ae1fba4737921c98458003f583ca4744a5ec798c14b4ed7bb119af3c7f786825

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
07/08/2024, 09:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9b42521890c6576a558896a1fe580810N.exe
Size

39KB
MD5

9b42521890c6576a558896a1fe580810
SHA1

82339a466599bfcdb5a0b4ec6ce330d4319a2915
SHA256

ae1fba4737921c98458003f583ca4744a5ec798c14b4ed7bb119af3c7f786825
SHA512

ff4a51168e4df3f8b95391907b85ebd68fa6aa1ad731a80b3dc701dc2c66db95750e525ef8ce83132612b9d07c8031f2bdc2dda3def07b2868476379c075a5b2
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh7:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYb

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2820	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2820	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3294248377-1418901787-4083263181-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	9b42521890c6576a558896a1fe580810N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	9b42521890c6576a558896a1fe580810N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b42521890c6576a558896a1fe580810N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2820	2112	9b42521890c6576a558896a1fe580810N.exe	30
PID 2112 wrote to memory of 2820	2112	9b42521890c6576a558896a1fe580810N.exe	30
PID 2112 wrote to memory of 2820	2112	9b42521890c6576a558896a1fe580810N.exe	30
PID 2112 wrote to memory of 2820	2112	9b42521890c6576a558896a1fe580810N.exe	30

C:\Users\Admin\AppData\Local\Temp\9b42521890c6576a558896a1fe580810N.exe
"C:\Users\Admin\AppData\Local\Temp\9b42521890c6576a558896a1fe580810N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
47ea69b47bfd7b3121938672474a833d

SHA1
875a0999bbdaf4489f9b30c93125adce92332fff

SHA256
da48f0c66bf8486ce4bc9eb5f475fa890d387ae9d80afb289c99420f9fcf0e1a

SHA512
bf7f479c5f5657dd4463e181a7b864fa3887a6e2461622ffbb1c501d6c1a2cb416c40e60717768bbff3998c78a819a0be96d72ec8bc1ee01711586bcf88918e8

Download Submit
memory/2112-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2820-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads