14fc540682b88122bd023151f046d501a3d9731e7c306f2dc0685577917c4b80

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
03/08/2024, 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4befd33024147f3bad2a891c18c8d340N.exe
Size

39KB
MD5

4befd33024147f3bad2a891c18c8d340
SHA1

72431cbbaa29345d1e74aaab31bf1b521a7feb30
SHA256

14fc540682b88122bd023151f046d501a3d9731e7c306f2dc0685577917c4b80
SHA512

cabff1abca51f7e6d1daf3e77e9b0a8b9d8ac6793a26bc98ce6af0f9ed66a50ccf58c19f71a7692f782055fa1bc40f0f5bf875c0343b23293c199167efcea97a
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhR:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYx

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2844	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	4befd33024147f3bad2a891c18c8d340N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	4befd33024147f3bad2a891c18c8d340N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4befd33024147f3bad2a891c18c8d340N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2844	2776	4befd33024147f3bad2a891c18c8d340N.exe	30
PID 2776 wrote to memory of 2844	2776	4befd33024147f3bad2a891c18c8d340N.exe	30
PID 2776 wrote to memory of 2844	2776	4befd33024147f3bad2a891c18c8d340N.exe	30
PID 2776 wrote to memory of 2844	2776	4befd33024147f3bad2a891c18c8d340N.exe	30

C:\Users\Admin\AppData\Local\Temp\4befd33024147f3bad2a891c18c8d340N.exe
"C:\Users\Admin\AppData\Local\Temp\4befd33024147f3bad2a891c18c8d340N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
671f1247c1e51a1ff906160df06fa5cb

SHA1
6d65c0f940b9ac6ad63c4ef2f3cbef994407a0ba

SHA256
44f9bc6e1ce134500e24b3a81a54af5855dc166a2e536a5eab1304361a42b1a0

SHA512
270193299aeec78a7011720ff19a9a503b5b3e4a114904a18e3f3b8587a217eeaff4afff99ee0956fde3f09b8dac9524049c6021dd185b1bb0cfdf2ebbc30aa7

Download Submit
memory/2776-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2776-6-0x0000000000230000-0x0000000000233000-memory.dmp

Filesize
12KB

Download
memory/2844-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads