53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87

Analysis

max time kernel
149s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 22:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe
Size

64KB
MD5

399e220605f4c1a7b43cf7c8482f2896
SHA1

f0abda63cf90b39c3462f134820ea6da91d78a04
SHA256

53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87
SHA512

c69435e71e91ae61e4f9817d41d9104f749b00d2274d1ec92872a5d0410b631ddce14049625e0cb74e16ca30b1d0a3b266abeb79595e91edb9961d1755f3791f
SSDEEP

1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uZd7ZYho:lAo1lOwvlKlXBP6vghzwYu7vih9GueIe

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2908	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2908	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2388 wrote to memory of 2908	2388	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe	29
PID 2388 wrote to memory of 2908	2388	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe	29
PID 2388 wrote to memory of 2908	2388	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe	29
PID 2388 wrote to memory of 2908	2388	53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe	29

C:\Users\Admin\AppData\Local\Temp\53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe
"C:\Users\Admin\AppData\Local\Temp\53873b204a0d854938ad76b7b350182b606d4b824f9806e31c3efebc69926c87.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2388
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
64KB

MD5
8b6b4b8164814284b337ede5a9d4e40e

SHA1
b7d5a3e5bef34a5b76a270e0e235aab23bc327b5

SHA256
71fce4363d36a562feec037fd622b5ede32bc58ecf23e4956baca8359ad36d96

SHA512
b33c0b0661828c1c84ac2139108bd7d04e1d012d25e77c8cf173123d4550dd0eaa331c6663a65ce10c7ea63be3f208f5cbc646093e6ebda5df768dec6976b020

Download Submit
memory/2388-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2388-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2908-8-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2908-10-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads