cd4d4250ca3afb3e3cb50b2242bbf911ade9585b818e84c567e045f9b2978342

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
23-07-2024 09:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9c89f1a7f6c81cb0899f53edbf228570N.exe
Size

40KB
MD5

9c89f1a7f6c81cb0899f53edbf228570
SHA1

d7c21d3065f7a5844e1e5d3719096dd6f8d9755f
SHA256

cd4d4250ca3afb3e3cb50b2242bbf911ade9585b818e84c567e045f9b2978342
SHA512

4d1b6ecf164e44b03e9b8fdcd9de2bd2217955a674dea0c2c2bb21c0727a4ae46603b72b390f139bfaf4a855aea13bd223d794535a69f1158d8f7600d42dd581
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh+:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYe

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2720	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2720	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	9c89f1a7f6c81cb0899f53edbf228570N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	9c89f1a7f6c81cb0899f53edbf228570N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2720	2272	9c89f1a7f6c81cb0899f53edbf228570N.exe	30
PID 2272 wrote to memory of 2720	2272	9c89f1a7f6c81cb0899f53edbf228570N.exe	30
PID 2272 wrote to memory of 2720	2272	9c89f1a7f6c81cb0899f53edbf228570N.exe	30
PID 2272 wrote to memory of 2720	2272	9c89f1a7f6c81cb0899f53edbf228570N.exe	30

C:\Users\Admin\AppData\Local\Temp\9c89f1a7f6c81cb0899f53edbf228570N.exe
"C:\Users\Admin\AppData\Local\Temp\9c89f1a7f6c81cb0899f53edbf228570N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
40KB

MD5
6f86679c440df3b61967e7b05e27f11f

SHA1
8f282e1d81964649dcd99c148aae34b76aff021a

SHA256
0b0070c4bb62536d32348cdc500f1f32261986bee7df85ce17e3a705a85952a0

SHA512
8177a30b441fcb282d02090b6ae364c68d4ac0c531e45f4bc5e36ad2f3060b2c8dcbc78f0ba9903683c405601e8cc83d02bb30ec90e127abcb694e1befa0517f

Download Submit
memory/2272-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2272-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2720-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads