ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014b

Analysis

max time kernel
120s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 21:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe
Size

75KB
MD5

33edf2a91e70f2444719a970067fde00
SHA1

109943dbe5ea301034e17f97a01242ac78bbc495
SHA256

ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014b
SHA512

3b52635c3656bcd1f153385a8ff211631c17d6c8c5544236dfcfc5bfd48d65fa5b0b000e1b83ff5e8a606d1705479bcbbdb068f2af9fb9d76c5437be9c552143
SSDEEP

1536:86RAo0ej2d6rnJwwvlNlIUBvsI7hrhEh9cpDN43vBKMvWPqH5kYhpvEHchVvhESQ:xAo1lOwvlNlXBvsI7hrhEh9cpDN43vBI

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3348	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3348	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 3348	4696	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe	82
PID 4696 wrote to memory of 3348	4696	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe	82
PID 4696 wrote to memory of 3348	4696	ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe	82

C:\Users\Admin\AppData\Local\Temp\ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe
"C:\Users\Admin\AppData\Local\Temp\ab628d6a4c5feeb5c29b25b007bd0e1053018607061acd0a70aaf32ab6e0014bN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
75KB

MD5
f25531747fbbac95135caa5d658db4d9

SHA1
c421336e1c84a984da4b5cf36a2c19df4887a926

SHA256
53d511fba7cf5428291d003f662aad7df5a389440c98d56fb56a57e0fd32684c

SHA512
5c43e547bae2cde976b07ddf9ae654f639a980036be7c3a80a5fe32ae50e0a19ac83d15af4efa91ab057ee8364349059bab019e7c977d0c757cfe708a01b8153

Download Submit
memory/3348-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4696-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4696-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads