Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240708-en
  • resource tags

    arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
  • submitted
    17/08/2024, 07:46

General

  • Target

    6fa03a7b41cce8f43089f6d8e85cb9a0N.exe

  • Size

    44KB

  • MD5

    6fa03a7b41cce8f43089f6d8e85cb9a0

  • SHA1

    ccd08d959c00c6cb6412482450f56b7eb40f7978

  • SHA256

    666fdb01170c20ba8bf30acfeb53a949f2c66bf02dce15d95f5426d053b187af

  • SHA512

    b587edf452437670eacba4d75e14fa339b8cd328219e4db19305ba87ebc736f0e16c5cfa41cb092f14209775f0a9367b18894887f1db1e013e7ccacb786255bc

  • SSDEEP

    768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNho:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYI

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6fa03a7b41cce8f43089f6d8e85cb9a0N.exe
    "C:\Users\Admin\AppData\Local\Temp\6fa03a7b41cce8f43089f6d8e85cb9a0N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2972
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2064

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    44KB

    MD5

    08efde9c1f0beab18a61030d9e31dabc

    SHA1

    0ebe549bd70317c8efbd12665cf3768ce9f1473e

    SHA256

    c13c02c7e078571e9adcfc1a57b3e6187bee02bfb4eae5e2d8b487fd6bf24aff

    SHA512

    e82e756337c55ad73629aa031b2ec7f44003bbd47073fdde49ecfd32d143e80b18db24dbd83c25c56ce43b6a17046a37cb0b3db54c329150f9ed88d701559555

  • memory/2064-8-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2064-10-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2972-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2972-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB