f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5

Analysis

max time kernel
149s
max time network
18s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
02/08/2024, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe
Size

42KB
MD5

25a2f65274ccb2a5f1ad9a5b8eb99c3a
SHA1

6302d8e44f42c15ff34ed29e82c3151ed192918f
SHA256

f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5
SHA512

34a0f4d91c6c91624e20eba47091e47e95859646a010f571fc28799dc5d80177468384f27a30b9409486d84248ab9a944afd8fc4acc794c1b40d37976175c6c3
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh8:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYc

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1728	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1728	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1728	2152	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe	29
PID 2152 wrote to memory of 1728	2152	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe	29
PID 2152 wrote to memory of 1728	2152	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe	29
PID 2152 wrote to memory of 1728	2152	f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe	29

C:\Users\Admin\AppData\Local\Temp\f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe
"C:\Users\Admin\AppData\Local\Temp\f72c564b6d0f6c3e775d4d2b519c7e18df0c06bfa22d6473114c3d0c8a46e5a5.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
42KB

MD5
b49d7cf35ae9badd67cf028a26fa0345

SHA1
c08797023e579e6ff27489de11a296b348372e47

SHA256
b5bf88e54fd350fcbb70bc54f6afc047a4f4bc3e67f55a1b3f02bb2dd1f44685

SHA512
2fc8e60c209189f10301867e1a5bb740cf3954667d44f26f58bd9d3fdd88a2a79ec5fcf8c0045ca02016f0fa64e1fed869885622cfbf3ed2971efa405a979999

Download Submit
memory/2152-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2152-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads