4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747

General

Target
NHelperV4.exe
Size 195.2MB
Sample260615-tswqsacy5z
SHA256 4244aabad5c7a06e475d096e6ea96b040ef7fd43d9b8082a85a4a8b7833b1747
MD5 be8823a31ffdceac035ed5362e62e430
SHA1 08dfecab55d511338b91115ad898275e1719be05
SHA512 b366e10a3121b818906a4a00ad80a25aee784b1a4e4328fdc6e64f3e049acf51eee70f1f6254ae90a11443b58702511d6bffe930ab43d85df30473e37b91b6ae
SSDEEP 786432:mwHz3ODmtjw1rHi/PEEpjelfNTDA2y06OlgflKUsExM3RfbmYEyGUqzDTjzNiJID:LHyDmyU/ComlUo9aYDGnzDTjzNQID
TLSH
T193A88D0163E80A15E67F8678D6B24261DB75FC425711C2CF0494FA5D2FB3BC2AA363B6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NHelperV4.exe

Loads dropped DLL 1 IoCs

pid	Process
1328	NHelperV4.exe

Registers new Windows logon scripts automatically executed at logon. 1 TTPs 1 IoCs

persistence

Logon Script (Windows)

T1037.001

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1679180529-4058988202-686829476-1000\Environment\UserInitMprLogonScript = "C:\\Program Files\\ctrlNH\\crtl+n.bat"	NHelperV4.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

defense_evasion trojan

System Information Discovery

T1082

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NHelperV4.exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files\ctrlNH\117.exe	NHelperV4.exe
File opened for modification	C:\Program Files\ctrlNH\117.exe	NHelperV4.exe
File created	C:\Program Files\ctrlNH\crtl+n.bat	NHelperV4.exe
File created	C:\Program Files\ctrlNH\crtl+n.exe	NHelperV4.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\FriendlyName	vds.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	NHelperV4.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	NHelperV4.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	NHelperV4.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1328	NHelperV4.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1328	NHelperV4.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2420	1328	NHelperV4.exe	81

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	NHelperV4.exe

C:\Users\Admin\AppData\Local\Temp\NHelperV4.exe
"C:\Users\Admin\AppData\Local\Temp\NHelperV4.exe"
1⤵
- UAC bypass
- Loads dropped DLL
- Registers new Windows logon scripts automatically executed at logon.
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1328
- C:\Windows\SYSTEM32\diskpart.exe
  "diskpart"
  2⤵
  PID:2420

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:3900

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Privilege Escalation

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Boot or Logon Initialization Scripts

1

T1037

Logon Script (Windows)

1

T1037.001

Defense Evasion

Abuse Elevation Control Mechanism

1

T1548

Bypass User Account Control

1

T1548.002

Impair Defenses

1

T1562

Disable or Modify Tools

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tfg43pwi.newcfg

Path C:\Users\Admin\AppData\Local\NHelperV4\NHelperV4_Path_vdd2zqaix53s53mywmb4qqlnvwdekwsb\4.2.0.0\tfg43pwi.newcfg
Size 1002B
SHA256 ddee20ee953521b1cd9928cb3b802f8cee94ab39415e0901929886a87ea2b0d0
MD5 7534e1a8244ed0a2ee919c37217b4ceb
SHA1 ea4ec84092eaff459b9819c43e7cbcce5011c363
SHA512 8b2327f0a2436e8bb73a7930956a1447cb28c8dbdef6d774c955b3be7c2c06441392d10ddc2ea8731eef45963fe1fc208532c96bdb7934239a09842643bc04a0
TLSH
T197118C0532C07E6B01232B33D5114641DEB413A346692868F4BE72778F794CA07C3376
MD5 SHA1 SHA512 TLSH

Submit Download

user.config

Path C:\Users\Admin\AppData\Local\NHelperV4\NHelperV4_Path_vdd2zqaix53s53mywmb4qqlnvwdekwsb\4.2.0.0\user.config
Size 883B
SHA256 190b493254d2b4d11c9edb215550adff350c4be5b1cf322fab429a45bbf45095
MD5 3be00bb29f23590fc86f49b98141d2b4
SHA1 0af99a0d5e167335bacb453be67a584fe52eee50
SHA512 1baf4e3c385557864d98af21b22c3861cc2856ffafaecfddfa6e782776e741a1d0dd085200965aa0de0bc56bc83db4d5ed844a04ca067f792e2d3e21aa941078
TLSH
T11511491122847E6B01232B33D5469641CEB453E74669296CF17E72778F7A4CA0783376
MD5 SHA1 SHA512 TLSH

Submit Download

PresentationNative_cor3.dll

Path C:\Users\Admin\AppData\Local\Temp\.net\NHelperV4\xTrkhz0vs0LOWnK9qn2oZWrGE+v5dRo=\PresentationNative_cor3.dll
Size 1.2MB
SHA256 4f8ac54f5b28a6a9251224c7ede89ec9ba67946a011a9480f22a7f3002cfac5a
MD5 0d85ea41722d9ca45680e05ef86ee055
SHA1 70ceb7df806e5098390fb0b9b001f784a08138e9
SHA512 dd152d2419d724cea5395be496c5c53befa3865f19c76270d4def2bf9c982fad4ff9fdc42b56b195b76c40a46f21df52b30eb4dc064040e38af5e7b5b68d798a
SSDEEP 24576:XgaltAn1r1sE33slrVCP0QSeDOM8zT3n6kcNbNUdah6ox3GmOBlIefATbpwwPAFm:anR+g8lYP00OM8zT3GbNUdvoxWZBlIu4
TLSH
T193453A22E2E642E5C47FC1B8C6469717FBB1740A131C66DB87608B652F27FE0963E364
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads