a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a

Analysis

max time kernel
253s
max time network
334s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29-11-2022 08:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
Size

188KB
MD5

0e70e25d265e5a926a49089a0c3c9878
SHA1

109b81d500e34bcb8460274212d15fb9c97d01a3
SHA256

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a
SHA512

ea12de35c7e697d3c2a1d8a2c39efa122fdc8276c4fe82a292c17a61608d23a4055df07877f758fb87b2e03f359632076b6bfed73a901e8237deda1026231441
SSDEEP

3072:rimsXXK9HRTOeriRfP6pXfSb0dspqc5oY0htVFAHT11Ual21Cxcs0HKAH057kyJ4:riMmXRH6pXfSb0ceR/VFAHh1kgcs0HWq

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 9 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-1214520366-621468234-4062160515-1000\desktop.ini.exe	aspack_v212_v242
C:\AutoRun.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242

Executes dropped EXE 1 IoCs

Processes:

HelpMe.exe

pid process

1488 HelpMe.exe

pid	process
1488	HelpMe.exe

Drops startup file 3 IoCs

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Loads dropped DLL 5 IoCs

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

pid	process
672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
1488	HelpMe.exe
1488	HelpMe.exe
1488	HelpMe.exe

Enumerates connected drives 3 TTPs 48 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

description	ioc	process
File opened (read-only)	\??\H:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\K:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\S:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\J:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\P:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\R:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\V:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\B:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\Q:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\Y:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\Z:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\X:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\E:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\F:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\I:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\M:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\T:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\W:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\A:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\N:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\O:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\G:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\L:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\U:	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\F:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

description	ioc	process
File opened for modification	C:\AUTORUN.INF	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exeHelpMe.exe

description	ioc	process
File created	C:\Windows\SysWOW64\HelpMe.exe	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

Processes:

a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe

description	pid	process	target process
PID 672 wrote to memory of 1488	672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe	HelpMe.exe
PID 672 wrote to memory of 1488	672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe	HelpMe.exe
PID 672 wrote to memory of 1488	672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe	HelpMe.exe
PID 672 wrote to memory of 1488	672	a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe	HelpMe.exe

C:\Users\Admin\AppData\Local\Temp\a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe
"C:\Users\Admin\AppData\Local\Temp\a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:672

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:1488

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1214520366-621468234-4062160515-1000\desktop.ini.exe
Filesize
188KB

MD5
eb953cd76c3da600c93e86f724928c44

SHA1
8e6743a3c71b6a5449179bf84a2a97cb7def37f7

SHA256
2a1f0d927d3b17a01dd184f74127b2cf95b0acb7358b810f8317f149e6cc6516

SHA512
51c10853441326f121a09ecfcdcb2d1ea6b093962e6e0b9e7241eba5d1abd99fd937da13a3868cd6ac74c67197f6583d6d1f3002dedeaed5e1eca10cd29b978f

Download Submit
C:\AutoRun.exe
Filesize
188KB

MD5
0e70e25d265e5a926a49089a0c3c9878

SHA1
109b81d500e34bcb8460274212d15fb9c97d01a3

SHA256
a438add2f0609d81dcae0e4cb18581aa1ab0a8dd006e17f9047c8750605c522a

SHA512
ea12de35c7e697d3c2a1d8a2c39efa122fdc8276c4fe82a292c17a61608d23a4055df07877f758fb87b2e03f359632076b6bfed73a901e8237deda1026231441

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
2005ffb9c62f120f8a9857da3a525224

SHA1
f101cebb149612a0fab32a818efdf69257bf4dc0

SHA256
03df87e7de319892aa1b714f205c9af7a72ed94fe86bd497ce621d5fb2174c1b

SHA512
cc52b515185129765ce53eb432cd8e6da9c4231f40c8a4aea6535cd34ce3b9f846540c6f297d7dc977e39049c71ca07909ebc8bd97e5a69feba86e70820b70e1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Filesize
950B

MD5
2005ffb9c62f120f8a9857da3a525224

SHA1
f101cebb149612a0fab32a818efdf69257bf4dc0

SHA256
03df87e7de319892aa1b714f205c9af7a72ed94fe86bd497ce621d5fb2174c1b

SHA512
cc52b515185129765ce53eb432cd8e6da9c4231f40c8a4aea6535cd34ce3b9f846540c6f297d7dc977e39049c71ca07909ebc8bd97e5a69feba86e70820b70e1

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
C:\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
\Windows\SysWOW64\HelpMe.exe
Filesize
182KB

MD5
1d1d22affbef11fd567037386c778564

SHA1
c4312719b2ea51133e35e5a6c8b8e24294d7366e

SHA256
9c5aba1c1069763eda69cc6ca8b5e23b7801f21ccc10194bc21b0397a241f3de

SHA512
c60fef613cc3dc6e23f083e5f4826ff59717a3e9f73a10c67da18a1af2ab7280d2e3332a35044076534f3f152256fa704720ee95b50e3a7701f02d0731dfbf93

Download Submit
memory/672-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1488-57-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads