108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680

Analysis

max time kernel
120s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 18:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe
Size

50KB
MD5

4b27dfd5bf2ec8f13da1f599894d7380
SHA1

0ea791c4d8e2bebe1fa71bce71ccacc96238bb62
SHA256

108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680
SHA512

a6a969d87b992c2247e96078c7f17e562ff02fa06b0f6cf18c54ab77646b70599112a3940ce9960e60968034d280b5d017ae3de01b0da265f7fe4e6dfb65c9c3
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIm:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYV8

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2448	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2448	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2448	4888	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe	82
PID 4888 wrote to memory of 2448	4888	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe	82
PID 4888 wrote to memory of 2448	4888	108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe	82

C:\Users\Admin\AppData\Local\Temp\108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe
"C:\Users\Admin\AppData\Local\Temp\108ca35959d865f4b18d49b4f30d5b6e6dba95306b5b41d454219074d29d2680N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
50KB

MD5
2a90d855c6516f9bef0213cd30289d5f

SHA1
b61c14ca87dfe9ad51ffa3520611c8da4d31ad66

SHA256
47fa8823fde3a231b465c84a0c99d0cd8d522681e89d0e166b6ac11786c90bcf

SHA512
616d825ede41a453a5fdddff52e90f560e43e84fed0ae052c1a421f5931d2c63c48ed61de2e6c3a0cb0f4e72653ab6890e6692500d7d65bbe3b389f996812c11

Download Submit
memory/2448-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2448-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4888-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4888-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads