General
- Target NHelperV4.exe
- Size 195.2MB
- Sample260615-tswqsacy5z
- SHA256 4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747
Score
10/10
Malware Config
Targets
-
- Target NHelperV4.exe
- Size 195.2MB
- SHA256 4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747
Score10/10-
UAC bypass
-
Disables RegEdit via registry modification
-
Possible privilege escalation attempt
-
Checks computer location settings
Looks up country code configured in the registry, likely geofence.
-
Loads dropped DLL
-
Modifies file permissions
-
Registers new Windows logon scripts automatically executed at logon.
-
Checks whether UAC is enabled
MITRE ATT&CK Enterprise v16
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Initialization Scripts
1Logon Script (Windows)
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1File and Directory Permissions Modification
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
2