ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53

Analysis

max time kernel
149s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 05:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe
Size

41KB
MD5

9ed8e4fcfba3ffdaf18c6f5a09c50cc4
SHA1

a46caada1fc3cf0ad6cf65b7beabd0f349dbdf63
SHA256

ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53
SHA512

4becfba35ff642d3c27cdda300f556a2f8e70a1f545942a0646a5527daea7c5390043cb7bf0cfd88ea2e30e655535943f9eb92883c4cedac5c678ccfee60bdc0
SSDEEP

768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjUvJw3/I:e6q10k0EFjed6rqJ+6vghzwYu7vih9G7

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
808	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
808	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 808	3116	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe	83
PID 3116 wrote to memory of 808	3116	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe	83
PID 3116 wrote to memory of 808	3116	ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe	83

C:\Users\Admin\AppData\Local\Temp\ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe
"C:\Users\Admin\AppData\Local\Temp\ef767106235456cb30ac315ec50fd777054d14aff4fc6c8711602c398ac42c53.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
41KB

MD5
0b07578fcfdee78180a2073a941b9cfd

SHA1
832f3c27cdd7f2d3dfcb6234a94423302f3541bd

SHA256
6cb1c902af5cb2b4d1551c6244470286cde0ad330e6463fc8cd9a3839654878e

SHA512
f3bc387f799a0bc8999500742a29286957eba96c36d0cd9e028f61e0c6f9a085bac38196b2b1b5b57636325e5ad6ef5193fa88d972563b40d4cc1ef65bcc7e33

Download Submit
memory/808-7-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3116-0-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download
memory/3116-5-0x0000000000400000-0x000000000040E000-memory.dmp

Filesize
56KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads