Analysis

  • max time kernel
    119s
  • max time network
    17s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    11/11/2024, 12:49

General

  • Target

    269ada454f40dc262e9b2c5440cc942d33fc7c20106677e184586fdbb5e216a1N.exe

  • Size

    68KB

  • MD5

    fbb09027f654f0ff4f01400ce797447d

  • SHA1

    839679b6fbacfb69ab93db6ee04cb0061d2c9c11

  • SHA256

    907f2c4cf105e1f8e2021d279aab2ecedd505e75ddb18d34dd8b5fa1e96d987f

  • SHA512

    ecdf04257e0b4fa5f371bea022f6c5e3007a96cb214fad99fc1285f59ac602df3bafcf39e56b7574deeecedc6589bd5eac3f38aef3c2ab9636889c52656dfad1

  • SSDEEP

    1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbRJIch1hGx3:NAoglOwvl4ulkP6vghzwYu7vih9GueI1

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\269ada454f40dc262e9b2c5440cc942d33fc7c20106677e184586fdbb5e216a1N.exe
    "C:\Users\Admin\AppData\Local\Temp\269ada454f40dc262e9b2c5440cc942d33fc7c20106677e184586fdbb5e216a1N.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\microsofthelp.exe
      "C:\Windows\microsofthelp.exe"
      2⤵
      • Deletes itself
      • Executes dropped EXE
      • Drops file in Windows directory
      PID:1732

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\microsofthelp.exe

          Filesize

          68KB

          MD5

          049fa827743d4a329d44423b327abcc9

          SHA1

          e1849aa05012c98068ff774b0b72333a769401bd

          SHA256

          c06bace61c327b543719ef44649bcb0ac7fa4e8df8e4f185813cd83e691e8d2a

          SHA512

          7b4f6fcc81093f8c911178746c19c1543c12ed28373d49f95eda9abbd0a733f90abfb204f6014b827c035f0b56a9f57a81c434b6af3d18551c5aba9c24260d94

        • memory/1732-9-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/2160-0-0x0000000000400000-0x000000000040F000-memory.dmp

          Filesize

          60KB

        • memory/2160-3-0x0000000000220000-0x000000000022F000-memory.dmp

          Filesize

          60KB