772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa

Analysis

max time kernel
149s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
23-07-2024 23:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe
Size

44KB
MD5

f1f581e72344e3efc44b8429611cbc96
SHA1

ab19a5ed448fdeb615a0f672fff1f92d156cb832
SHA256

772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa
SHA512

f90131335167d3fc2a7ede7bec24eb59eba98bde4989d5e1ba87ac79cdc82dc12c5b9d139602969d9ce1e9dde3b2a454d49667bc0154b45c3cb57fafe26f637d
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhG:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYm

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1200	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1200	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-47134698-4092160662-1261813102-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1200	5036	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe	84
PID 5036 wrote to memory of 1200	5036	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe	84
PID 5036 wrote to memory of 1200	5036	772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe	84

C:\Users\Admin\AppData\Local\Temp\772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe
"C:\Users\Admin\AppData\Local\Temp\772d4c62ff5b62441c0405d8bf7c9e1efeea50334454aad629c9d708b335a9fa.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
45KB

MD5
3bb3470691d12c5ba168e03bb0758774

SHA1
ab60f1e90a4acb859f3a9b40e76a71bb66a11a08

SHA256
cbf7f3cf3e07d86b83ecd0c5c669d4fbd31231bbb07aeedc7e89c4631eee8880

SHA512
222b0a3008dfef54441f901d385f6fe65fa4ec2762701a554ec21698161d0695a29d72dbc8fbb4178eaae2234388fe356790ce4f1663c83076be93ce51c9103b

Download Submit
memory/1200-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/5036-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/5036-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads