c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74ae

Analysis

max time kernel
119s
max time network
17s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 05:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe
Size

66KB
MD5

e2cff400395bf2375d4ebf46aee06490
SHA1

adb125e94753479316cd1b594153aa62e15d324e
SHA256

c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74ae
SHA512

3fc3efba24b2289f7fbd7770496d0289e274fee2f62822868d26da4606c7758a1db6d46de312423bd3ea93044bd2e790aacc5d560a7fc53a3cfdc2b3e0280aa3
SSDEEP

1536:DqMA6C1VqaqhtgVRNToV7TtRu8rM0wYVFl2g5u58dO0xXHQEyYfdhNhFO5h3xhIG:+MA6C1VqaqhtgVRNToV7TtRu8rM0wYVU

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2768	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
2768	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1846800975-3917212583-2893086201-1000\Software\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3052 wrote to memory of 2768	3052	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe	31
PID 3052 wrote to memory of 2768	3052	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe	31
PID 3052 wrote to memory of 2768	3052	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe	31
PID 3052 wrote to memory of 2768	3052	c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe	31

C:\Users\Admin\AppData\Local\Temp\c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe
"C:\Users\Admin\AppData\Local\Temp\c8b2f42f937730b831e467e9870eb9fb9e9fea75e8234481994e4f0a9f5e74aeN.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3052
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  PID:2768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\microsofthelp.exe

Filesize
66KB

MD5
8902c538fef3d82215ba93fa3911ebfb

SHA1
a850a2d268441334b1a3df89356fde8598b58cff

SHA256
1a3af6c5cda4085841a63781927afe25894d354159bc6444847df066baeb6cb3

SHA512
67a01ad93ce04cf3f0687fda499863186c9556639d941abb73ed9c86f4005619d4cb953314c0006d843c9ce9db0aff437c0b5beb3c6c76f17150fddb6ab65ca5

Download Submit
memory/2768-8-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/2768-10-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3052-0-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download
memory/3052-6-0x0000000000400000-0x0000000000403000-memory.dmp

Filesize
12KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads