52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732

Analysis

max time kernel
147s
max time network
127s
platform
windows10_x64
resource
win10v20210410
submitted
17-08-2021 08:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
Size

2.7MB
MD5

ce01abae632039492328b5d9920a572c
SHA1

62709acf15da719ee84d692834176de59ab32c9e
SHA256

52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732
SHA512

afdcfe14ce9396f77c238c93090c1e03dfc74959b0b1229e2410ed119c68bbd4196efd3d8a291a1e45325caf9a17001a5122ead1538bb1766b9cac57c18703b0

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

1084 HelpMe.exe

pid	process
1084	HelpMe.exe

Drops startup file 3 IoCs

Processes:

HelpMe.exe52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

description	ioc	process
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\K:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\W:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\X:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\N:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\R:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\B:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\O:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\T:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\A:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\I:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\Q:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\V:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\G:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\H:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\J:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Z:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\E:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\F:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\S:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\Y:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\L:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\P:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
File opened (read-only)	\??\U:	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Drops file in System32 directory 2 IoCs

Processes:

HelpMe.exe52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

Processes:

52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe

description	pid	process	target process
PID 3944 wrote to memory of 1084	3944	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe	HelpMe.exe
PID 3944 wrote to memory of 1084	3944	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe	HelpMe.exe
PID 3944 wrote to memory of 1084	3944	52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe
"C:\Users\Admin\AppData\Local\Temp\52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3944

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops file in System32 directory
PID:1084

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3686645723-710336880-414668232-1000\desktop.ini.exe
MD5
9b6b330586c29d2fb9aa599657bb75e5

SHA1
ec8c8d14f12e8a5e7aee6834d4325a9e2ea8c064

SHA256
c8e9dee247cfbd8bae0c8ff86e9883014b01eb8525a8fd5ff25be3dfde06e7c9

SHA512
1cda64aba72604501d60757a1fcc6ccbf38c75444a93b03a3d6a78bed1f5cb8967a764b37f6e1edbc1764487f0d4fa0a986139ee4bd2b218ce6d9259e0a573f0

Download Submit
C:\AutoRun.exe
MD5
ce01abae632039492328b5d9920a572c

SHA1
62709acf15da719ee84d692834176de59ab32c9e

SHA256
52ec2bb551c23ecd0aad847e5fbe3e0370b0f7684e7c8b00807ac497b370e732

SHA512
afdcfe14ce9396f77c238c93090c1e03dfc74959b0b1229e2410ed119c68bbd4196efd3d8a291a1e45325caf9a17001a5122ead1538bb1766b9cac57c18703b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
e1920663d6b78e7a61d9c062c88d53f8

SHA1
b3628e228957c445352aa51fb20d4383ddbb616d

SHA256
2a8f3e20f766c4cb46d3b57a42ffbb1aeb1d8e29a6ae284fd5791fce6a783ba8

SHA512
337f2cdbf81ffeb7bb72a93d2cb2aba7632f9a2f7f8212cff4329df14ffc409da0e47454436a77ce472a548b12f78e780fa329cbbbd91bb7d02f10f07f896253

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
e1920663d6b78e7a61d9c062c88d53f8

SHA1
b3628e228957c445352aa51fb20d4383ddbb616d

SHA256
2a8f3e20f766c4cb46d3b57a42ffbb1aeb1d8e29a6ae284fd5791fce6a783ba8

SHA512
337f2cdbf81ffeb7bb72a93d2cb2aba7632f9a2f7f8212cff4329df14ffc409da0e47454436a77ce472a548b12f78e780fa329cbbbd91bb7d02f10f07f896253

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
e1920663d6b78e7a61d9c062c88d53f8

SHA1
b3628e228957c445352aa51fb20d4383ddbb616d

SHA256
2a8f3e20f766c4cb46d3b57a42ffbb1aeb1d8e29a6ae284fd5791fce6a783ba8

SHA512
337f2cdbf81ffeb7bb72a93d2cb2aba7632f9a2f7f8212cff4329df14ffc409da0e47454436a77ce472a548b12f78e780fa329cbbbd91bb7d02f10f07f896253

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
1c2e0a8f60e5968ce67fdc8fab6fc1d9

SHA1
a9b51ac724ae41706854f5c0e02a2ae6946ffc2c

SHA256
a1e7ee4a0f0f902328e3bc770c6e0e24281d759eaac7e6a7ba5076dde118a211

SHA512
72ac7d85000297052c4db7af72ce2c57acc697a68e0be7d01f849922d4925ff95bd2fd0e17a22c147c257d1c177dc0282c2147a8bf7706b02d9772c82143f5de

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
39984a0a8b722479e6dc2d49e9beb4a8

SHA1
593c13e9ba10b6134b32de97b5ede00c45e1033a

SHA256
c7628d4422add1069911569bf682f0b353eb3992eace84a20e620bd5e8e45e41

SHA512
121bfaa807cc69d5198f7d898e670681d4a82d98d26b42819005c65ecfbd07b73b3675b8c4f6db7fcdf179a3f5b59601c6645d1ddba4e21663e12bc84e1d7da2

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
9b2d9e102cb789df8fbaa4114233410a

SHA1
c0168639e6adc1f1396ea7191e8b3dd33f55af6c

SHA256
bd6a9b8ea336c326511dba0950826b55b1ec43ea02e60ca41836862af9664861

SHA512
89fa8070c893c45f9e142a971fa115f5797d5cce4be791c26f91eb3130c42d658973df28ffc2bf6f763a91b13cf51577237480db4549b67cb952ddc95a9806f4

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
MD5
9b2d9e102cb789df8fbaa4114233410a

SHA1
c0168639e6adc1f1396ea7191e8b3dd33f55af6c

SHA256
bd6a9b8ea336c326511dba0950826b55b1ec43ea02e60ca41836862af9664861

SHA512
89fa8070c893c45f9e142a971fa115f5797d5cce4be791c26f91eb3130c42d658973df28ffc2bf6f763a91b13cf51577237480db4549b67cb952ddc95a9806f4

Download Submit
memory/1084-114-0x0000000000000000-mapping.dmp

Download
memory/1084-118-0x00000000006B0000-0x00000000006B1000-memory.dmp

Filesize
4KB

Download
memory/3944-117-0x0000000000630000-0x0000000000631000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads