b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938c

Analysis

max time kernel
120s
max time network
103s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 10:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe
Size

47KB
MD5

31d5f2ccfd5ab59bf83bdc2225e6e6b0
SHA1

2755740ebfa5b9bcce7d878f4a3e36adb027f44b
SHA256

b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938c
SHA512

b078202a57e41fd8a2ee5522419db92bb4503bab6c135a137a0e76a6b9c256ce9bc5078b2405683adebc86ade010b6c8a1abd4d96f41420443fc47a5efa15c0e
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhz:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYT

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2536	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2536	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 2536	4296	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe	82
PID 4296 wrote to memory of 2536	4296	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe	82
PID 4296 wrote to memory of 2536	4296	b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe	82

C:\Users\Admin\AppData\Local\Temp\b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe
"C:\Users\Admin\AppData\Local\Temp\b0ce40a4be35c125bc5d0f9f50dc5338181243327a4312ba3b875756ea27938cN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
47KB

MD5
85f990282170866f145bbde4cec7bd2d

SHA1
ae231b16a6cccbac4a38976d087afc45068ceb98

SHA256
b5e9f907687cc725b0f8b1c83a7cce56c4c8ac19e5dfd5669730582076181661

SHA512
71513870fcdf8355b6dc738cc822d7b9c9b483feef86af6712b564c33ce1b2ee64a6b63eff449c4c51f5adf238a47e978f9b13245ec830ace368b7308d0da638

Download Submit
memory/2536-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2536-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4296-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4296-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads