927310d4a07260477232678066ff53cbd2ac76c82863ba19ea7af8ca1cf63576

Analysis

max time kernel
164s
max time network
147s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
12-10-2023 01:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
Size

20.8MB
MD5

1f0702f557828bfb7d885081eab158d6
SHA1

373ac2f11f2dabf51fdb6e5d351c2770b4d8d72e
SHA256

927310d4a07260477232678066ff53cbd2ac76c82863ba19ea7af8ca1cf63576
SHA512

919bc4695dc98387c5c306227081114ed9133165f9c6d4df9bcfc0eac0378e19a92c8f0defccd87f3426d7deeb2ad163d23e2a444ee6ddf996e406619a1e4803
SSDEEP

98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMR:9nwngnwnBRk

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\G:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\I:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\U:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\Q:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\K:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\O:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\W:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\Z:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\A:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\B:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\R:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\E:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\J:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\T:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\P:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\H:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\L:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\N:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\M:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\S:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\V:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\X:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\Y:	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened (read-only)	\??\P:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2464 wrote to memory of 2356	2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe	28
PID 2464 wrote to memory of 2356	2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe	28
PID 2464 wrote to memory of 2356	2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe	28
PID 2464 wrote to memory of 2356	2464	2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe	28

C:\Users\Admin\AppData\Local\Temp\2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe
"C:\Users\Admin\AppData\Local\Temp\2023-08-26_1f0702f557828bfb7d885081eab158d6_ryuk_JC.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3513876443-2771975297-1923446376-1000\desktop.ini.exe

Filesize
20.8MB

MD5
dec16a0f6fb1d78858f60e4a0a0903e0

SHA1
ce422472f68367a29d30aa72391ce567c6280167

SHA256
bd107ea82d6519be9ddebe715f111afc19f3eb134e492697b251fd37db3e9f2e

SHA512
3afdac0871e0e91a43e5ff585212a711658592e2dbcf21f196affc88f1dde05b2568c3b58e991eb19f15b51fcdf92061db5521383a788fdf66e67e4b753037da

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
27c433734b0141001e030f537214e021

SHA1
77232b0fa618e452fd8afc3891f6a117fd65fe7f

SHA256
3e95d2d82f63fdba0995714bcbc6c48dee2bcfe0f679304d1c984117e5ee91ac

SHA512
8d9e6e00cfbd60b1e2cb0928a55414ea7e87e269bf2f3b004637d60bbe04203987fe5645411fafb9fda3dc9bfd5f198641c1fd6f03d8fbfd066e78ac2cc0e829

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
177a601530b12726c30105c12443bb1f

SHA1
c3921c02fe2266c61709c2de82c64d5808e9f46e

SHA256
9d2898bdc4baecc6d985e0007c706821bb2ebaa4fdde3857ee6056154e1817ae

SHA512
6b0dc38ec221bc7acd56b644f9bd8160d70d6c5cb248970d864c896562db6a94c3c3488e1053466f01270bd1aaf6fd25e2a398385fd2a6a5f518f244fcce8770

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.8MB

MD5
48eb9d1993fcadbcfecc43bd0df4e72b

SHA1
6b2cfc5e036587d0ec584e9ba10a0af4e4a372e1

SHA256
d67fdda64d1f88699d86408fd8a150b7f34b4cb12918d62600ddb76d8fd13b0b

SHA512
f13efc43262436434df0764656743116b7d2a11fe93225d7567b2995faa81bbbdde6bea8b4e221677c26fa67239dac7eb076c3ecb2dfbde3ddeffa9fb9e54193

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.8MB

MD5
48eb9d1993fcadbcfecc43bd0df4e72b

SHA1
6b2cfc5e036587d0ec584e9ba10a0af4e4a372e1

SHA256
d67fdda64d1f88699d86408fd8a150b7f34b4cb12918d62600ddb76d8fd13b0b

SHA512
f13efc43262436434df0764656743116b7d2a11fe93225d7567b2995faa81bbbdde6bea8b4e221677c26fa67239dac7eb076c3ecb2dfbde3ddeffa9fb9e54193

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
20.8MB

MD5
48eb9d1993fcadbcfecc43bd0df4e72b

SHA1
6b2cfc5e036587d0ec584e9ba10a0af4e4a372e1

SHA256
d67fdda64d1f88699d86408fd8a150b7f34b4cb12918d62600ddb76d8fd13b0b

SHA512
f13efc43262436434df0764656743116b7d2a11fe93225d7567b2995faa81bbbdde6bea8b4e221677c26fa67239dac7eb076c3ecb2dfbde3ddeffa9fb9e54193

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
20.8MB

MD5
1f0702f557828bfb7d885081eab158d6

SHA1
373ac2f11f2dabf51fdb6e5d351c2770b4d8d72e

SHA256
927310d4a07260477232678066ff53cbd2ac76c82863ba19ea7af8ca1cf63576

SHA512
919bc4695dc98387c5c306227081114ed9133165f9c6d4df9bcfc0eac0378e19a92c8f0defccd87f3426d7deeb2ad163d23e2a444ee6ddf996e406619a1e4803

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
20.8MB

MD5
48eb9d1993fcadbcfecc43bd0df4e72b

SHA1
6b2cfc5e036587d0ec584e9ba10a0af4e4a372e1

SHA256
d67fdda64d1f88699d86408fd8a150b7f34b4cb12918d62600ddb76d8fd13b0b

SHA512
f13efc43262436434df0764656743116b7d2a11fe93225d7567b2995faa81bbbdde6bea8b4e221677c26fa67239dac7eb076c3ecb2dfbde3ddeffa9fb9e54193

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
20.8MB

MD5
48eb9d1993fcadbcfecc43bd0df4e72b

SHA1
6b2cfc5e036587d0ec584e9ba10a0af4e4a372e1

SHA256
d67fdda64d1f88699d86408fd8a150b7f34b4cb12918d62600ddb76d8fd13b0b

SHA512
f13efc43262436434df0764656743116b7d2a11fe93225d7567b2995faa81bbbdde6bea8b4e221677c26fa67239dac7eb076c3ecb2dfbde3ddeffa9fb9e54193

Download Submit
memory/2356-14-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2356-12-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2356-67-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2464-0-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2464-66-0x0000000000360000-0x00000000003DB000-memory.dmp

Filesize
492KB

Download
memory/2464-4-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download
memory/2464-3-0x0000000000400000-0x000000000047B000-memory.dmp

Filesize
492KB

Download
memory/2464-1-0x0000000000320000-0x0000000000321000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads