3403ecf905ba76cfc16235ada3d15e06ea0a2ce4f359d022723f21871d03da16

Analysis

max time kernel
120s
max time network
16s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
20-08-2024 21:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b97d09f9b463f4c64ace395bd6a53960N.exe
Size

36KB
MD5

b97d09f9b463f4c64ace395bd6a53960
SHA1

9a5d6b405a56f6ea547955663f1c910fe8b8511b
SHA256

3403ecf905ba76cfc16235ada3d15e06ea0a2ce4f359d022723f21871d03da16
SHA512

5da47c2c89cdc1d38b16524f07b414bac08ebed79ee7eb7b59b43748d1dc023ae6184d09862f511951645f6835f4da2bf51ef0df743faf2121288bad2300dc70
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+EmkcN:e6q10k0EFjed6rqJ+6vghzwYu7vih9Gc

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
916	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
916	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	b97d09f9b463f4c64ace395bd6a53960N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	b97d09f9b463f4c64ace395bd6a53960N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b97d09f9b463f4c64ace395bd6a53960N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2120 wrote to memory of 916	2120	b97d09f9b463f4c64ace395bd6a53960N.exe	29
PID 2120 wrote to memory of 916	2120	b97d09f9b463f4c64ace395bd6a53960N.exe	29
PID 2120 wrote to memory of 916	2120	b97d09f9b463f4c64ace395bd6a53960N.exe	29
PID 2120 wrote to memory of 916	2120	b97d09f9b463f4c64ace395bd6a53960N.exe	29

C:\Users\Admin\AppData\Local\Temp\b97d09f9b463f4c64ace395bd6a53960N.exe
"C:\Users\Admin\AppData\Local\Temp\b97d09f9b463f4c64ace395bd6a53960N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2120
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
36KB

MD5
924720472b2a881bdea1025e0d8ffbab

SHA1
a84d2e8162b64429aa6b7c5752061ad78da766de

SHA256
ac2d9feea9045267eabfc32bfc5deb8d7c343b30fbf8cd9b49e701d7a5d549be

SHA512
2e765c5da04ef0a39609fcb550a22257c416d85b6156f11eb8925ab5e99b520fa159cfa9dc4646a030555bb68c0c933659867330b637a578c9f68f0a1216667f

Download Submit
memory/916-9-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/916-11-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2120-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2120-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads