ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9

Analysis

max time kernel
119s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-10-2024 09:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe
Size

38KB
MD5

bbd6eb0a8d9b75820e92a694b56c1960
SHA1

2e8262cb77ffca7b4609ca746e7fee427a4c7aa9
SHA256

ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9
SHA512

23726d567156c238282763eb9bc4f29d5b3b588662378b7233435424d2f6fd5f1bbe8d102e369d545ecbf4b10f8ca333b85366d69eecfcab1ba5ac0c69dd04c8
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhi:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYC

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2420	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2420	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2420	1852	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe	28
PID 1852 wrote to memory of 2420	1852	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe	28
PID 1852 wrote to memory of 2420	1852	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe	28
PID 1852 wrote to memory of 2420	1852	ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe	28

C:\Users\Admin\AppData\Local\Temp\ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe
"C:\Users\Admin\AppData\Local\Temp\ec164b81ed97de05d33b9d4454549e7f92479f2ea01cc53b7a714732170b40c9N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
57be2c46383a6ff5edef7d7f03f8ce9a

SHA1
178f2600586e7c8d81a139e28bbf489154df03ac

SHA256
d97a7d12812f53b0e89b3e0996eb2421a312495dc4ef5852a8de0e9d4a287625

SHA512
fcd8accfb6ddda6932baa72dab3b4a241499ba58c3d54ad87cedeffe8c42d180a04c3f4300d325cafc686afd502a323778178425c91d331702ce55101d2ae822

Download Submit
memory/1852-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1852-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/1852-6-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download
memory/2420-9-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2420-11-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads