29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755

Analysis

max time kernel
118s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
01/10/2024, 01:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe
Size

56KB
MD5

b21c8203f1f4a96e238033b69910d310
SHA1

e24962565e9a787e56c1a8160881f3db22e2b9ca
SHA256

29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755
SHA512

ed9db2b25bcec0626575ac4f1c31f600d8519e7dbdf9a79848622a81edb4034b9c44cf7c6bdee2c0435892914a5579b36e366f28c860e0da750793755c4c94d9
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhI5:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVP

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2416	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2416	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2916 wrote to memory of 2416	2916	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe	30
PID 2916 wrote to memory of 2416	2916	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe	30
PID 2916 wrote to memory of 2416	2916	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe	30
PID 2916 wrote to memory of 2416	2916	29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe	30

C:\Users\Admin\AppData\Local\Temp\29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe
"C:\Users\Admin\AppData\Local\Temp\29d0baf107b2218698e558555f01f629fa2000fe2447d1a60389dcefaa02f755N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
56KB

MD5
7b208b0357f1b7c8731dc1b49e340b24

SHA1
755399a63f953d3b536b5d942e457da796343aa7

SHA256
10ff405caec7c3104055c9d25b8829551160d8e5b19c2e36145a8ce271867057

SHA512
084e8648127c119d40d961c3c57df8a68282115d70ff43ed1de8d13b47d6ff4cf39975ac03c7ff646c21946aa07094ef25016f6d60ee100301559c59d29cd72f

Download Submit
memory/2416-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2416-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2916-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2916-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads