08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3c

General

Target

08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
Size

73KB
MD5

9195d68a504a7c0353194a5f7f1e2910
SHA1

ad481283e4d50e8b38dc327d0f62d2b0dea8e1b7
SHA256

08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3c
SHA512

a2ab1207c4a7250ce3003cbee3766849455a5b88bdda67beec4db4c3cc69fdbed3236f812a6c1f9f0420731dbb485df6a3a9abaffca10cb86043ebbabe480671
SSDEEP

1536:I7lvnKhWQtC3Izj6TrlDa2z6Ewd0zvPTQw9LBZRWd8V3zhb:0lvKztiIzj6xtDLBZRWd8Vj5

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 4 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{\stubpath = "C:\\Windows\\system32\\WinHelp18.exe"	regedit.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{	regedit.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\}AHH6HF68/.7F@/67;2+;4?;/.GG3HFDD9@HG{\stubpath = "C:\\Windows\\system32\\WinHelp53.exe"	regedit.exe

Deletes itself 1 IoCs

pid	Process
2736	WinHelp18.exe

Executes dropped EXE 2 IoCs

pid	Process
2736	WinHelp18.exe
3944	WinHelp53.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\WinHelp18.exe	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
File created	C:\Windows\SysWOW64\WinHelp53.exe	WinHelp18.exe

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3380	5016	WerFault.exe	90
2772	5016	WerFault.exe	90

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WinHelp53.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	regedit.exe

Runs .reg file with regedit 2 IoCs

pid	Process
1672	regedit.exe
2188	regedit.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3944	WinHelp53.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 1672	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	83
PID 3100 wrote to memory of 1672	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	83
PID 3100 wrote to memory of 1672	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	83
PID 3100 wrote to memory of 2736	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	84
PID 3100 wrote to memory of 2736	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	84
PID 3100 wrote to memory of 2736	3100	08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe	84
PID 2736 wrote to memory of 2188	2736	WinHelp18.exe	85
PID 2736 wrote to memory of 2188	2736	WinHelp18.exe	85
PID 2736 wrote to memory of 2188	2736	WinHelp18.exe	85
PID 2736 wrote to memory of 3944	2736	WinHelp18.exe	86
PID 2736 wrote to memory of 3944	2736	WinHelp18.exe	86
PID 2736 wrote to memory of 3944	2736	WinHelp18.exe	86
PID 3944 wrote to memory of 5016	3944	WinHelp53.exe	90
PID 3944 wrote to memory of 5016	3944	WinHelp53.exe	90
PID 3944 wrote to memory of 5016	3944	WinHelp53.exe	90
PID 3944 wrote to memory of 5016	3944	WinHelp53.exe	90

C:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
"C:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe"
1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Windows\SysWOW64\regedit.exe
  regedit.exe /s C:\Users\Admin\AppData\Local\Temp\240617718.reg
  2⤵
  - Boot or Logon Autostart Execution: Active Setup
  - System Location Discovery: System Language Discovery
  - Runs .reg file with regedit
  PID:1672
- C:\Windows\SysWOW64\WinHelp18.exe
  C:\Windows\system32\WinHelp18.exe kowdgjttgC:\Users\Admin\AppData\Local\Temp\08a61d3e9514227d87d357269462dcbe4625f9ba8a9c544d647286886ec69b3cN.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2736
- - C:\Windows\SysWOW64\regedit.exe
    regedit.exe /s C:\Users\Admin\AppData\Local\Temp\240617953.reg
    3⤵
    - Boot or Logon Autostart Execution: Active Setup
    - System Location Discovery: System Language Discovery
    - Runs .reg file with regedit
    PID:2188
- - C:\Windows\SysWOW64\WinHelp53.exe
    C:\Windows\system32\WinHelp53.exe kowdgjttgC:\Windows\SysWOW64\WinHelp18.exe
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3944
  - - C:\Windows\SysWOW64\svchost.exe
      C:\Windows\system32\svchost.exe
      4⤵
      PID:5016
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 212
        5⤵
        Program crash
        
        PID:3380
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 5016 -s 188
        5⤵
        Program crash
        
        PID:2772

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 5016 -ip 5016
1⤵
PID:1004

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 524 -p 5016 -ip 5016
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Active Setup

1

T1547.014

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\240617718.reg

Filesize
384B

MD5
085f2b4fa993d8b24aecc3ee3221018c

SHA1
1363a227785268a3b99642f3e83fb4e4028ac03b

SHA256
be16f2c168c4d7b6b66fd939e4fe638b835a14b5448b00a9feb1d7003448074c

SHA512
c66dc0898abb8b609bfbf2fe37bc66ab23cefdcd0e6674c88e6527dd4fc9d9f3a0f33f43078f89642fe1979f5e92143598c9bc44eaec46c317ea8ee7e8e93d4c

Download Submit
C:\Users\Admin\AppData\Local\Temp\240617953.reg

Filesize
384B

MD5
072410d3bf73dc28b3ea51825d0018b8

SHA1
db0bb6fd8f57d4acfd6a019017f6521c87676491

SHA256
e7d4cf72f94b853b83d9b32eff7ce10aacce4fcde85c14ee84b4e1d0cc2fb8da

SHA512
03db545e4de5dc799c1373a04775fd4f577fee27cee1cf1c86ac795c00ca24ba3eef313a8f8b9925f76416916784fd26b5fba38e664e65cba4a3c296046f8a0f

Download Submit
C:\Windows\SysWOW64\WinHelp18.exe

Filesize
73KB

MD5
ff88c3029523d2ff69ec5954267fa916

SHA1
e313af582ae693dae62caeb8ad1b8f1a545a5cec

SHA256
97a3613aeaa3614d5d0d67955448444738ea69334e44ac837da7801df9f703d8

SHA512
56bf2be086ca2f8eff4162de876d7300343e8b521e369b1cab26910d2bfd87bd9a4e56fcae0e105bb788c8801977687af24dc859ced01a9bd3869fe33ce7bf30

Download Submit
C:\Windows\SysWOW64\WinHelp53.exe

Filesize
73KB

MD5
1539ef3abd3fb245e072d60d3a0f3bfb

SHA1
0a1905c36088f8453cecfca7a766848d117964e3

SHA256
7df9336de77574544f1dda9a52262d2757ac454737ab9f7511443e98a8edab64

SHA512
e9e88a796a3f25a21397ded277a7c3e477d8da0c9508a62439218c466be0e48161207163cc79410ea264ab7e5b833d3d31633b78d29f77fadbef371794fab846

Download Submit
memory/5016-12-0x0000000013150000-0x0000000013167000-memory.dmp

Filesize
92KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads