Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/11/2024, 21:57

General

  • Target

    4a3c8dd1d716ae16de2322439014ea29acf0b900bf41ed47d86e62977c503078.exe

  • Size

    50KB

  • MD5

    e2c8ab6ed01405df15164ac7ec03a5cc

  • SHA1

    4fffd6a4a4eca213037688eb67d60da107dd1c38

  • SHA256

    4a3c8dd1d716ae16de2322439014ea29acf0b900bf41ed47d86e62977c503078

  • SHA512

    5a49d1332586dc5155bce8215ac3d7129f208aaba82b28f3434a27f580a24d34a6218db2ae6e8d083d35a31b6a37e3f9d5e38a73409e1f2a46bf314976cf91be

  • SSDEEP

    1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIb:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVR

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a3c8dd1d716ae16de2322439014ea29acf0b900bf41ed47d86e62977c503078.exe
    "C:\Users\Admin\AppData\Local\Temp\4a3c8dd1d716ae16de2322439014ea29acf0b900bf41ed47d86e62977c503078.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2844
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1464

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    50KB

    MD5

    280a671508ac84a003da0263a4b6be99

    SHA1

    dcbf24dd7c55b4dd2a5501b57c49791ae689e2f1

    SHA256

    0237235829417a3b3aa21f75a74aca51ab1a446c225e5a61417a3bc57d2843f1

    SHA512

    b280e9334c2f539d4480043d1f271a9ea81685e7d13c754d772ab9e8158431084be6704a2636759d6d02b43661e0177c8c102d3219af3ad56430938901f63620

  • memory/1464-6-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2844-0-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB

  • memory/2844-4-0x0000000000400000-0x0000000000403000-memory.dmp

    Filesize

    12KB