1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670

Analysis

max time kernel
120s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 12:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe
Size

42KB
MD5

8caa55e16021bd685cb849552c26bc50
SHA1

d9526573f0015c6955db8f6a38d563eeb8a921d3
SHA256

1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670
SHA512

fb544434b2bf9184b2d9b37fc5ff0c278ef3e74a7062a8c7f3c06c6be3c05a4e03698dd709306603c7b1121b6f3fac38aba8a63801325d2d249dfe36ee20c7d0
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNh1:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYV

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3864	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3864	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 680 wrote to memory of 3864	680	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe	84
PID 680 wrote to memory of 3864	680	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe	84
PID 680 wrote to memory of 3864	680	1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe	84

C:\Users\Admin\AppData\Local\Temp\1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe
"C:\Users\Admin\AppData\Local\Temp\1c093867db296985b00d54773f6079e5ee96734eb5994cca91617051172ea670N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:680
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3864

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
43KB

MD5
56b66fddd17c5392d2dbcca6229e67f0

SHA1
b890ccc0c050d4f0020ce2e23a72b478b46b1bc0

SHA256
f32dfd049fa3d9c6f0f02a231b466c5b99d358c4109ed718fe2531858f73631f

SHA512
bc52e1ee3d9967cd1d3e208d60a461f2c3b0e46deb90c2e4fb972a62a16a4a8aea149c4b4507ab9ccd5c99724624db7b67d2f9101a391ed9538ce8bd093aaebb

Download Submit
memory/680-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/680-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3864-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads