3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b

Analysis

max time kernel
198s
max time network
47s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 10:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
Size

974KB
MD5

9bf90eb205bc0d48aef2ea2cb604d513
SHA1

c50b85efe2530a3d17f11aca4520043f4d5fb643
SHA256

3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b
SHA512

228ccb385a9701ff9e9cbbb08cf36990511e3480488426f70ea8978a6c24bbb9d388a19c1ab552e1f2f4d59e8e534622a6517924e73bb77c892e2a916bb66c2f

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

HelpMe.exe3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\desktop.ini.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

1220 HelpMe.exe

pid	process
1220	HelpMe.exe

Drops startup file 3 IoCs

Processes:

HelpMe.exe3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

Loads dropped DLL 2 IoCs

Processes:

3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

pid	process
1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

description	ioc	process
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\B:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\E:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\H:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\Q:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\R:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\A:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\M:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\O:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\F:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\W:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\J:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\L:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\X:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\Y:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\N:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\T:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\U:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\G:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\K:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\P:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\V:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File opened (read-only)	\??\Z:	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

HelpMe.exe3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

description	ioc	process
File opened for modification	C:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

Drops file in System32 directory 2 IoCs

Processes:

3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe

description	pid	process	target process
PID 1208 wrote to memory of 1220	1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe	HelpMe.exe
PID 1208 wrote to memory of 1220	1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe	HelpMe.exe
PID 1208 wrote to memory of 1220	1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe	HelpMe.exe
PID 1208 wrote to memory of 1220	1208	3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe
"C:\Users\Admin\AppData\Local\Temp\3ba702c5569d6e6b76beb010d9ea0e1d6945135ca8699dacb4492c4be0bfeb6b.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1208

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:1220

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2277218442-1199762539-2004043321-1000\desktop.ini.exe
Filesize
974KB

MD5
6403fef5655b7ddbd608a568df7f0c6d

SHA1
6aa608fe1acb351615148006be1ff27cb7646758

SHA256
354589bcdb72941d391695a73dde88c25d01d5b9786d4b40b28ff6649750919a

SHA512
b8dffdf9c3314f2a23338cfb7722a4822fb29e680596e8272fb6a00271a4744b28fabc74568552d1a1d93a8098595ea0d31a560d5c44e9e86e34aa367fa77cf8

Download Submit
C:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AUTORUN.INF
Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
C:\AutoRun.exe
Filesize
974KB

MD5
d64e3a3e79bc2950b8615374c464ff3f

SHA1
2ab15f394722f836475cf4a665f2664a7ac129b1

SHA256
6bcf37275d2cf513490ecdeda2a32577eaf8288aa5d0e5623a49313e0b9caa7b

SHA512
b06f6b4fda66200ddddac96732c499da847b9c4ea0f0c32874fcc7651b0d99716233963a7570ee3ade5b7bd88669079a4a41d90821f9dce58e9679307a64bcc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
3e8ac58304b8c41c33b41582744a217a

SHA1
183173ead78c6fce4ff8359b727d83048b370370

SHA256
8ff3bbea9744c22491ce12d998928fd0ed67d6bc5dab1594fa9ec916a7a25887

SHA512
774983042d6389a3e158c422f9b9b7fcfcf8a3cf761f0448ebfa8c7934222cb8ee0849430318a374dcbac97336181474dfd13d67c0305d7218fd7b24c2cd6b33

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
47d54e27137757da2518c12561e073bf

SHA1
18e381507357bbbff054546903747b724d11894a

SHA256
ec019864570c426e3c49343203899856f274d1b14b955e0098d721f08b296ec5

SHA512
dc49d1dca7c718783aff6c25a614872782c8da1c8e89a2cd0009179a3a7d4c26438bdd50096af855259fa69f446860b03a0be01aecbc5745aac26ec4ccb58724

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
974KB

MD5
d64e3a3e79bc2950b8615374c464ff3f

SHA1
2ab15f394722f836475cf4a665f2664a7ac129b1

SHA256
6bcf37275d2cf513490ecdeda2a32577eaf8288aa5d0e5623a49313e0b9caa7b

SHA512
b06f6b4fda66200ddddac96732c499da847b9c4ea0f0c32874fcc7651b0d99716233963a7570ee3ade5b7bd88669079a4a41d90821f9dce58e9679307a64bcc2

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
974KB

MD5
d64e3a3e79bc2950b8615374c464ff3f

SHA1
2ab15f394722f836475cf4a665f2664a7ac129b1

SHA256
6bcf37275d2cf513490ecdeda2a32577eaf8288aa5d0e5623a49313e0b9caa7b

SHA512
b06f6b4fda66200ddddac96732c499da847b9c4ea0f0c32874fcc7651b0d99716233963a7570ee3ade5b7bd88669079a4a41d90821f9dce58e9679307a64bcc2

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
974KB

MD5
d64e3a3e79bc2950b8615374c464ff3f

SHA1
2ab15f394722f836475cf4a665f2664a7ac129b1

SHA256
6bcf37275d2cf513490ecdeda2a32577eaf8288aa5d0e5623a49313e0b9caa7b

SHA512
b06f6b4fda66200ddddac96732c499da847b9c4ea0f0c32874fcc7651b0d99716233963a7570ee3ade5b7bd88669079a4a41d90821f9dce58e9679307a64bcc2

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
974KB

MD5
d64e3a3e79bc2950b8615374c464ff3f

SHA1
2ab15f394722f836475cf4a665f2664a7ac129b1

SHA256
6bcf37275d2cf513490ecdeda2a32577eaf8288aa5d0e5623a49313e0b9caa7b

SHA512
b06f6b4fda66200ddddac96732c499da847b9c4ea0f0c32874fcc7651b0d99716233963a7570ee3ade5b7bd88669079a4a41d90821f9dce58e9679307a64bcc2

Download Submit
memory/1208-68-0x0000000003C30000-0x0000000003C5E000-memory.dmp

Filesize
184KB

Download
memory/1208-54-0x0000000075F61000-0x0000000075F63000-memory.dmp

Filesize
8KB

Download
memory/1220-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads