883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4

Analysis

max time kernel
120s
max time network
92s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2024, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe
Size 25KB
Sample241112-ph4lesvrfp
SHA256 883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4
MD5 7d09aee691686ad0871337803f617336
SHA1 d1644eba052295afd7cf030a0422eb1e9a4901c5
SHA512 f5f2dc8eec0a28583a0661bbdae96e12a2a5e8c1ec3a37aed1920ff27fbef85edad93d36216ac97118793531a8f79e155bb0ffc5e1133d4380ac8237d642412e
SSDEEP 768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wk7IErqyEOGNFbuSxhLIsv/hDhtMhIm:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wkh
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3300	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
3300	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4476 wrote to memory of 3300	4476	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe	85
PID 4476 wrote to memory of 3300	4476	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe	85
PID 4476 wrote to memory of 3300	4476	883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe	85

C:\Users\Admin\AppData\Local\Temp\883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe
"C:\Users\Admin\AppData\Local\Temp\883ff7ecac4f84de8a49b72ec0cffbdc73c57e896b92ed9138ef3e105b5715a4.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 26KB
SHA256 a509b5015e982c52944b86a2636cc4b05a07e432e0298143a128fdc4fd461df7
MD5 a13de2a4a7044158e0da88177b611cb3
SHA1 4534b22917e5ac2493386faf4aa50ea9dac4839e
SHA512 766abd0f5e0bdb5941d966561cc5c45cbc516875c21e3bbe88f717bff67d0a85f4acf0a4b49498c7c172c9d39118c8d608bb16836ee7292af1994792338fb9a7
SSDEEP 768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wk7IErqyEOGNFbuSxhLIsv/hDhtMhIB:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wk6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3300-6-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/4476-0-0x0000000000400000-0x0000000000403000-memory.dmp

Download

memory/4476-5-0x0000000000400000-0x0000000000403000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads