d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe
Size

54KB
MD5

869cec10e65fefb525bac61750b81d0f
SHA1

5de5c0f1730b97d3df95ffc485584431fb6622ba
SHA256

d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166
SHA512

0f68b29ecc28455b66cc3fd619b2c839847bc9081599507f3d927024b6298981919f896fd0b02e790dcb2835dcb328cf005f3b451bc90cb65e3fb030f9c71488
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIb:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYV9

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3344	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3344	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4182098368-2521458979-3782681353-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3268 wrote to memory of 3344	3268	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe	84
PID 3268 wrote to memory of 3344	3268	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe	84
PID 3268 wrote to memory of 3344	3268	d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe	84

C:\Users\Admin\AppData\Local\Temp\d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe
"C:\Users\Admin\AppData\Local\Temp\d55132c7bbd5af3822385c723fdaf285cac41c141ba524a9df3e04ed2177b166.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
54KB

MD5
2501d26b8db2bf933fe3928aec33257e

SHA1
1a7e4415c5247432fe31ab9c851de75b06c833f9

SHA256
01ad4b1b54758c75ee7a9d611c3b113a72ce099ce682157311646f78ab1621dd

SHA512
3a4d6bb7d48e9bafeb6629db6784802815047a8336ca1381a80e7e48ccd4bfd093dce4ab5196b942744e75ac10ad5a7573e894f239adbf11a600c48a39e224ca

Download Submit
memory/3268-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3268-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3344-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads