Analysis
- max time kernel
141s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system - submitted
03/02/2024, 20:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
8d44a1dc87c9ae9d07c48ec37dd58568.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
8d44a1dc87c9ae9d07c48ec37dd58568.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
13 signatures
150 seconds
General
- Target 8d44a1dc87c9ae9d07c48ec37dd58568.exe
- Size 728KB
- Sample240203-y8a68sbhdn
- SHA256 3b56d425f23b78268452f8cc5cc6d7f8789e14081b0d95c1d0ab22580a78cbdd
- MD5 8d44a1dc87c9ae9d07c48ec37dd58568
- SHA1 658f0402e4b79eab18a7de579abd1b84b08da1e4
- SHA512 1c3ac4ac13e32e197d883714b6c9621e45b5dcc2e69e3da5449c10559c764f273255134f4491d96e41275b04b278af111d170f7348a0f65afc803a4a00014d6f
- SSDEEP 12288:3qFrL9FP3PhW4mAMrm9IVwnKVEhYRAuZrY4N/1gq7pJ6:crXpVrownKeYo4d1gIn6
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 3 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation 8d44a1dc87c9ae9d07c48ec37dd58568.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation nethelper.exe Key value queried \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Control Panel\International\Geo\Nation nethelper.exe - Executes dropped EXE 5 IoCs
pid Process 4660 nethelper.exe 1480 8d44a1dc87c9ae9d07c48ec37dd58568.exe 3184 nethelper.exe 5088 nethelper.exe 5092 nethelper.exe - Loads dropped DLL 3 IoCs
pid Process 2180 regsvr32.exe 1204 regsvr32.exe 4360 regsvr32.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsNetworkHelper = "C:\\Windows\\system32\\nethelper.exe" 8d44a1dc87c9ae9d07c48ec37dd58568.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsNetworkHelper = "C:\\Windows\\system32\\nethelper.exe" nethelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsNetworkHelper = "C:\\Windows\\system32\\nethelper.exe" nethelper.exe - Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1593C741-C011-46FE-99FC-3805C28328BA} 8d44a1dc87c9ae9d07c48ec37dd58568.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1593C741-C011-46FE-99FC-3805C28328BA} nethelper.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1593C741-C011-46FE-99FC-3805C28328BA} nethelper.exe - Drops file in System32 directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\RCX48B1.tmp nethelper.exe File created C:\Windows\SysWOW64\nethelper.dll nethelper.exe File created C:\Windows\SysWOW64\nethelper.exe nethelper.exe File created C:\Windows\SysWOW64\nethelper.dll 8d44a1dc87c9ae9d07c48ec37dd58568.exe File created C:\Windows\SysWOW64\nethelper.exe 8d44a1dc87c9ae9d07c48ec37dd58568.exe File opened for modification C:\Windows\SysWOW64\nethelper.exe 8d44a1dc87c9ae9d07c48ec37dd58568.exe File opened for modification C:\Windows\SysWOW64\RCX47E6.tmp 8d44a1dc87c9ae9d07c48ec37dd58568.exe File created C:\Windows\SysWOW64\nethelper.exe nethelper.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
pid pid_target Process procid_target 4696 3184 WerFault.exe 92 -
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" nethelper.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch nethelper.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" nethelper.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync nethelper.exe Set value (int) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2" nethelper.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch nethelper.exe Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" nethelper.exe Key created \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\Software\Microsoft\Internet Explorer\IESettingSync nethelper.exe - Modifies registry class 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\TypeLib\ = "{0324D9F1-2199-4424-98C7-A0E8CC45743B}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook.1\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CLSID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID\ = "NetHelper.Hook.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CLSID\ = "{1593C741-C011-46FE-99FC-3805C28328BA}" regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ = "Hook Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID\ = "NetHelper.Hook.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\ = "Hook Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\Programmable regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32 regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID\ = "NetHelper.Hook.1" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\nethelper.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\Programmable regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32\ = "C:\\Windows\\SysWow64\\nethelper.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\HELPDIR\ = "C:\\Windows\\System32" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\ = "Hook Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32\ = "C:\\Windows\\SysWow64\\nethelper.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\nethelper.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ = "Hook Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\ProxyStubClsid32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\TypeLib\ = "{0324D9F1-2199-4424-98C7-A0E8CC45743B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\VersionIndependentProgID\ = "NetHelper.Hook" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\0\win32\ = "C:\\Windows\\SysWow64\\nethelper.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook.1\ = "Hook Class" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\TypeLib\Version = "1.0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook.1\CLSID\ = "{1593C741-C011-46FE-99FC-3805C28328BA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CurVer\ = "NetHelper.Hook.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\FLAGS regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\ = "IHook" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CLSID\ = "{1593C741-C011-46FE-99FC-3805C28328BA}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\ProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\TypeLib regsvr32.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\VersionIndependentProgID\ = "NetHelper.Hook" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\InprocServer32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CLSID\ = "{1593C741-C011-46FE-99FC-3805C28328BA}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1593C741-C011-46FE-99FC-3805C28328BA}\TypeLib\ = "{0324D9F1-2199-4424-98C7-A0E8CC45743B}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\ = "IHook" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\ = "Hook Class" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\NetHelper.Hook\CurVer regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{0324D9F1-2199-4424-98C7-A0E8CC45743B}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{54DCBD5A-3FDC-490F-B9AE-5B9DBAA39BEC}\TypeLib regsvr32.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe - Suspicious use of SetWindowsHookEx 12 IoCs
pid Process 1480 8d44a1dc87c9ae9d07c48ec37dd58568.exe 1480 8d44a1dc87c9ae9d07c48ec37dd58568.exe 1480 8d44a1dc87c9ae9d07c48ec37dd58568.exe 1480 8d44a1dc87c9ae9d07c48ec37dd58568.exe 5088 nethelper.exe 5088 nethelper.exe 5088 nethelper.exe 5088 nethelper.exe 5092 nethelper.exe 5092 nethelper.exe 5092 nethelper.exe 5092 nethelper.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3276 wrote to memory of 2180 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 88 PID 3276 wrote to memory of 2180 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 88 PID 3276 wrote to memory of 2180 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 88 PID 3276 wrote to memory of 4660 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 89 PID 3276 wrote to memory of 4660 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 89 PID 3276 wrote to memory of 4660 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 89 PID 3276 wrote to memory of 1480 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 90 PID 3276 wrote to memory of 1480 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 90 PID 3276 wrote to memory of 1480 3276 8d44a1dc87c9ae9d07c48ec37dd58568.exe 90 PID 4660 wrote to memory of 1204 4660 nethelper.exe 91 PID 4660 wrote to memory of 1204 4660 nethelper.exe 91 PID 4660 wrote to memory of 1204 4660 nethelper.exe 91 PID 4660 wrote to memory of 3184 4660 nethelper.exe 92 PID 4660 wrote to memory of 3184 4660 nethelper.exe 92 PID 4660 wrote to memory of 3184 4660 nethelper.exe 92 PID 4660 wrote to memory of 5088 4660 nethelper.exe 93 PID 4660 wrote to memory of 5088 4660 nethelper.exe 93 PID 4660 wrote to memory of 5088 4660 nethelper.exe 93 PID 3184 wrote to memory of 4360 3184 nethelper.exe 95 PID 3184 wrote to memory of 4360 3184 nethelper.exe 95 PID 3184 wrote to memory of 4360 3184 nethelper.exe 95 PID 3184 wrote to memory of 5092 3184 nethelper.exe 96 PID 3184 wrote to memory of 5092 3184 nethelper.exe 96 PID 3184 wrote to memory of 5092 3184 nethelper.exe 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe"C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s nethelper.dll2⤵
- Loads dropped DLL
- Modifies registry class
PID:2180
-
-
C:\Windows\SysWOW64\nethelper.exe"C:\Windows\system32\nethelper.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4660 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s nethelper.dll3⤵
- Loads dropped DLL
- Modifies registry class
PID:1204
-
-
C:\Windows\SysWOW64\nethelper.exe"C:\Windows\system32\nethelper.exe"3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Installs/modifies Browser Helper Object
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3184 -
C:\Windows\SysWOW64\regsvr32.exe"C:\Windows\System32\regsvr32.exe" /s nethelper.dll4⤵
- Loads dropped DLL
- Modifies registry class
PID:4360
-
-
C:\Windows\SysWOW64\nethelper.exe"C:\Windows\system32\nethelper.exe"4⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5092
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3184 -s 6324⤵
- Program crash
PID:4696
-
-
-
C:\Windows\SysWOW64\nethelper.exe"C:\Windows\SysWOW64\nethelper.exe"3⤵
- Executes dropped EXE
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5088
-
-
-
C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe"C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1480
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3184 -ip 31841⤵PID:2260
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe
- Size 495KB
- SHA256 67b0aa8a2adc26f7e1ad81b98615bbf2c48e34445f6fd8b12890a9146a5af482
- MD5 d7931de86924a6dd81d493bfb1452d64
- SHA1 d1ff444af225df6ced6fddc22b06edb481dce67f
- SHA512 c8731112f64a5b66a8e0878d8c84d37fb08d1b40e1925368ffe6ae8119c05e3c5c0338d7fdf799bde6fb61a82252a70ff5cb2e4283181436f7a04f0c4d5558bb
- SSDEEP 6144:JXZz4Pk/+tWxypWJ7AMrUn9XYVwnKV+dhrUNPA+pKy9rslvC9aCt:oPhW4mAMrm9IVwnKVEhYRAuZrYk
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\8d44a1dc87c9ae9d07c48ec37dd58568.exe
- Size 599KB
- SHA256 7361b940ede77536d1830c2b590ab540cff25b2375eed62e3d726a6b7626a974
- MD5 8c5a5b8e4cf88e935b1db2aa36f5a9af
- SHA1 40be0c9c6326c81859626bf71530c907242ebc3d
- SHA512 1f51bb281c2412a95004c716a3ce232b6d1cd0bb50b130c4986b66370576ebbb7ca837e67321ec455dfc0d931d2c43ceddc80ac9f326eca8de74d30459a854fd
- SSDEEP 12288:oPhW4mAMrm9IVwnKVEhYRAuZrY4N/1gqe:kVrownKeYo4d1g9
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\TMP5696\4ebook.htm
- Size 3KB
- SHA256 d9355f6bfd2e922d872d05252de5d99b1102c2983897c9daaffa74af8d3dacb9
- MD5 6f2320b8373dc158f27d87f2b15ec3c2
- SHA1 cf335d17a804e0ea8e148521e1392a5b7d4465ab
- SHA512 63eee4151e6fa52ee246de6e88229906663d424218d7b8a921492e629ec9f4522f98cc09f7473ce9d0ee7e1decfd87d03fe68de4c6b8d1697a90e0e60766f284
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Temp\TMP5696\search_magnifg_animated.gif
- Size 14KB
- SHA256 ed4d2a3d775843f4c71be58f791e6183ce677778c32e67ece71f2ca08599437e
- MD5 5d409ac68d3ccd58f39c94017ddeea73
- SHA1 be4bbb6f55a7bc6ad3e8d9e0c48faddd19344b7a
- SHA512 bd4af469b778fc65d0f9305c05e261a7163ac782c9b5e55eec00007e91dbed1fa18cd82f326f377ca2fb67dd2d41ad95fd2e9510611c39100e657f68372ca9b3
- SSDEEP 384:O9SKL0+jrun+cgANd4lQhZBKS7F6RTXyhY:VAx3un+LANalQJKQF6Zv
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nethelper.dll
- Size 40KB
- SHA256 369d5d99328207920ccd60a29cad44f2a7b3a7cb88ffa4a432b227f17bb1ff9b
- MD5 52d5b345421b3e7180ea2244f94d49f6
- SHA1 efcf9cb3b1fb2563eb8a457b91de7cb896c4b704
- SHA512 a02b7efd6bf5ef304fd3b9a42cb3e8627b01b81fcd9ee06d853345551847e59231f40e8d0c6425696dc32ef85fce378076c8363e2d90dea092143a6cdf4ad57d
- SSDEEP 384:7W4fbvtqd6gK8q3laII7/1zQT9shSbr2Bc+kuZqN8ch9XszbOaLg:Ed6yq3lgyT+hIr2Bc+kZNRqg
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\nethelper.exe
- Size 728KB
- SHA256 3b56d425f23b78268452f8cc5cc6d7f8789e14081b0d95c1d0ab22580a78cbdd
- MD5 8d44a1dc87c9ae9d07c48ec37dd58568
- SHA1 658f0402e4b79eab18a7de579abd1b84b08da1e4
- SHA512 1c3ac4ac13e32e197d883714b6c9621e45b5dcc2e69e3da5449c10559c764f273255134f4491d96e41275b04b278af111d170f7348a0f65afc803a4a00014d6f
- SSDEEP 12288:3qFrL9FP3PhW4mAMrm9IVwnKVEhYRAuZrY4N/1gq7pJ6:crXpVrownKeYo4d1gIn6
- MD5 SHA1 SHA512 SSDEEP