Analysis
-
max time kernel
119s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
14-08-2024 00:21
Static task
static1
Behavioral task
behavioral1
Sample
0926eaa23d8a639a96a972318d421870N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
0926eaa23d8a639a96a972318d421870N.exe
Resource
win10v2004-20240802-en
General
-
Target
0926eaa23d8a639a96a972318d421870N.exe
-
Size
35KB
-
MD5
0926eaa23d8a639a96a972318d421870
-
SHA1
4746888051b2656f328f3aec8d5c620abe3ae47a
-
SHA256
3ce9ccbc0831a430c98198d1735582e8781706d3aaa772b2fed1a1ffc569d470
-
SHA512
01d2b788ba46cd9c907d693b42c1f1e72238699bd27319de5d87660a3164902d6d2177e93d299f916cf89575986203a394f63184dbcd7946b975629bdb0e856c
-
SSDEEP
768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6Im:e6q10k0EFjed6rqJ+6vghzwYu7vih9G6
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2664 microsofthelp.exe -
Executes dropped EXE 1 IoCs
pid Process 2664 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 0926eaa23d8a639a96a972318d421870N.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\microsofthelp.exe 0926eaa23d8a639a96a972318d421870N.exe File created C:\Windows\HidePlugin.dll microsofthelp.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0926eaa23d8a639a96a972318d421870N.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2924 wrote to memory of 2664 2924 0926eaa23d8a639a96a972318d421870N.exe 31 PID 2924 wrote to memory of 2664 2924 0926eaa23d8a639a96a972318d421870N.exe 31 PID 2924 wrote to memory of 2664 2924 0926eaa23d8a639a96a972318d421870N.exe 31 PID 2924 wrote to memory of 2664 2924 0926eaa23d8a639a96a972318d421870N.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\0926eaa23d8a639a96a972318d421870N.exe"C:\Users\Admin\AppData\Local\Temp\0926eaa23d8a639a96a972318d421870N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Drops file in Windows directory
PID:2664
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
35KB
MD565f843c52935b7e5ca674ae581315a85
SHA16072a5b0bc4e02aa608b40331737ad8e6f3d40c1
SHA25667c06fc3da647a622f91d7fd78725cd55077a9d0548f72c470dc0869ca006e53
SHA51211d3705a7363ddb335fff4f9ebbe2c03c5bf6f3f6208ef3f29a4eeb720759e9a4463dfa54cfaaa1f1654808475d844a9a6c21e86802b31ccdc594c6c9198f95e