0e0ead189be90ab96f34c4f357530bf6232ef17afca745843fd92014397bda67

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 11:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

782376c692a0d3c76f68dde2fc6f5c60N.exe
Size

43KB
MD5

782376c692a0d3c76f68dde2fc6f5c60
SHA1

5bc2c232031268efccb15e6f6204fb3068702bc8
SHA256

0e0ead189be90ab96f34c4f357530bf6232ef17afca745843fd92014397bda67
SHA512

70d87558145d365fe5c17fb5ec5ab12c8dd354e8d9e7f89d8e747b55f9939f3bd715d965fc864520ff4f7887430253f020aeaa210833c8ed3fdfceb05aac78c3
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhH:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYn

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4380	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4380	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1194130065-3471212556-1656947724-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	782376c692a0d3c76f68dde2fc6f5c60N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	782376c692a0d3c76f68dde2fc6f5c60N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	782376c692a0d3c76f68dde2fc6f5c60N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4164 wrote to memory of 4380	4164	782376c692a0d3c76f68dde2fc6f5c60N.exe	84
PID 4164 wrote to memory of 4380	4164	782376c692a0d3c76f68dde2fc6f5c60N.exe	84
PID 4164 wrote to memory of 4380	4164	782376c692a0d3c76f68dde2fc6f5c60N.exe	84

C:\Users\Admin\AppData\Local\Temp\782376c692a0d3c76f68dde2fc6f5c60N.exe
"C:\Users\Admin\AppData\Local\Temp\782376c692a0d3c76f68dde2fc6f5c60N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4164
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
43KB

MD5
e933a516e9a8e7b4b816fc7982c8a386

SHA1
056cb89e802260bc8b25a2c80098befa6e8c8c0c

SHA256
ffe65d458c9a48e54ea27282c2e1a25dfd64010743d938076a63cee6401d80a7

SHA512
c9374493f718df9894b0d84b2f0b67c01892083b35f3ff10de25b9b8b6fbdd7631c6aac8a9e795b09de3a2f2f750b095c43b6add86a1a80a6c841c3ad0d2bef0

Download Submit
memory/4164-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4164-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4380-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads