8142f82f19dfb9bcd43c5ce4f63970f8a6700a858481b7ec9c4f314a977b49c9

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 03:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1987801ad054a1f5a810203ba418f520N.exe
Size

50KB
MD5

1987801ad054a1f5a810203ba418f520
SHA1

536e436cb98fb2138f9e065cd9f5d84b11f564f9
SHA256

8142f82f19dfb9bcd43c5ce4f63970f8a6700a858481b7ec9c4f314a977b49c9
SHA512

b872bc6d6c7732b9501fbc282339f8c3d3d42b5d96a5a2fba618eaace2fff1a511d231d7d59964d05954a441e80bf9481df1258e01e00db33a16d0fdece7f051
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIu:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVQ

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4176	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4176	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	1987801ad054a1f5a810203ba418f520N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	1987801ad054a1f5a810203ba418f520N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1987801ad054a1f5a810203ba418f520N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4004 wrote to memory of 4176	4004	1987801ad054a1f5a810203ba418f520N.exe	86
PID 4004 wrote to memory of 4176	4004	1987801ad054a1f5a810203ba418f520N.exe	86
PID 4004 wrote to memory of 4176	4004	1987801ad054a1f5a810203ba418f520N.exe	86

C:\Users\Admin\AppData\Local\Temp\1987801ad054a1f5a810203ba418f520N.exe
"C:\Users\Admin\AppData\Local\Temp\1987801ad054a1f5a810203ba418f520N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4004
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
51KB

MD5
42bea7bbdfc7faeaf4e6e0fe0913375b

SHA1
832b83a5940153b0a0d9a3bf7f8216123f87b763

SHA256
bdf468661ff167b0299dac2d3fbfab558ce7cac03262a073fd2000c4779d14e9

SHA512
5c4a60250a9cacd64eaa5793a7318594057f2db788bc253b63349ee6f449400e433c245d01cf81055165a0a8d9208a28d2bc60befbe1020cf65146290b3ad3b6

Download Submit
memory/4004-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4004-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4176-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads