08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3c

General

Target

08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
Size

73KB
MD5

9195d68a504a7c0353194a5f7f1e2910
SHA1

ad481283e4d50e8b38dc327d0f62d2b0dea8e1b7
SHA256

08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3c
SHA512

a2ab1207c4a7250ce3003cbee3766849455a5b88bdda67beec4db4c3cc69fdbed3236f812a6c1f9f0420731dbb485df6a3a9abaffca10cb86043ebbabe480671
SSDEEP

1536:I7lvnKhWQtC3Izj6TrlDa2z6Ewd0zvPTQw9LBZRWd8V3zhb:0lvKztiIzj6xtDLBZRWd8Vj5

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{\stubpath = "C:\\Windows\\system32\\WinHelp18.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{\stubpath = "C:\\Windows\\system32\\WinHelp21.exe"	regedit.exe

Deletes itself 1 IoCs

pid	Process
1920	WinHelp18.exe

Executes dropped EXE 2 IoCs

pid	Process
1920	WinHelp18.exe
2484	WinHelp21.exe

Loads dropped DLL 4 IoCs

pid	Process
2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
1920	WinHelp18.exe
1920	WinHelp18.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHelp21.exe	WinHelp18.exe
File created	C:\Windows\SysWOW64\WinHelp18.exe	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp21.exe

Runs .reg file with regedit 2 IoCs

pid	Process
2472	regedit.exe
1888	regedit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2484	WinHelp21.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1888	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	31
PID 2332 wrote to memory of 1888	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	31
PID 2332 wrote to memory of 1888	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	31
PID 2332 wrote to memory of 1888	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	31
PID 2332 wrote to memory of 1920	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	32
PID 2332 wrote to memory of 1920	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	32
PID 2332 wrote to memory of 1920	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	32
PID 2332 wrote to memory of 1920	2332	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	32
PID 1920 wrote to memory of 2472	1920	WinHelp18.exe	33
PID 1920 wrote to memory of 2472	1920	WinHelp18.exe	33
PID 1920 wrote to memory of 2472	1920	WinHelp18.exe	33
PID 1920 wrote to memory of 2472	1920	WinHelp18.exe	33
PID 1920 wrote to memory of 2484	1920	WinHelp18.exe	34
PID 1920 wrote to memory of 2484	1920	WinHelp18.exe	34
PID 1920 wrote to memory of 2484	1920	WinHelp18.exe	34
PID 1920 wrote to memory of 2484	1920	WinHelp18.exe	34
PID 2484 wrote to memory of 2348	2484	WinHelp21.exe	35
PID 2484 wrote to memory of 2348	2484	WinHelp21.exe	35
PID 2484 wrote to memory of 2348	2484	WinHelp21.exe	35
PID 2484 wrote to memory of 2348	2484	WinHelp21.exe	35
PID 2484 wrote to memory of 2348	2484	WinHelp21.exe	35

C:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
"C:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\259429818.reg
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1888
- C:\Windows\SysWOW64\WinHelp18.exe
  C:\Windows\system32\WinHelp18.exe kowdgjttgC:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1920
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Users\Admin\AppData\Local\Temp\259430021.reg
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2472
- - C:\Windows\SysWOW64\WinHelp21.exe
    C:\Windows\system32\WinHelp21.exe kowdgjttgC:\Windows\SysWOW64\WinHelp18.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:2484
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:2348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\259429818.reg

Filesize
384B

MD5
085f2b4fa993d8b24aecc3ee3221018c

SHA1
1363a227785268a3b99642f3e83fb4e4028ac03b

SHA256
be16f2c168c4d7b6b66fd939e4fe638b835a14b5448b00a9feb1d7003448074c

SHA512
c66dc0898abb8b609bfbf2fe37bc66ab23cefdcd0e6674c88e6527dd4fc9d9f3a0f33f43078f89642fe1979f5e92143598c9bc44eaec46c317ea8ee7e8e93d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\259430021.reg

Filesize
384B

MD5
20f07f05826dde5d5fdf481c4f5db222

SHA1
fb6f3a3b95fd007c48ea971bd05212d3114af061

SHA256
d3c5e2e00e124567e06b39e080c7ba0ca04b0d2a68a7ae5e9715e7e44298cca5

SHA512
991d9af975c66ec345ee060d203352a44587a75e69715e683fbc81bdfd31b7833867105a5817677acbf42b7a60e865e0834f2033b070abe073ff7d1466b17ad4

Download Submit
C:\Windows\SysWOW64\WinHelp18.exe

Filesize
73KB

MD5
275b702159e091ba419b714fed018bf1

SHA1
52f2150fbd1fe3ee8143997b748374326ccf62a9

SHA256
1889a2538d4dbda407b1e3a0c2ca07c152c2b37d315adcd198b1ec388688a1da

SHA512
f138489ea51169ac585fe606864a34901f405b04411b523b3f4fcaf2bd19d590ee91f5196c0d3f71a23fa455dc28b2fff2ea5a32075ed0d0ef60ca77f54ff1e9

Download Submit
C:\Windows\SysWOW64\WinHelp21.exe

Filesize
73KB

MD5
740c39c1f3e35b054bc087b6fe6594cb

SHA1
1bc2963ae45ad2015e86aaac2c8beab33e7e4d91

SHA256
a603ac1026f1a51946a0101e236a1170da16d5277a26df5885aff45a2cbff924

SHA512
d64c23d4098c8222764c9d905218aaa070074e70e1bcba48574bb72b2f6be68829adae3580018ef2102bd0ff89662a09bf43d0f5e58ff77fdd32ad73c7756456

Download Submit
memory/2348-23-0x0000000013150000-0x0000000013167000-memory.dmp

Filesize
92KB

Download
memory/2348-21-0x0000000013150000-0x0000000013167000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads