68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8f

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-09-2024 11:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe
Size

66KB
MD5

81a73c2e73f416a0a80a201a26af0d10
SHA1

0045833eba8a70a0156351412f6c08d579051350
SHA256

68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8f
SHA512

0565c92e80581864a4c24852b5c4cf73d5ef7ea76be65c02871782f8e4479a7a1eb0e26f93fd4fd0acdaf3b119ceb56980bf53949f7fc95a1d52a00a28caa7a6
SSDEEP

1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAcBHUIF2kvEHrH1hys:lAo1lOwvlKlXBP6vghzwYu7vih9GueIF

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1232	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1232	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2676 wrote to memory of 1232	2676	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe	31
PID 2676 wrote to memory of 1232	2676	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe	31
PID 2676 wrote to memory of 1232	2676	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe	31
PID 2676 wrote to memory of 1232	2676	68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe	31

C:\Users\Admin\AppData\Local\Temp\68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe
"C:\Users\Admin\AppData\Local\Temp\68bcce4c79ec61095108105ccc7a1b103da6ad7236305c55b49e50932049bb8fN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2676
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:1232

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
67KB

MD5
3a9566ac44e82f054193542bf3c46fd7

SHA1
4bea890d9a0d278fa6b4a3dc23eebea5e282f162

SHA256
f02c9b66b5979e1096260e59a14c035942f439d18bb88fbee9c85f160c65f8ea

SHA512
5afd5073b9a9e7bd089db0fa65e0a829d0ff1ee95ae9b696dea4611f2309cc0a81dbcf30c27bb1ebd97f0c9ab4ae76b99119588651d40e1a61de7b5a3c782709

Download Submit
memory/1232-8-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/1232-10-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2676-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2676-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads