5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffa

Analysis

max time kernel
119s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/11/2024, 13:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe
Size

68KB
MD5

dd0928ba7b3ace2690839db22e4c3660
SHA1

3112e57e63e0790a5a3b2a8767756edac6360d51
SHA256

5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffa
SHA512

f4bf9ab49ad342635532e99d64cd03ce59bc4b9e98dc0f74a598d9c21b092a2fc51644726812e68e8422add755e6ea1bd69ce2bef5df69f33dbab8034237e231
SSDEEP

1536:NAo0Tj2d6rnJwwvl4ulkP6vghzwYu7vih9GueIh9j2IoHAjU+EmkcU+uhXHVhhx3:NAoglOwvl4ulkP6vghzwYu7vih9GueIw

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1596	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
1596	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe
File created	C:\Windows\microsofthelp.exe	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 1596	4640	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe	83
PID 4640 wrote to memory of 1596	4640	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe	83
PID 4640 wrote to memory of 1596	4640	5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe	83

C:\Users\Admin\AppData\Local\Temp\5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe
"C:\Users\Admin\AppData\Local\Temp\5943d7ab456269a4750b2aa3b4bf3df2546079beadcf049455cf8d12f912fffaN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
68KB

MD5
6b0e5d17cd15fda47cf59196f5b7c001

SHA1
4b2eee298e80b675fe0e6b954efc83f78d603eb8

SHA256
f3e62153dbdeba52e0c9855b3c31d8f7f9b64268236db59f3f5a80535def00db

SHA512
7fc0b61acfd19e03e2cfe9cbe48e89b857d6e3bba17456ed3dc59265bf92428eb2ee60253d439ed3da2485cfefd75983ac14b4485c7db711bb7326d021e9a423

Download Submit
memory/1596-6-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4640-0-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download
memory/4640-5-0x0000000000400000-0x000000000040F000-memory.dmp

Filesize
60KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads