c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1

Analysis

max time kernel
149s
max time network
120s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
21-11-2024 07:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe
Size

56KB
MD5

39ff66d5fa290e82b58b71ca74860281
SHA1

fbd5718d59efc4b671c9de27acefbcf896b5bf57
SHA256

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1
SHA512

2187c82681e70dc6bd999a228124a1ac03af34cc4374a64721db295895860931add7a5108cfca06ce2de4b9a1f36087352c89917fe320ffe76b5814a33332b9d
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIj:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVF

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

Processes:

microsofthelp.exe

pid process

2524 microsofthelp.exe
Executes dropped EXE 1 IoCs

Processes:

microsofthelp.exe

pid process

2524 microsofthelp.exe

pid	process
2524	microsofthelp.exe

pid	process
2524	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3533259084-2542256011-65585152-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

Drops file in Windows directory 1 IoCs

Processes:

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

description ioc process

File created C:\Windows\microsofthelp.exe c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

description	ioc	process
File created	C:\Windows\microsofthelp.exe	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe

description	pid	process	target process
PID 2496 wrote to memory of 2524	2496	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe	microsofthelp.exe
PID 2496 wrote to memory of 2524	2496	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe	microsofthelp.exe
PID 2496 wrote to memory of 2524	2496	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe	microsofthelp.exe
PID 2496 wrote to memory of 2524	2496	c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe	microsofthelp.exe

C:\Users\Admin\AppData\Local\Temp\c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe
"C:\Users\Admin\AppData\Local\Temp\c286b15469dc04439c9b47a391f6a17454ec0847f05be01fc37c7207dfda97e1.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
56KB

MD5
3ffd63d5f2be0a4fbd05675cc2e8f18b

SHA1
03d59d2aaa63368c28166f587781427f97e7b2c7

SHA256
dffd8f851417e9568dd4c0301d7ec7e6b1f4fbdc63fff4c890b925e73074ea13

SHA512
c20b8ccc327b96009456434b89b2dc19af114b2f45a45b076fe8debf58bc0009e0074bb57d2dc726d47d326e2af235e06a3a55749827e7f6981ca472c9d451d2

Download Submit
memory/2496-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2496-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2524-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2524-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download