6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72c

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21/09/2024, 09:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe
Size

46KB
MD5

88500d4cfa3360582c9ba08a21c63200
SHA1

68866a4dfdb1974da9c53388f710ee6394bd3518
SHA256

6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72c
SHA512

2a1561238240c79ae8b671ad50e06e8aa08f53888238c53b5b9a87ce046235fe153870eb301378922f54aa224bafae039eec931c59b5b812e100f91b2dd2bbb1
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNha:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wY6

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2760	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2760	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2660 wrote to memory of 2760	2660	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe	30
PID 2660 wrote to memory of 2760	2660	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe	30
PID 2660 wrote to memory of 2760	2660	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe	30
PID 2660 wrote to memory of 2760	2660	6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe	30

C:\Users\Admin\AppData\Local\Temp\6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe
"C:\Users\Admin\AppData\Local\Temp\6728691ce8df98f290584c3815232f7b6c7e67bf623a20c21874884b7028b72cN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2660
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
47KB

MD5
e69b3ec8a62c1b31961640313b68f774

SHA1
90ac66f178e0bacd8986d36cdc92b2b95828dcdd

SHA256
d90424104d6abd8c4d826684b8c4110d7812df82976e130bed6998cde7afb8fe

SHA512
d42da46049753f4fdea93ed5a9d63ea0dc883bf632839642726967910b05eddcb88e98abbf4f28b72b54a9a14983a8fb3fafae6016e7322c6685ddbce4af470b

Download Submit
memory/2660-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2660-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2760-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads