Analysis

  • max time kernel
    119s
  • max time network
    97s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:42

General

  • Target

    77d943da7db845a99d567b66eac39c2620a08fafc8bece62e51125ed83b2312aN.exe

  • Size

    42KB

  • MD5

    c6781d400fb8977f034676aea440f1f0

  • SHA1

    1da8973ba1337db0b19ec8f837168a351d4349a2

  • SHA256

    77d943da7db845a99d567b66eac39c2620a08fafc8bece62e51125ed83b2312a

  • SHA512

    d890b2ccf65955b9405ce15a7a804181b2c96de5620ce72a006f8baac0241db10e090a46341d6bae3b505ca0b4fb281db52eaca893ae97382ccae124a737519b

  • SSDEEP

    768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6I:e6q10k0EFjed6rqJ+6vghzwYu7vih9G0

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\77d943da7db845a99d567b66eac39c2620a08fafc8bece62e51125ed83b2312aN.exe
    "C:\Users\Admin\AppData\Local\Temp\77d943da7db845a99d567b66eac39c2620a08fafc8bece62e51125ed83b2312aN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1864
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      • System Location Discovery: System Language Discovery
      PID:4480

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    42KB

    MD5

    67a945a414391d3d79212300849e6806

    SHA1

    0e14cc0ee7c2339046bca2a8a493b02813084f13

    SHA256

    50274f2a93dc2116f59a89caf7bb5566161060171de81fd8062197a5c8a5dbd1

    SHA512

    36e0b913e14aeec3428873197d2ff8cdd958c8d51c0084d10cc163ffbba65808297281cf7958f20aca33e77a1e9c3fbdfdce029721e93701b0f3773d46657205

  • memory/1864-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1864-6-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/4480-7-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB