a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8

Analysis

max time kernel
154s
max time network
46s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 00:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
Size

186KB
MD5

6fc7d46bf78a5dea96c7fdc9d5456743
SHA1

0ae6ca13828c488ac0546af3a21d5160b9619a58
SHA256

a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8
SHA512

2c5f3495bc7d4d52170fafbb58646ff32357bd7158c8e3ec9779e2b4408468e91992a07f6112f1a3c0fb84c8d51dca65a1fbbc2479893233db4de607fdc7336d
SSDEEP

3072:rimsXXK9HRTOeriRfP6pXfSb0dspqc5oY0htVFAHT11Ual21Cxcs0HKAH057kyJo:riMmXRH6pXfSb0ceR/VFAHh1kgcs0HWa

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 26 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x0007000000005c50-55.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-56.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-58.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-60.dat	aspack_v212_v242
behavioral1/files/0x0008000000012703-61.dat	aspack_v212_v242
behavioral1/files/0x000b00000001230f-62.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-63.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-64.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-67.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-70.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-73.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-76.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-79.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-82.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-85.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-88.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-91.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-94.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-97.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-100.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-103.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-106.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-109.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-112.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-115.dat	aspack_v212_v242
behavioral1/files/0x0007000000005c50-118.dat	aspack_v212_v242

Executes dropped EXE 1 IoCs

pid	Process
1052	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe

Loads dropped DLL 27 IoCs

pid	Process
2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe
1052	HelpMe.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\N:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\U:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\G:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\K:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\F:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\R:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\S:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\A:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\I:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\Z:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\P:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\X:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\V:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\W:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\Y:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\B:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\H:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\M:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\Q:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\T:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\E:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\J:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened (read-only)	\??\O:	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2036 wrote to memory of 1052	2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe	26
PID 2036 wrote to memory of 1052	2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe	26
PID 2036 wrote to memory of 1052	2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe	26
PID 2036 wrote to memory of 1052	2036	a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe	26

C:\Users\Admin\AppData\Local\Temp\a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe
"C:\Users\Admin\AppData\Local\Temp\a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2036
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Executes dropped EXE
  - Drops startup file
  - Loads dropped DLL
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:1052

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-999675638-2867687379-27515722-1000\desktop.ini.exe

Filesize
186KB

MD5
97dab43159a8e8e4b81b6a7c71fe2d2f

SHA1
0dfbdb14c06848f1e4aece6e8b5aabba9e6d33c4

SHA256
eacc6e244ef097e4306241c52199642e45e6da756b9b113014799083e517d3b4

SHA512
08b9f0ecb986fb812c2499b0b369180ba75c2b24db9e4e2cc4adb6458b1da49e5368856cebcf06d4280608f1949dc0be707ab04958dcb32ca27a15c6c7bdbec7

Download Submit
C:\AutoRun.exe

Filesize
186KB

MD5
6fc7d46bf78a5dea96c7fdc9d5456743

SHA1
0ae6ca13828c488ac0546af3a21d5160b9619a58

SHA256
a674e4d991daf4bd597c94ede8b34237f7887a9a6187acbdb3bb0f63f3500af8

SHA512
2c5f3495bc7d4d52170fafbb58646ff32357bd7158c8e3ec9779e2b4408468e91992a07f6112f1a3c0fb84c8d51dca65a1fbbc2479893233db4de607fdc7336d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
946B

MD5
dfe94c18dfc1709eb9a7442088f75255

SHA1
ddc66de94dace5d768e97495e55d6a035020bd33

SHA256
2e8aa3f24cdb50fa0493603ac4a668b5f25bc4ec7773733ffa6eeef88ae797d9

SHA512
6914518dfebf2e5a37378bd5fae35e3c4ef2612e4542d6a01ef2ae42791b10e1477f3cc7002743dbb0ab5e9bed5eb0b5e6b47f810684f6269d6e92f2216cb720

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7d88e99b4076140199c44728afd25abe

SHA1
b9dbd8796a05b9d256df64fb49b2ef17c130c4b2

SHA256
8a222b9d021386ed2d9245f6743c6628cf3c3196a48bf801c800e089ebf225b3

SHA512
460e2bed4c35e4045e97064481f45b49068193cf4b2b8a2db0becc9b22fd236f5013bddbebeaa2ac827298f83d4475ba5167d1e006d95192d95c3a4fdac698b8

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
183KB

MD5
642204f5f29ed00a25daf8fa03777a3b

SHA1
2b5ae7ee534b90cdb216c3e91d93e04ac9e46d6b

SHA256
e151307c8873bbb0a7005371185458ef8ed4fbc44115424bcba69755b8bd7aef

SHA512
cd74fe3b5793caaa004bc251b544f8b866f3e887b80a355f98d4ff1e7a5c81bfae7434ccad3a20472ed491451f44eff07dac607d670f2588a8167f976afe49d1

Download Submit
memory/2036-54-0x0000000076151000-0x0000000076153000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads