7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc

Analysis

max time kernel
149s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
29/09/2024, 22:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe
Size

43KB
MD5

fe9c4a8aa211fdb0bb9d405dc631bedd
SHA1

4930c2f0e5a21700a4ff5e21c7693a5786d8904b
SHA256

7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc
SHA512

d85ae4f265f8f4b9abfc85260ea047e3c1790c68696d6a868aa7a1be267dd8169c27a24d83fc3d41ba2356ab00104cc7aa6c6124062f7609aed33768f474ac77
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjUvJw3/B:e6q10k0EFjed6rqJ+6vghzwYu7vih9GW

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2132	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2132	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2132	1924	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe	30
PID 1924 wrote to memory of 2132	1924	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe	30
PID 1924 wrote to memory of 2132	1924	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe	30
PID 1924 wrote to memory of 2132	1924	7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe	30

C:\Users\Admin\AppData\Local\Temp\7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe
"C:\Users\Admin\AppData\Local\Temp\7054c4adecfa94cc9e970683927ff74b0628c2326df27dda0f7ec7ddd121f7fc.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
43KB

MD5
ced1bc4a44a5c6696c48eb8cd3d4be61

SHA1
626c7d979dbf442d580d1be8a1a399d8560e5c39

SHA256
0983701a224ed20e4f6a38ffa320788324c315ba9768e1dfa818de5756867d9d

SHA512
5eba4fb2a316f2d4920c5d22ab0d97d5a13b9bc6822100e680dfed6558bf672dcd6b62c25ad6ce4abc80592b02947a4e8fb9da055c589691b3711fd55812e16a

Download Submit
memory/1924-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2132-8-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/2132-10-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads