52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 17:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe
Size 64KB
Sample240925-v94cmayarr
SHA256 52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1
MD5 6434d4d6913c7024b3d5e5daf2dfc210
SHA1 f982ce171f146b4eaf18da2e9c5c67f9a8389140
SHA512 9c1951d4badf391ac62a1c77ffb7243983199d0aeb505dc93e84f8a1984b0daa6660e63ca6d64b9cc7e25b50dd08617c906ca77162cdbe8f9fe7028349a2cd80
SSDEEP 1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uZd7ZYh9:lAo1lOwvlKlXBP6vghzwYu7vih9GueID
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1224	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1224	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 1224	2240	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe	82
PID 2240 wrote to memory of 1224	2240	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe	82
PID 2240 wrote to memory of 1224	2240	52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe	82

C:\Users\Admin\AppData\Local\Temp\52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe
"C:\Users\Admin\AppData\Local\Temp\52e78a8f5519e56a8f85e924645b34076d9147b53bfc271d9defc87faa9922e1N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 64KB
SHA256 d1ea7d6e585ccbb813cf6afe36fc1618705f1272c2542abd3807cbb5b39ebf89
MD5 454aeb73b4e25a75519efd2cd9363fca
SHA1 73be7d1fcb1e04fe0be3fac7dc5724b9f64aab8e
SHA512 bc241ff162f0191fae01fe3119f607f3fee0fe32368cd66b2c7686b503266b1e98978dd4b4784367f34d8cc3a17cea227d32ee697b09ba8809597d8e09f7a8d5
SSDEEP 1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uZd7ZYhS:lAo1lOwvlKlXBP6vghzwYu7vih9GueIk
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1224-6-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2240-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2240-4-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads