3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d

Analysis

max time kernel
151s
max time network
49s
platform
windows7_x64
resource
win7-20220414-en
submitted
03-07-2022 10:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
Size

810KB
MD5

f39c1d7c5cfde8d8b9dcac2678ed7e37
SHA1

0ddfc33907c9152ad7a181b5f31bffe07e0f9825
SHA256

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d
SHA512

8fbc98f677d43ff38f655edfca786fda04e2db1cede309b01745805bc2bea33d135efe418a93c67553f35eaf61ebc067ff953f1e18d01a0e917601f5e3a5f363

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 6 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

1848 HelpMe.exe

pid	process
1848	HelpMe.exe

Drops startup file 3 IoCs

Processes:

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exeHelpMe.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

Loads dropped DLL 2 IoCs

Processes:

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

pid	process
824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exe3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

description	ioc	process
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\B:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\E:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\L:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\Q:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\S:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\Z:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\M:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\T:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\X:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\A:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\I:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\P:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\K:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\Y:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\F:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\H:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\N:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\R:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\U:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\J:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\V:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\W:	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

HelpMe.exe3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

description	ioc	process
File opened for modification	C:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

Drops file in System32 directory 2 IoCs

Processes:

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe

description	pid	process	target process
PID 824 wrote to memory of 1848	824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe	HelpMe.exe
PID 824 wrote to memory of 1848	824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe	HelpMe.exe
PID 824 wrote to memory of 1848	824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe	HelpMe.exe
PID 824 wrote to memory of 1848	824	3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe
"C:\Users\Admin\AppData\Local\Temp\3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:824

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:1848

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1819626980-2277161760-1023733287-1000\desktop.ini.exe
Filesize
811KB

MD5
44220cd4b72fed26ed5ecfe1d477f758

SHA1
deeeeeac6fc8309393ceb64d9d099a1390c59ecb

SHA256
fa98f633ba4daaf4d704fd5413d9c7eda05f9ca21cff2f1e6b82005c725ad2a2

SHA512
fa2415fd9f57166afbca506536d01e3c661a480abefc29a20ff5c436820ff230c4051ed5005dc904fdee7e79f299df209e082d29bdd26eb85c7623e9b83bb567

Download Submit
C:\AutoRun.exe
Filesize
810KB

MD5
f39c1d7c5cfde8d8b9dcac2678ed7e37

SHA1
0ddfc33907c9152ad7a181b5f31bffe07e0f9825

SHA256
3b99391d69a827abeb48c5886c5a7108dfe7dfd79371947b31e126a3a3b5dc4d

SHA512
8fbc98f677d43ff38f655edfca786fda04e2db1cede309b01745805bc2bea33d135efe418a93c67553f35eaf61ebc067ff953f1e18d01a0e917601f5e3a5f363

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
1KB

MD5
5ea0e932a69821c776fde2ab001dd622

SHA1
307b0f2210cc9cdd8ee2d6b63cd24e3dc9faf373

SHA256
2464e9b51a92b3a3d3049de1dbe71053401f175e248b0397ca9b8260c50f2042

SHA512
b72610c887dc0d296302ec6d756d08caf0fd4c631d6306af851cd9f6a2651fd49ff83019f38bb419041317948ad275e8ef42659bd06bcd9f9efbe251f120a343

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
954B

MD5
187d714d697f45e68f65fd1c7415be93

SHA1
83d319ea2ff541e3cb6d210399dac993c52f81b8

SHA256
7b8fff32472ff9e04169f30b9557d95de31d93b34a9579e11bbee8a35f7bf159

SHA512
543ca9925b036efa3f37f66e7fe0e0dfc9604fb32113b3aa4dae508c5c7cdc2693d85536b79300b928ee0bd5c4b3e049180fcd4f4cbdff5858b386232117c96a

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
797KB

MD5
75a07836dcd639567c45f38857334c27

SHA1
28c0145599c1f492af39522a667d036fe00b88d4

SHA256
d870587355cf072dbd502e8a76005a20142d734b653b6d5c581c6501d3306db9

SHA512
d59b6fa47ed333a4d8086b144e6aba7b3b166097dc6f3180eb5ab7f90324600ced16d321464980e72ee117443ecf8f251bf1b76b4ec3b845ed4ccd0b3536a7f4

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
797KB

MD5
75a07836dcd639567c45f38857334c27

SHA1
28c0145599c1f492af39522a667d036fe00b88d4

SHA256
d870587355cf072dbd502e8a76005a20142d734b653b6d5c581c6501d3306db9

SHA512
d59b6fa47ed333a4d8086b144e6aba7b3b166097dc6f3180eb5ab7f90324600ced16d321464980e72ee117443ecf8f251bf1b76b4ec3b845ed4ccd0b3536a7f4

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
797KB

MD5
75a07836dcd639567c45f38857334c27

SHA1
28c0145599c1f492af39522a667d036fe00b88d4

SHA256
d870587355cf072dbd502e8a76005a20142d734b653b6d5c581c6501d3306db9

SHA512
d59b6fa47ed333a4d8086b144e6aba7b3b166097dc6f3180eb5ab7f90324600ced16d321464980e72ee117443ecf8f251bf1b76b4ec3b845ed4ccd0b3536a7f4

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
797KB

MD5
75a07836dcd639567c45f38857334c27

SHA1
28c0145599c1f492af39522a667d036fe00b88d4

SHA256
d870587355cf072dbd502e8a76005a20142d734b653b6d5c581c6501d3306db9

SHA512
d59b6fa47ed333a4d8086b144e6aba7b3b166097dc6f3180eb5ab7f90324600ced16d321464980e72ee117443ecf8f251bf1b76b4ec3b845ed4ccd0b3536a7f4

Download Submit
memory/824-54-0x0000000075741000-0x0000000075743000-memory.dmp

Filesize
8KB

Download
memory/1848-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads