6a73eaf6c2600991a69d1c5ced410a0e176c3fc1659d8caf58a49de7b5a1652c

Analysis

max time kernel
119s
max time network
99s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/11/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe
Size 63KB
Sample241112-rpe8hsvbkc
SHA256 6a73eaf6c2600991a69d1c5ced410a0e176c3fc1659d8caf58a49de7b5a1652c
MD5 cc0e6db713d76159b6fb6388117e7c03
SHA1 87b67c2bc1e34e99e454b23ff681e3abc82c0c24
SHA512 0dc665ded933683b7ce6f234d74e93b26406144db0439d0d9d399ef37d2f4058843aacbef4fe16fc79cb5faa1a96bd92714fee039c1013298630ba8ce7872ed6
SSDEEP 1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbRJhHhLhhP:lAo1lOwvlKlXBP6vghzwYu7vih9GueIi
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2140	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2140	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 2140	1852	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe	85
PID 1852 wrote to memory of 2140	1852	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe	85
PID 1852 wrote to memory of 2140	1852	ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe	85

C:\Users\Admin\AppData\Local\Temp\ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe
"C:\Users\Admin\AppData\Local\Temp\ea449cdaca0e0531e48a83d858119355d15084ed179fa4b344fb252631793106N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:2140

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 64KB
SHA256 bd88806e69b2a42d4a7f94be6d59a0fab4e6d6ff891698e61bf7ba9ab49f00be
MD5 e331ddaf8c0d94c3de771ea13a1011e9
SHA1 445cd1969aee7738b89d293a314e94717c6e0b4c
SHA512 8e5a9a74ca3c82cb1f7f2a79b8e9fd8d62dc900a6b5113c9399d445e65c0450115b1d3f94f4ae45d61efac1f396616c51991234167c59d1dce3df8b3f141ec40
SSDEEP 1536:lAo0ej2d6rnJwwvlKlIUBP6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IbRJhHhLhhJ:lAo1lOwvlKlXBP6vghzwYu7vih9GueIG
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1852-0-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/1852-4-0x0000000000400000-0x000000000040F000-memory.dmp

Download

memory/2140-6-0x0000000000400000-0x000000000040F000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads