Analysis

  • max time kernel
    120s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:29

General

  • Target

    f6e138ede9c3fad6e421bc029463a540fd574f22c8149cf8603dbd7c5d8364edN.exe

  • Size

    72KB

  • MD5

    57716a015b17f2c52bb94bb278050c60

  • SHA1

    f2b66533464f548d48b67b0abd7be16cbf6eb0c8

  • SHA256

    f6e138ede9c3fad6e421bc029463a540fd574f22c8149cf8603dbd7c5d8364ed

  • SHA512

    22e876a07320c1a6168664f719167562a3b5415c1e5a982c0a6c278265337ad73021387fc74b0fa6b7b4843115cc6ea713a0c3775369ba9b02afef526d71199f

  • SSDEEP

    1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbRJhHhLhIKF:NAoglOwvl4ulkP6vghzwYu7vih9GueIO

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f6e138ede9c3fad6e421bc029463a540fd574f22c8149cf8603dbd7c5d8364edN.exe
    "C:\Users\Admin\AppData\Local\Temp\f6e138ede9c3fad6e421bc029463a540fd574f22c8149cf8603dbd7c5d8364edN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2280
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1552

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    72KB

    MD5

    3c5787b7c8139b6b521d2e62c8203f86

    SHA1

    4edd07ffd2b3bfa4363bd66ee3302be5d5a895cd

    SHA256

    59c093a1e65ca86d9140235164776579ee0af2845bd57af16fc4eb470691418b

    SHA512

    fd8e5bd5fdf2b9a3508dcc678405fb80bbf05fce5e7bb7ec51a77bb40625b34524b1c5f8368780458a229168e074cd098df755ec94077cd5724673fc062c263a

  • memory/1552-9-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2280-0-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/2280-6-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB