Analysis
-
max time kernel
191s -
max time network
225s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 03:34
Static task
static1
Behavioral task
behavioral1
Sample
5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe
-
Size
474KB
-
MD5
80426d9fb58e322c1643e6ac12257c00
-
SHA1
859d681f0bfaa76eb014750e99175f5fb2122998
-
SHA256
5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05
-
SHA512
c173e7a3da75eeab3e7fa82365a9ce942c55045fd94cd4d4b5afb0cd674eae5c0c4457f8030a80c31786b5519530b9d031aead25c1715a7e10160e0ce120b164
-
SSDEEP
6144:k82p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBilO:Cp4pNfz3ymJnJ8QCFkxCaQTOl2jq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Executes dropped EXE 1 IoCs
pid Process 2768 HelpMe.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\F: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe -
Drops autorun.inf file 1 TTPs 1 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification C:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\HelpMe.exe 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe File created C:\Windows\SysWOW64\notepad.exe.exe 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe File created C:\Windows\SysWOW64\HelpMe.exe 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\7-Zip\History.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\ro.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fr-FR\TipTsf.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\System\msadc\it-IT\msaddsr.dll.mui.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\it.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\ps.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\System\Ole DB\de-DE\oledb32r.dll.mui.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\be.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVOrchestration.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RUI.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml.exe HelpMe.exe File created C:\Program Files\Common Files\System\msadc\msaddsr.dll.exe HelpMe.exe File created C:\Program Files\Common Files\System\msadc\msdaprst.dll.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\uz.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\zh-cn.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\ClientEventLogMessages.man.exe HelpMe.exe File created C:\Program Files\Common Files\System\Ole DB\fr-FR\msdasqlr.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\InkObj.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\System\msadc\de-DE\msadcer.dll.mui.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\ja.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.es-es.dll.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\id.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.vi-vn.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\concrt140.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\micaut.dll.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\gl.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\lt.txt.exe HelpMe.exe File created C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\pl.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\tt.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\readme.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsplk.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\uk-UA\tipresx.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\System\ado\adovbs.inc.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\ShapeCollector.exe.mui.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TipTsf.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\VC\msdia100.dll.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\ky.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.pt-pt.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee90.tlb.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\cs.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-time-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVFileSystemMetadata.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ja-jp-sym.xml.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb.exe HelpMe.exe File created C:\Program Files\Common Files\System\Ole DB\msdasql.dll.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\fr.txt.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\fur.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.sr-latn-rs.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat.exe HelpMe.exe File created C:\Program Files\7-Zip\Lang\mr.txt.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\ja-JP\InkObj.dll.mui.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4976 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe 4976 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4976 wrote to memory of 2768 4976 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe 80 PID 4976 wrote to memory of 2768 4976 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe 80 PID 4976 wrote to memory of 2768 4976 5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe"C:\Users\Admin\AppData\Local\Temp\5214f774aa6c32a3044b8886aee129f32c91dd27a483eee106ba838c32a58b05.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4976 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
PID:2768
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
460KB
MD58ea4fbd72a892e218eb8cee13682d9ea
SHA1b31e61d74e652682ee0de4f1ac708913601e903f
SHA2565846edd2087927866b7f76443ea75cef5df70bbf6ceecebff3853cac8412895a
SHA5129d6fdceacb309dcbf69438ee8b31fc20f740d7c3a7764aa708be2921adfb2a5a91a489f430b4883d31e73b93d622809f50dde7f7c4cdc9a7a2dcd7824040f882
-
Filesize
459KB
MD5fd4d6ea614f5bb79a5a805f0fec892b7
SHA1115dfdbef71d8569574d5d98fd3f5bed173f8dbf
SHA2562c5336f8f93fb76f50554cde98ecce3be4da05629075e994bdbb787e8c2b6980
SHA51264ef659b9397af968235af46007f196bc7062687ec1a6504ca9d30198241c21acb54ac9b6c4c2584b5c4a34091af13c6d0f0722aa02c7ef81c1f86321d9553c1
-
Filesize
459KB
MD5fd4d6ea614f5bb79a5a805f0fec892b7
SHA1115dfdbef71d8569574d5d98fd3f5bed173f8dbf
SHA2562c5336f8f93fb76f50554cde98ecce3be4da05629075e994bdbb787e8c2b6980
SHA51264ef659b9397af968235af46007f196bc7062687ec1a6504ca9d30198241c21acb54ac9b6c4c2584b5c4a34091af13c6d0f0722aa02c7ef81c1f86321d9553c1