675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00d

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 17:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe
Size

47KB
MD5

70671906704bfbad55f86b25cc813a40
SHA1

5d878309371974fc6c5dd118863f5dea640422f4
SHA256

675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00d
SHA512

b5311c3b5481f97124b5e3114c035f84e6703624aa835005994d8d3e3ac12e79b71781ada7cd3451381d2550d775e204c89610f9b65530bf0cc4987eb5aac623
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYC

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4632	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4632	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 4632	2504	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe	84
PID 2504 wrote to memory of 4632	2504	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe	84
PID 2504 wrote to memory of 4632	2504	675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe	84

C:\Users\Admin\AppData\Local\Temp\675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe
"C:\Users\Admin\AppData\Local\Temp\675078dfef2d25fd4e3b837c603fc77f6e7069e7862005624a519ff969b6f00dN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
48KB

MD5
46faca65a22d4fb34922235adc21e42a

SHA1
76f5783634a64c9a13a8ca954009fe3af0203ac0

SHA256
6cc6095799a2b63420f2b9de8d0e1b81b604d586166353b34fa61807ead14e7f

SHA512
f8568e54c4e3d6990e64bf6ac50113b8bcb51eda7d6591d133892dc73e89f760f46057f00b88fea7b27879aa04f81e449f2a641e222e4145ee73494b850a2e9c

Download Submit
memory/2504-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2504-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4632-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads