Analysis

  • max time kernel
    119s
  • max time network
    16s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    09/11/2024, 20:30

General

  • Target

    36f99af0deca2322b005ce945c6068c234c25dd38ab6989d64f84f933aba031eN.exe

  • Size

    42KB

  • MD5

    16366b1a5bd005141a80423b285656d0

  • SHA1

    ad0da01f492d468e38b49d88c763cec2e138b5bf

  • SHA256

    36f99af0deca2322b005ce945c6068c234c25dd38ab6989d64f84f933aba031e

  • SHA512

    190b3e5d6590ca078162fc0f79fdb9b0c9c3bc968a18d9be1119aae7df5fa261138ddb038a3081e95e6eace9870c969d72ef66220f0031e535ceccc2ae97fd4e

  • SSDEEP

    768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IT:e6q10k0EFjed6rqJ+6vghzwYu7vih9G/

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\36f99af0deca2322b005ce945c6068c234c25dd38ab6989d64f84f933aba031eN.exe
    "C:\Users\Admin\AppData\Local\Temp\36f99af0deca2322b005ce945c6068c234c25dd38ab6989d64f84f933aba031eN.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1172

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\microsofthelp.exe

    Filesize

    42KB

    MD5

    721c0b113bb089c810525a3815b7a2ee

    SHA1

    6eaf4d5391ee5c9a7a908788da35889de64fbbd8

    SHA256

    66a5b03e74156601b4ceadac6f36ae14d4ea65b868fe74548a79fa9655dd510b

    SHA512

    636813215d0aeeb486c902b562abddd8099045b890e2bdeabd70753e0d2901db514994b04a023c985c299c98eba025dcdc47330ad3d6a450c207255f11abe79e

  • memory/1076-0-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1076-2-0x00000000001B0000-0x00000000001BE000-memory.dmp

    Filesize

    56KB

  • memory/1172-9-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB

  • memory/1172-11-0x0000000000400000-0x000000000040E000-memory.dmp

    Filesize

    56KB