eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5

Analysis

max time kernel
120s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
19/09/2024, 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe
Size

55KB
MD5

9ebc0ac55cb91b86bd6e7479b1f68460
SHA1

8ba531d547951582d20d77c8281ce61eb1a864e1
SHA256

eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5
SHA512

bc2139559c9f2e97939ba6d7622bb31d9cda17d95b47434f9ff3b5d733d8eb038c73249d669afc251e8620e6e5cd980eff67416c1d3b51be20cbf41f83dee57e
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhI4:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVi

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2236	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2236	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-457978338-2990298471-2379561640-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2524 wrote to memory of 2236	2524	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe	30
PID 2524 wrote to memory of 2236	2524	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe	30
PID 2524 wrote to memory of 2236	2524	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe	30
PID 2524 wrote to memory of 2236	2524	eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe	30

C:\Users\Admin\AppData\Local\Temp\eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe
"C:\Users\Admin\AppData\Local\Temp\eb6184541102f7fa0ba7638f70e305d3577f358423cf58aca506e7302d0dacc5N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2524
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
55KB

MD5
c78e0d638737f0ec730d34ab236372ba

SHA1
26a435f50beb789c789ed38d33c664f686116d5d

SHA256
6e409555cb195f6f49cda7cae4dc73751bf227ae52710db6eab51341bba069c3

SHA512
de0582fcd899b56345ffc9aa84b9a4c2fa0840b7d9f792b21f5262ce144ba4568c17a7dd440e037845ce395df55e25dca47e91995ae4579756bf196005ee3f3e

Download Submit
memory/2236-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2236-11-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2524-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2524-6-0x00000000001B0000-0x00000000001B3000-memory.dmp

Filesize
12KB

Download
memory/2524-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads