e115dd6cf12b2e1680e51cc1ef0fe05e63c1a86665fe989c8dcc14c0a5711616

Analysis

max time kernel
119s
max time network
126s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 19:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e1eff9986f57e8a0fbaf53781eb83d20N.exe
Size

45KB
MD5

e1eff9986f57e8a0fbaf53781eb83d20
SHA1

cb0a33902d12483db274728703d0b6231dbfde94
SHA256

e115dd6cf12b2e1680e51cc1ef0fe05e63c1a86665fe989c8dcc14c0a5711616
SHA512

a7eaf1f5d48dd7c2f5abe24317bcc809f64559eb208c75ebf1f2ccdc0ac7491460e1c7731025fbcccfc71775382c48ff9a9033a88001ca38bc8c01748c6070a2
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh1:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYV

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4500	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4500	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	e1eff9986f57e8a0fbaf53781eb83d20N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	e1eff9986f57e8a0fbaf53781eb83d20N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e1eff9986f57e8a0fbaf53781eb83d20N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4516 wrote to memory of 4500	4516	e1eff9986f57e8a0fbaf53781eb83d20N.exe	84
PID 4516 wrote to memory of 4500	4516	e1eff9986f57e8a0fbaf53781eb83d20N.exe	84
PID 4516 wrote to memory of 4500	4516	e1eff9986f57e8a0fbaf53781eb83d20N.exe	84

C:\Users\Admin\AppData\Local\Temp\e1eff9986f57e8a0fbaf53781eb83d20N.exe
"C:\Users\Admin\AppData\Local\Temp\e1eff9986f57e8a0fbaf53781eb83d20N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4516
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
45KB

MD5
d22aae43c7015912920302c864c74074

SHA1
23adfce7fddec7e5a623ca8a6064ec5569415d7b

SHA256
244594d85e059dbbc17eeb24c7dd6026057c6ecd87d5b2163bf6fb471e186f31

SHA512
cc43ee78225c7db0d4e2843bc5d9c32cda217c2d40c33d0ca0a77294f2e8250e1f0c20a2b31aace474e9f5b7a1269f61fe0ceb182d67be3e0dc9effdbb40c4bf

Download Submit
memory/4500-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4516-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4516-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads