53662e3c8ce8be4db9b2caadc299944099ca280310ecf82bc287826c12a87b58

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240729-en
resource tags

arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 04:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61d24784cafc398a203b2004c4741d90N.exe
Size

34KB
MD5

61d24784cafc398a203b2004c4741d90
SHA1

276e92796cfc6373de8cbc6f10a2d3acc8d08942
SHA256

53662e3c8ce8be4db9b2caadc299944099ca280310ecf82bc287826c12a87b58
SHA512

471fbaea51b062859882d92a2c95ffaa3574987678e9a3e6e25eac0e63e22d9553446ef8eef1724614b00087a71edb7cc1b98a2ecf0cb6b66c5981589e965a8e
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+EmkcL:e6q10k0EFjed6rqJ+6vghzwYu7vih9Ga

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1964	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1964	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2703099537-420551529-3771253338-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	61d24784cafc398a203b2004c4741d90N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	61d24784cafc398a203b2004c4741d90N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	61d24784cafc398a203b2004c4741d90N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2572 wrote to memory of 1964	2572	61d24784cafc398a203b2004c4741d90N.exe	31
PID 2572 wrote to memory of 1964	2572	61d24784cafc398a203b2004c4741d90N.exe	31
PID 2572 wrote to memory of 1964	2572	61d24784cafc398a203b2004c4741d90N.exe	31
PID 2572 wrote to memory of 1964	2572	61d24784cafc398a203b2004c4741d90N.exe	31

C:\Users\Admin\AppData\Local\Temp\61d24784cafc398a203b2004c4741d90N.exe
"C:\Users\Admin\AppData\Local\Temp\61d24784cafc398a203b2004c4741d90N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
34KB

MD5
922839133dcb2d070ce8d6a1c0f7cc36

SHA1
0af1218ffe03aeb40eb1a1c816ac7e1dc85ddc4e

SHA256
ed2c8b97ca4d34db733348c42d0584ec230b4c3cab2a93224cd4e4074357e2a3

SHA512
e852e0aca59b90f2b42f4b3f8ff9b253d7f3ded1e47a9bd8769189038ba5c45804e93b7eb13880f8434fb4639c2e8d2f919466540e2210c1305fde78a13c4ec1

Download Submit
memory/1964-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1964-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2572-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2572-3-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads