8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140f

Analysis

max time kernel
119s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04/10/2024, 08:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe
Size

64KB
MD5

54cd96dfdc458da87bdcbb2cd9e45b00
SHA1

2b67658590a018bb5d92f38874ff84da3ec88e19
SHA256

8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140f
SHA512

ec08e68317447273ebcde3ae6e1a9ffc51a04980adb00d9f2b5e5191b98a93cb76cf53e4393fb4f5bc56dee9cffb203158dd27aba85fef0476f7524e7b5d1fcd
SSDEEP

1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uZd7ZY82:lAo1lOwvlKlXBP6vghzwYu7vih9GueIz

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4024	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
4024	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 4024	436	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe	82
PID 436 wrote to memory of 4024	436	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe	82
PID 436 wrote to memory of 4024	436	8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe	82

C:\Users\Admin\AppData\Local\Temp\8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe
"C:\Users\Admin\AppData\Local\Temp\8b57ef0eca7de4b5322f021bc00fd844ebb2d215a1e8ca6d0626b7b77f6a140fN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:4024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
64KB

MD5
dcde62fa960b1ec2f1f1f4fbd0d7fb14

SHA1
54e58f777a5fed8ea4c36a854625b9b84264d2ad

SHA256
14d3cb8d7c1abff3017f8742a9bedebba13d5e676a0db995d2fe1c3891f3673b

SHA512
178777135253f0ef66c50903f3ffeefdc3124be5eda443a64c4132c454dc26ea385a84766ad37ba6336bc6c18eead74fade58fec6af12f938ff208695712bb27

Download Submit
memory/436-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/436-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4024-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4024-7-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads