f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
25/09/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe
Size

39KB
MD5

91e18d796b5cd2b1d45935b8ca9b9cc7
SHA1

201d7fc646077c11a1525d032e5ace57c7f6c42a
SHA256

f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea
SHA512

34842a8bd365fa32298d54218a847b88bef6c5b472989988ae06539cc566a912b7acef8331b8e763348a68885520afdbd919485af2bdf3ad0d30689b9a9c2905
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6v8tvGE9UHrSdghj8bvHRIkhbUIchUh89:e6q10k0EFjed6rqJ+6v8tvGE9UHrSdgH

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2192	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 2192	2868	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe	28
PID 2868 wrote to memory of 2192	2868	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe	28
PID 2868 wrote to memory of 2192	2868	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe	28
PID 2868 wrote to memory of 2192	2868	f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe	28

C:\Users\Admin\AppData\Local\Temp\f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe
"C:\Users\Admin\AppData\Local\Temp\f641835bb0c26097036fdd515db28c71530810d090948793c811fdca6833cbea.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
9080ae90d3baef286a6b6efbd0606aa5

SHA1
c37fbd78fd6467fe83417c448bb9b40072aa6727

SHA256
2819c1f214df0ac333781ab4abf0a08ee7ed8ed574423e769be2b143e2fae0b0

SHA512
87091d6dc557431d30e63f50b7d57ab3c206440d628b9891f0c23f5397bffab44f3978806ded15d3dfa384a9d6911f34d0e7a5ecefeb371859c7533ff78c6bfd

Download Submit
memory/2192-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2868-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2868-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads