263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2024, 03:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe
Size

40KB
MD5

b9c6e92dc5f721ea219045cd72f92020
SHA1

ae26de478510b45352b67ef60d2597f67ecc213e
SHA256

263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989
SHA512

553860e0bb387f635250910df57581b8a105a60bde95e5358fba0370342afe0038961518d4ba99f706db533976d66968a54fc9a2ed437e8f69fff8cb40a18081
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IR:e6q10k0EFjed6rqJ+6vghzwYu7vih9G1

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3824	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3824	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3248 wrote to memory of 3824	3248	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe	82
PID 3248 wrote to memory of 3824	3248	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe	82
PID 3248 wrote to memory of 3824	3248	263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe	82

C:\Users\Admin\AppData\Local\Temp\263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe
"C:\Users\Admin\AppData\Local\Temp\263b5941626c7d5a9f59f7bd64b0ee92c6e7810aaa73dd1d8cf98d812b31d989N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3248
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
40KB

MD5
6912682e7d75b7e068c6ab92f5f264cc

SHA1
0f0fcaabbb6716b914fdc281ff84599e4cbf23db

SHA256
a60a900b3d64eac8f48265065ca65b87ab812272b4a5717d29bfd896affd9a90

SHA512
d78d9fd7e23d77817a211dc05826566f8c8764a43a1068fbe896b96364f6e6001e0c9ea3a062ddeb99414f9b2e2497400a4298b1a4a0c8d44bfa96deb7126959

Download Submit
memory/3248-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3248-6-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3824-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads