839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120

Analysis

max time kernel
119s
max time network
18s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09/10/2024, 13:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe
Size

66KB
MD5

45187d337a59a78953ec0b2f4627a150
SHA1

de415017fcbf6df543bd5a2b5c17292f70631269
SHA256

839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120
SHA512

ba21e8bf3dbb4822e7130e203f5d06e8433d0c4c7bf0fb25c4c7f3fb0e81477aaf304fded7f686c59ff61c801459271da55134bfe8292d27c0c0a4dadcb252be
SSDEEP

1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uhIehXehT:NAoglOwvl4ulkP6vghzwYu7vih9GueI/

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2412	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2412	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2412	2112	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe	30
PID 2112 wrote to memory of 2412	2112	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe	30
PID 2112 wrote to memory of 2412	2112	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe	30
PID 2112 wrote to memory of 2412	2112	839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe	30

C:\Users\Admin\AppData\Local\Temp\839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe
"C:\Users\Admin\AppData\Local\Temp\839767560fd4ddba1be8c5b073d72387ac637ff445be57c78b795e6ebfd37120N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  PID:2412

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
66KB

MD5
718b7263dd43049b000d9335830aed73

SHA1
5c60b731a25b9205904f529637696646d0da381f

SHA256
89edb653b6a78dfe016965dc1521d6ae5f9b633d38176787b92dcbfb0e73da0c

SHA512
c6dfc5b3d14a77ac4a4d4f4e95bf611c3a26af0cf62356e30b7b48cd5312e1ed220870afea7c3ddb3c7ba54dabc4abc27ca3f23b9183673bfbd479589d789676

Download Submit
memory/2112-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2112-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/2412-9-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads