Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    02/09/2024, 02:56

General

  • Target

    16f7253b4e82e53573654fe99a23fac0N.exe

  • Size

    78KB

  • MD5

    16f7253b4e82e53573654fe99a23fac0

  • SHA1

    1ad6716ed06dfc9e379709d1fdc2047bba404a33

  • SHA256

    335c23d6b7ee0543594c65daac973952602513908cd391deeca078bfedcc2a7d

  • SHA512

    8b2992b820c31f85c7892331b96d7424bb830d0e8b19b890cbe2fd431ccaa6af73af8de4beed9045c36710b3590b29a1ba28f76f868467de90c9df0586809bd8

  • SSDEEP

    1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvP3OChhW4dI0h4HCIzhUvTv:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhAF

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\16f7253b4e82e53573654fe99a23fac0N.exe
    "C:\Users\Admin\AppData\Local\Temp\16f7253b4e82e53573654fe99a23fac0N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3068
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:2344

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    78KB

    MD5

    0272f4a36c71068f3e2a0920eaf0a5d6

    SHA1

    9dca7bb7a02156742351d770a72064ce31aab2be

    SHA256

    7b9053fcaf63df7677091b8963b8df30e82ff93435d8f5ecb9d06fea881819d2

    SHA512

    2cf89baccf6c564c88cd9a76367a5226163dd1d62480acbc450b1ed64ea9b97e74ab8eada2d6873b133446885f18d6b62d8766042ea744909070a4c39f6527ef

  • memory/2344-9-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3068-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3068-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB