f90ead3f045e8bf404d4f2663cef21722c1ae0a19f7e9d6efbfe754b4689267f

Analysis

max time kernel
119s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27-07-2024 21:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

08e0cdc3aa73d78b17f582998fbb04f0N.exe
Size

46KB
MD5

08e0cdc3aa73d78b17f582998fbb04f0
SHA1

5aa78da6dfac1d0adba3fe4869317a996d0f6bc0
SHA256

f90ead3f045e8bf404d4f2663cef21722c1ae0a19f7e9d6efbfe754b4689267f
SHA512

23d07a394704a22fa707ad84687fc2c25444d1902d0d4fe665166c97758b8c764e2703a3acfcf098752998d99db9ded2ef2d58afd907dadc62b66c2421fc3d1b
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhE:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYk

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3164	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3164	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2990742725-2267136959-192470804-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	08e0cdc3aa73d78b17f582998fbb04f0N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	08e0cdc3aa73d78b17f582998fbb04f0N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08e0cdc3aa73d78b17f582998fbb04f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 3164	1640	08e0cdc3aa73d78b17f582998fbb04f0N.exe	84
PID 1640 wrote to memory of 3164	1640	08e0cdc3aa73d78b17f582998fbb04f0N.exe	84
PID 1640 wrote to memory of 3164	1640	08e0cdc3aa73d78b17f582998fbb04f0N.exe	84

C:\Users\Admin\AppData\Local\Temp\08e0cdc3aa73d78b17f582998fbb04f0N.exe
"C:\Users\Admin\AppData\Local\Temp\08e0cdc3aa73d78b17f582998fbb04f0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3164

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
46KB

MD5
f7b7f83561e6b7cdd7de76b76c7c560c

SHA1
ed8edfb32c7b1ee6687c1eac19e5e72e73308255

SHA256
22ad60dc812160e7612fe11a3f683208f33e9be0ae118d491d34f47163371fe9

SHA512
2866f0d6260074e0c48c46f26b8b97ebac128564215af31801d2637e7203711b30fa9e722b39a0f33b3068324d867a2d37e5ddee53fb59252d954060fe0e1a06

Download Submit
memory/1640-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1640-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads