7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20241023-en
resource tags

arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system
submitted
20/11/2024, 02:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe
Size

47KB
MD5

2a91b754a5786c71c5c09584020eaff0
SHA1

9721ced7d24a03c53eff542a485920820283a23c
SHA256

7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039
SHA512

4a224930a1644e2fbd96a43a778c0993ab6490a4eac98bc3f3ba6abfaec6167cb60bb3d9aaf39ffa88f30466597ac55d0ffa499ceffabc4f90a3a925b393fb35
SSDEEP

768:DqPJtsA6C1VqahohtgVRNToV7TtRu8rM0wYVFl2g5coW58dO0xXHV2EfKYfdhNhx:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYR

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2444	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2444	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2444	2580	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe	30
PID 2580 wrote to memory of 2444	2580	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe	30
PID 2580 wrote to memory of 2444	2580	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe	30
PID 2580 wrote to memory of 2444	2580	7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe	30

C:\Users\Admin\AppData\Local\Temp\7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe
"C:\Users\Admin\AppData\Local\Temp\7f7bd7de788daa5b0fc88728e6d62ceb3a21f21476f1b600c75ebfc3d6e66039N.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
47KB

MD5
ec2459162eeeee2f569ba9b9ffa2e6be

SHA1
f548a4fd6c750d371a220a597b362e79c422b56d

SHA256
d9c723307fdcffe68bfa3b76bd29f9788bc93964cdf3f4d676845135062ac8ce

SHA512
7c5fafdcd8c1b3e5368198b0ca46c107d77dccf29d0eab3b785558ecc1f7ebc4ad639f59e360fa0cb9c148d9a50daa71a47dd8aaa6fae58a7941fba3f8788c7b

Download Submit
memory/2444-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2444-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2580-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2580-3-0x0000000000220000-0x0000000000223000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads