Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03-10-2024 15:23

General

  • Target

    680dd2804df4063bf6164063eb22cd3003544504f67d4a7382d3e9014e62f0fcN.exe

  • Size

    53KB

  • MD5

    c984d5dc33cac61ed1eda47d1b300960

  • SHA1

    258fda39376ebe5dec1d7c64b7520dc921add98d

  • SHA256

    680dd2804df4063bf6164063eb22cd3003544504f67d4a7382d3e9014e62f0fc

  • SHA512

    887531a5167a46fa59daea19a28e4ae1eefa642b31b35fbcbd23a5d6b0e5a8e09766c9786cf53057a2ee549271877dd7e2661a6a794736052e39e1609d23c909

  • SSDEEP

    1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIN:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYV7

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\680dd2804df4063bf6164063eb22cd3003544504f67d4a7382d3e9014e62f0fcN.exe
    "C:\Users\Admin\AppData\Local\Temp\680dd2804df4063bf6164063eb22cd3003544504f67d4a7382d3e9014e62f0fcN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1016
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      PID:2120

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    53KB

    MD5

    f4b358efea2908c5081544935fe81002

    SHA1

    34a43e7815e0c4b5cf835d59eaf5277ebbc3dacf

    SHA256

    ba3b7cfbc899f6c98c3ea9f96d2afec8b2e7f7dbb37faca6a6b52cb5f03b563f

    SHA512

    e5e5050104aad697a3135a1ed7852c6d61b23342d74df3826da672d2baf9a07c48b8c9e595120e16d32f7bbfe0310b830c67ecdd074097fb78dfc6b2f5119010

  • memory/1016-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/1016-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2120-8-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2120-10-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.