82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913

Analysis

max time kernel
119s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/01/2025, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe
Size 41KB
Sample250127-sa124svjfk
SHA256 82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913
MD5 d99c65c6a91b8ac81f69b1ba858dd77c
SHA1 c1c369523b198c99d33d11f58c75b406583afc13
SHA512 b493e94d340f31b75da68c7ca8bbba96e03098541ae3217ead4962c6574e068a7da69dbb00ebedb39cbd67143eefac41820eccf84f54882e0185a16da7394f86
SSDEEP 768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6If:e6q10k0EFjed6rqJ+6vghzwYu7vih9Gz
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5108	microsofthelp.exe

Executes dropped EXE 1 IoCs

pid	Process
5108	microsofthelp.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\microsofthelp = "C:\\Windows\\microsofthelp.exe"	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\microsofthelp.exe	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe
File created	C:\Windows\HidePlugin.dll	microsofthelp.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	microsofthelp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1044 wrote to memory of 5108	1044	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe	81
PID 1044 wrote to memory of 5108	1044	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe	81
PID 1044 wrote to memory of 5108	1044	82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe	81

C:\Users\Admin\AppData\Local\Temp\82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe
"C:\Users\Admin\AppData\Local\Temp\82fc6ad6420b68560be0b9905e2e586de5b4034fe07b7c55e8d57eeec7e54913.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1044
- C:\Windows\microsofthelp.exe
  "C:\Windows\microsofthelp.exe"
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

microsofthelp.exe

Path C:\Windows\microsofthelp.exe
Size 41KB
SHA256 7e027154802f1d7e3252a389cfd54eb6781c1ffeceb7a31d9d5cb84844c589cb
MD5 6179d7ead84219acee2389cf3335327f
SHA1 96874cab57b7e7f47b1ed4a661ecec5534cfc22e
SHA512 c98a94660ec57fc8e2ed55935351bdbfd18536e2096f57c23eb13dc3f642ba54e3a0f6c0f01e9d16aa022ba4e13fedc7812e22e1ded4d02245c0b1b70ed14144
SSDEEP 768:ePyFZFASe0Ep0EpHZplRpqpd6rqxn4p6vghzwYu7vih9GueIh9j2IoHAjU+Eh6IF:e6q10k0EFjed6rqJ+6vghzwYu7vih9G5
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1044-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/1044-6-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/5108-7-0x0000000000400000-0x000000000040E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads