Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 18:58
Static task
static1
Behavioral task
behavioral1
Sample
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe
Resource
win10v2004-20241007-en
General
-
Target
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe
-
Size
60KB
-
MD5
f3148c741c1c4e5344cb919b92cceba0
-
SHA1
8ddac45dae1e5f9a9d46b5a22601d9cd17223d03
-
SHA256
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20
-
SHA512
4b4bda0169ca6500e3fe183fc595178f64262eb1623e4bb923f30572e97b359174e41e69d7c7ea1873cd4e38622ebca9e26d98817a1a313dd1d9378b8819805e
-
SSDEEP
1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIy:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVo
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
microsofthelp.exepid Process 4424 microsofthelp.exe -
Executes dropped EXE 1 IoCs
Processes:
microsofthelp.exepid Process 4424 microsofthelp.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe" 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe -
Drops file in Windows directory 1 IoCs
Processes:
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exedescription ioc Process File created C:\Windows\microsofthelp.exe 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exemicrosofthelp.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language microsofthelp.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exedescription pid Process procid_target PID 2632 wrote to memory of 4424 2632 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe 83 PID 2632 wrote to memory of 4424 2632 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe 83 PID 2632 wrote to memory of 4424 2632 0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe"C:\Users\Admin\AppData\Local\Temp\0d6628e14630e8e19c7599296e4bf047eca606ae0eb80aeef399e22c7f13ed20N.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\microsofthelp.exe"C:\Windows\microsofthelp.exe"2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4424
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
61KB
MD5c4688490b605a8bd39fe22a58f412a2b
SHA1af5a53eb8add68b342dd1fae79c27419aeb0ed28
SHA2563a297f4f9c1a6699e4398b2001d7d2b933a19565559e3080b14228ee75547e54
SHA512e0882c7a6279c2b3b9586fff8be58f734ed910f0ef3b3776d6f0e2d49774bc2cffee3fe1ed6d0fdfb0308b916377beb53b0bb3a9d90fe2581c6ede5ea98f12a8