65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
05-08-2024 22:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe
Size

43KB
MD5

5a42ab9e1e34571c8d7539ab822f4e24
SHA1

76404235aa0fe62d24808afb06f437bd4c620188
SHA256

65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c
SHA512

377e1dd6ac47da00b96380a4d7fd836b34f521a9935df7a9cffb5948f26aef8d3fc890c091baedbfc371a22ea087d7139a98e45d74e9ec476256a984b5985671
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhJ:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYp

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2396	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2396	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1628 wrote to memory of 2396	1628	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe	28
PID 1628 wrote to memory of 2396	1628	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe	28
PID 1628 wrote to memory of 2396	1628	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe	28
PID 1628 wrote to memory of 2396	1628	65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe	28

C:\Users\Admin\AppData\Local\Temp\65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe
"C:\Users\Admin\AppData\Local\Temp\65b518e567cb524f4d18295a394e73957928f6ed42f84ba95b1b4b0f17ed296c.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1628
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
44KB

MD5
170e905d60aaed12f63d6be16fbe01d5

SHA1
0bf22d09da1fa3844b745de9596f1e75ea208c02

SHA256
20d1fee0bfa06d45bd590e4671f0ec04aa14dbbdd18f427bd4c83a7d1f70fcc4

SHA512
8abad3d926707d7eacb7080ffa51e98ad4508a6662948577c71a97e160082c350d2d89e24b069a42088055c036b44a7c17a397380c7e4e0e0eb1d810a1cd439b

Download Submit
memory/1628-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2396-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads