92a409285dd8f6016ff088db400e15261e3a7530ab427d449a25f0c0446490d9

Analysis

max time kernel
119s
max time network
16s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
08/09/2024, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d4ab4cf0034be757440a151ec8bf92d0N.exe
Size

41KB
MD5

d4ab4cf0034be757440a151ec8bf92d0
SHA1

427c06f08d17f80de4fa25e799f774eed4433d48
SHA256

92a409285dd8f6016ff088db400e15261e3a7530ab427d449a25f0c0446490d9
SHA512

fa2072237af8f2a37989edab126fbbca19c48295959acb2bcb7cb0e3d7629684dbffe21d7addfc8bfa4d561989d5c897163b086fc4fcb4b510c2039099bedc7f
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjUvJjWHu:e6q10k0EFjed6rqJ+6vghzwYu7vih9Gr

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3028	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3028	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	d4ab4cf0034be757440a151ec8bf92d0N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	d4ab4cf0034be757440a151ec8bf92d0N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d4ab4cf0034be757440a151ec8bf92d0N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1880 wrote to memory of 3028	1880	d4ab4cf0034be757440a151ec8bf92d0N.exe	30
PID 1880 wrote to memory of 3028	1880	d4ab4cf0034be757440a151ec8bf92d0N.exe	30
PID 1880 wrote to memory of 3028	1880	d4ab4cf0034be757440a151ec8bf92d0N.exe	30
PID 1880 wrote to memory of 3028	1880	d4ab4cf0034be757440a151ec8bf92d0N.exe	30

C:\Users\Admin\AppData\Local\Temp\d4ab4cf0034be757440a151ec8bf92d0N.exe
"C:\Users\Admin\AppData\Local\Temp\d4ab4cf0034be757440a151ec8bf92d0N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1880
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
41KB

MD5
54c531cd4ca6a06a4356fcfa1bfe8faf

SHA1
8920effe1e14d6bd65e7583b1af1d8bb9b294bad

SHA256
c747b6f16f8143e9a1f0ca14116797e4e0f8854254261b25c6ebc043d2cf8f2b

SHA512
6a9901b6712052eebb4808a92197f82b32a00cfc438a6ea70384a3654bcf413e9f7c47bdcc433be46cecd2e3de29483ba5cedcc972c2e634b2a4f2758ec237ce

Download Submit
memory/1880-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/1880-2-0x0000000000220000-0x000000000022E000-memory.dmp

Filesize
56KB

Download
memory/1880-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3028-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3028-12-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads