58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917e

Analysis

max time kernel
120s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 23:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
Size

38KB
MD5

d7444ea85d230e4a4255d77c157791f0
SHA1

8e7cd0f442e90d562b6ec3b92c46bda93b2f0a0b
SHA256

58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917e
SHA512

054b27461ae83847ade6438bc7edaa1ffe927e3fba0d53985bd3f9ef1214c3f35c051b60d63afa5e2744c419963a8039095b29a596f127bc48d65e3da5d5ac37
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhD:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYj

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1780	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1780	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 1780	4476	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe	83
PID 4476 wrote to memory of 1780	4476	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe	83
PID 4476 wrote to memory of 1780	4476	58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe	83

C:\Users\Admin\AppData\Local\Temp\58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe
"C:\Users\Admin\AppData\Local\Temp\58564ed5d2cae7921f0c415cd09a4e9c54e52f9f33b33acfc2aa015882fb917eN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
39KB

MD5
e6260f8254c9a67aaee805e83b0e2b68

SHA1
eaf4fc6ced499ec214a481b08d44233c6fc233f0

SHA256
09930764c96f708e28b82481eac2c1f881f35bbb1b80a479eb685fd5372acfe4

SHA512
b755b5c5d71dafc93ad8af6a524704deb3168d05287dc9acb147495ee54a494a9352efc89fd6faed5f2300dafbc6ba38184d88ce796030c5307718e44c73f2c3

Download Submit
memory/1780-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4476-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/4476-4-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads