHA512

4552cb2bf8aa4cc54f211eb8d45e38155b81571d7de15c742c6db7a09efe356cb19880f4ad45522ad24927bded47255194784d25825efe3bfd5856bf72fd2e80
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhW:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wY2

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3024	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3024	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	42c06c5195de8b490a3e5c2eb2b81b90N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	42c06c5195de8b490a3e5c2eb2b81b90N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2180 wrote to memory of 3024	2180	42c06c5195de8b490a3e5c2eb2b81b90N.exe	31
PID 2180 wrote to memory of 3024	2180	42c06c5195de8b490a3e5c2eb2b81b90N.exe	31
PID 2180 wrote to memory of 3024	2180	42c06c5195de8b490a3e5c2eb2b81b90N.exe	31
PID 2180 wrote to memory of 3024	2180	42c06c5195de8b490a3e5c2eb2b81b90N.exe	31

C:\Users\Admin\AppData\Local\Temp\42c06c5195de8b490a3e5c2eb2b81b90N.exe
"C:\Users\Admin\AppData\Local\Temp\42c06c5195de8b490a3e5c2eb2b81b90N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2180
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:3024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
42KB

MD5
e179001d286315d51291745b0fa176c4

SHA1
94bf7c0135b8d22deb4ba1607d022560ddb90c68

SHA256
a9957542d612530203d60c881308a8a3098004abe2c6f13f678948723e54c5c5

SHA512
8c24517787ba107f1fa6cfebb499223c7735e02f0f9e7f344db98b32b7579de6398480cdfe289fd17eb057fea6de1b86eadc7f2eb781dd31cd592763409c3f16

Download Submit
memory/2180-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2180-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3024-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads