d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386

General

Target

d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe
Size

73KB
MD5

79a94079460b7da993ef0264ee8f3780
SHA1

8251f6af71a94e5a49f65c3726f2411f6c7c1167
SHA256

d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386
SHA512

cf32dd0120667b2340bbb13fc1390e48e892195619f454eb8b99f6278734e0d2854039f01e6e2f11454cfae3c13e9d8f0851f649fc83f2f2f3fac9dfbcb88450
SSDEEP

1536:O7qvnKhWQtC3Izj6TrlDa2z6Ewd0zvPTQw9LBZR+d8V3zhb:eqvKztiIzj6xtDLBZR+d8Vj5

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\\|BGG7GE77./6EA.58:1,:3@:./FF4GEEC8AGF\|	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\\|BGG7GE77./6EA.58:1,:3@:./FF4GEEC8AGF\|\stubpath = "C:\\Windows\\system32\\WinHelp59.exe"	regedit.exe

Deletes itself 1 IoCs

pid	Process
5012	WinHelp59.exe

Executes dropped EXE 1 IoCs

pid	Process
5012	WinHelp59.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHelp59.exe	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
5036	2760	WerFault.exe	88
5084	2760	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp59.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 1 IoCs

pid	Process
4724	regedit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5012	WinHelp59.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 4724	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	83
PID 2320 wrote to memory of 4724	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	83
PID 2320 wrote to memory of 4724	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	83
PID 2320 wrote to memory of 5012	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	84
PID 2320 wrote to memory of 5012	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	84
PID 2320 wrote to memory of 5012	2320	d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe	84
PID 5012 wrote to memory of 2760	5012	WinHelp59.exe	88
PID 5012 wrote to memory of 2760	5012	WinHelp59.exe	88
PID 5012 wrote to memory of 2760	5012	WinHelp59.exe	88
PID 5012 wrote to memory of 2760	5012	WinHelp59.exe	88

C:\Users\Admin\AppData\Local\Temp\d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe
"C:\Users\Admin\AppData\Local\Temp\d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\240630359.reg
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:4724
- C:\Windows\SysWOW64\WinHelp59.exe
  C:\Windows\system32\WinHelp59.exe kowdgjttgC:\Users\Admin\AppData\Local\Temp\d59bd98f835885336e6733adbf8a43aeb10fbf1629936eee4988891ced4ac386N.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5012
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    PID:2760
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 200
      4⤵
      Program crash
      PID:5036
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2760 -s 220
      4⤵
      Program crash
      PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 204 -p 2760 -ip 2760
1⤵
PID:3220

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 2760 -ip 2760
1⤵
PID:2456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240630359.reg

Filesize
384B

MD5
d332a6f8abc48e91798fee47c61a19cf

SHA1
802c67415ce9a14645d1148817377844e7e59802

SHA256
e7aca013acd602b1b6f248a95e18f45372dfe321ebb7a33ea1e95d35b148e77e

SHA512
d34ab16c71c8bfc870b216ec8815239e37f094bd2144df7eaa26ed2174c3586beb8252b0021f098c84151606ba2a02004594bb8ed5c5e31788d1c7a08046e0bf

Download Submit
C:\Windows\SysWOW64\WinHelp59.exe

Filesize
73KB

MD5
d8bacf7798ef755f665c0b73b1d767ed

SHA1
d581b88a5dc60625aa7ee410dcd6acd4a38bd511

SHA256
b8595e0a012347a1be260d95eacfb258232e4f00cadd4f8314a118cfc31a4c09

SHA512
8408bc726ad29d30201875e88bbd5e3942c3959487a9ad0ad03a214ae67e4a5704f329517bea23888866df34370017b104d27e146ad705f6f032144a01605e2c

Download Submit
memory/2760-6-0x0000000013150000-0x0000000013167000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads