9fea5d979634e4d66db6512dc724cecd2279af23772a0b26b7e87a32afac686b

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/08/2024, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ca87eaeeea53f3cd1130d2885f136650N.exe
Size

118KB
MD5

ca87eaeeea53f3cd1130d2885f136650
SHA1

d27a74b640390fc5776d1685d4d8aa4a16289257
SHA256

9fea5d979634e4d66db6512dc724cecd2279af23772a0b26b7e87a32afac686b
SHA512

d774615f2d10a2fb0cdc8a7c1330a02fd31a0c3200f43e06ad3e20d13cc46d963952dcd23d498534a1e983d350a3155d76038c0e27eb0c4ea65ea631906fe183
SSDEEP

768:FPy56wTz/A780mpqiHZplRRqpd6rnxn7A4xifivsWdvbh7iMTh:F6RAo0Yj2d6rnJk4IUFdvbh7iMTh

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4060	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4060	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ca87eaeeea53f3cd1130d2885f136650N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ca87eaeeea53f3cd1130d2885f136650N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ca87eaeeea53f3cd1130d2885f136650N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4060	1372	ca87eaeeea53f3cd1130d2885f136650N.exe	90
PID 1372 wrote to memory of 4060	1372	ca87eaeeea53f3cd1130d2885f136650N.exe	90
PID 1372 wrote to memory of 4060	1372	ca87eaeeea53f3cd1130d2885f136650N.exe	90

C:\Users\Admin\AppData\Local\Temp\ca87eaeeea53f3cd1130d2885f136650N.exe
"C:\Users\Admin\AppData\Local\Temp\ca87eaeeea53f3cd1130d2885f136650N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4060

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4260,i,2727319350781907497,7925939240893079607,262144 --variations-seed-version --mojo-platform-channel-handle=3852 /prefetch:8
1⤵
PID:4820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
118KB

MD5
e1967d558ce9a884ba5cc5083e1d961a

SHA1
fd8bf0666123b77c313c1797453e3e5b759bc193

SHA256
1b2d24fc6fb479efc1d68fa52f3dbb46a9fe04da684a28dbfdd2617aaba2329a

SHA512
0c8f0c4e3b699aa282c70282876f750792cb457dce761cd1284a97383b9d8ca0120c8fdc2948878c3f7d4fa2ac72de822cf66fee50a3989293135b83e35d7c59

Download Submit
memory/1372-0-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/1372-5-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4060-6-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download
memory/4060-7-0x0000000000400000-0x000000000041D000-memory.dmp

Filesize
116KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads