326629f981f002500c9c05138cd6e479adc23bf5b93a8bc13c146ce72bd3f072

Analysis

max time kernel
119s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
22/07/2024, 08:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

86fe9a77bdb3d3b45ad301d397e8d040N.exe
Size

85KB
MD5

86fe9a77bdb3d3b45ad301d397e8d040
SHA1

58eff1cbd89ef8eb0d239d276c9f8ad61f3f2e4c
SHA256

326629f981f002500c9c05138cd6e479adc23bf5b93a8bc13c146ce72bd3f072
SHA512

e09e899bada1398ee98403227e4c3d4dfbf784cdb8696e74b3de26641fb5aa58a81c9f8165fb2ed730299f9ae128ae488e8da801f6589779feb6ed5670ae8559
SSDEEP

1536:/Ao0zj2d6rnJYulBJnJBSX1nV1b1N1Il1k1YFI1x1J1MuEqx517Q/1T1Jzct01Nx:/AoAliulHnJBSX1nV1b1N1Il1k1YFI1S

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4588	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4588	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	86fe9a77bdb3d3b45ad301d397e8d040N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	86fe9a77bdb3d3b45ad301d397e8d040N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1384 wrote to memory of 4588	1384	86fe9a77bdb3d3b45ad301d397e8d040N.exe	84
PID 1384 wrote to memory of 4588	1384	86fe9a77bdb3d3b45ad301d397e8d040N.exe	84
PID 1384 wrote to memory of 4588	1384	86fe9a77bdb3d3b45ad301d397e8d040N.exe	84

C:\Users\Admin\AppData\Local\Temp\86fe9a77bdb3d3b45ad301d397e8d040N.exe
"C:\Users\Admin\AppData\Local\Temp\86fe9a77bdb3d3b45ad301d397e8d040N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1384
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
85KB

MD5
d8153ab8dfe5e44a93fd8334bd72cd5b

SHA1
074724a466419ab0290546504ad788547dd3a1d8

SHA256
cc4dd46efccd7afedab0dc024659df19aa5e9680a86ea87b2753bc56092349c7

SHA512
76c75b9c6e5f9b779ad11ce74ed821156b87af2eb94327cd95065bba057fd28c6036fff92a8bb0cd4bad80bcb8d8d34827151cce8e537d3b2d11b7125ab2c768

Download Submit
memory/1384-0-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/1384-6-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download
memory/4588-5-0x0000000000400000-0x000000000040D000-memory.dmp

Filesize
52KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads