c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1

Analysis

max time kernel
119s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 06:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe
Size

44KB
MD5

a47048df5a6a482fe30be0ccfe33ef40
SHA1

be6a5cf0cf393f191d7ca17ef0b204ac7a0c21fe
SHA256

c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1
SHA512

b76f6865bf8a5cb219c565f59e300bf7bfef5447da7b6b68e77a38f900e20d55cc6a9ab82ed14d5210f47d170df060056e297fb16c9c453d20e22a38ef3ff15d
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhr:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYL

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1236	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1236	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3876 wrote to memory of 1236	3876	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe	82
PID 3876 wrote to memory of 1236	3876	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe	82
PID 3876 wrote to memory of 1236	3876	c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe	82

C:\Users\Admin\AppData\Local\Temp\c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe
"C:\Users\Admin\AppData\Local\Temp\c39d73d1aa41183888afce7eb49369b4ab445b6a6b8464732a495faa1680c0b1N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
45KB

MD5
0a0273b34cc7238c6f99d8592e7e3776

SHA1
94977402c4fdbc96df8991f8a66e3b903ccfd56f

SHA256
6c1f2bec7ad9dcb4117ab3e65ce2ac05fc107e8f8700a23864eb4c10608c248d

SHA512
cd6f4f72e059af0ea2385daaff7b96317847bf58f6ad6e2f917dad418ae6594597bce2142e98782d2b688e3d8cfb9e99c3405265909140df7610ee535e1723a8

Download Submit
memory/1236-5-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1236-7-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3876-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3876-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads