3dd8aad57601faf68d9a3b2bdfc457a0a21eb12b074aec499e343c65022e1f85

Analysis

max time kernel
119s
max time network
120s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08-09-2024 03:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

18a25ed40c9771fc673a42fa4bb6b6f0N.exe
Size

75KB
MD5

18a25ed40c9771fc673a42fa4bb6b6f0
SHA1

b332c616eed6c3a5d9a40ba11949d1c9107ea72a
SHA256

3dd8aad57601faf68d9a3b2bdfc457a0a21eb12b074aec499e343c65022e1f85
SHA512

de31ab23a37ab60c63a0dae5241b73aa17a357262b7cac5e5f2d4990bb6b3a1f09f2078f5fffdfb7a4f226c21ba5a22981046c39fa5ba60a942d30ebb854fe27
SSDEEP

1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN/qhAvP3OChhW4dI0h4HCIzhUvTm:xAo1lOwvlNlXBvsI7hrhEh9cpDN/qhA0

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1440	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1440	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	18a25ed40c9771fc673a42fa4bb6b6f0N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	18a25ed40c9771fc673a42fa4bb6b6f0N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18a25ed40c9771fc673a42fa4bb6b6f0N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 1440	2056	18a25ed40c9771fc673a42fa4bb6b6f0N.exe	90
PID 2056 wrote to memory of 1440	2056	18a25ed40c9771fc673a42fa4bb6b6f0N.exe	90
PID 2056 wrote to memory of 1440	2056	18a25ed40c9771fc673a42fa4bb6b6f0N.exe	90

C:\Users\Admin\AppData\Local\Temp\18a25ed40c9771fc673a42fa4bb6b6f0N.exe
"C:\Users\Admin\AppData\Local\Temp\18a25ed40c9771fc673a42fa4bb6b6f0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1440

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4228,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
1⤵
PID:5052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
76KB

MD5
3959e65f1018e1b9223103b0c1bc0e12

SHA1
145992014f3d510a1df556ff75749dbe4a101738

SHA256
0148f8e95a8f1e88e38028918af7e5a02f04d8d4fc7d406427e74ab26dd57241

SHA512
b26f1dd3ae5066d05b1eed05012c263e9f4f37d43d6434733999d4285643841d79057a67e5fc2a0609f8d2e5ea893d91dfe665ba660bb5a9f99e26a51f85f716

Download Submit
memory/1440-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2056-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2056-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads