Analysis
- max time kernel
145s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
30/12/2023, 08:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
13915d863b77ae9962214393fc8de08b.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
13915d863b77ae9962214393fc8de08b.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target 13915d863b77ae9962214393fc8de08b.exe
- Size 2.2MB
- Sample231230-kjamhsbffq
- SHA256 c61cecd1469b5b262f59cf7bd9030a7f472a489aacfdcd37f5b97e6bb31f4e6f
- MD5 13915d863b77ae9962214393fc8de08b
- SHA1 8a0fae7540428c8c0f63cecb711536f38acfc493
- SHA512 9ecca8704b7857bd8a2e2b38e8d8d9d1ec3f605c1f60437f54fc839f369ee5779fc46154f3346f04bdb99888e6a99531fe44c46a2954690e6e7f89df0bb839e0
- SSDEEP 49152:JEs14ahMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMD:JE2ThMMHMMMvMMZMMMlmMMMiMMMYJMMD
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe - Renames multiple (5583) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe - Executes dropped EXE 1 IoCs
pid Process 1256 HelpMe.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe - Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF HelpMe.exe File opened for modification C:\AUTORUN.INF HelpMe.exe - Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe Process not Found File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe File opened for modification C:\Windows\SysWOW64\HelpMe.exe Process not Found File created C:\Windows\SysWOW64\notepad.exe.exe Process not Found - Drops file in Program Files directory 64 IoCs
description ioc Process File created C:\Program Files\Java\jdk-1.8\jre\bin\msvcp140.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHART.DLL.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\msotdaddin.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\libcrypto-1_1-x64.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-math-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_Subscription-pl.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-black_scale-80.png.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\rsod\proof.fr-fr.msi.16.fr-fr.boot.tree.dat.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEODTXT.DLL.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSAN.TTF.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Security.Cryptography.Algorithms.dll.exe HelpMe.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\charsets.jar.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_OEM_Perp-ppd.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\EduWorks Data Streamer Add-In\Microsoft.Office.Tools.Common.v4.0.Utilities.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinGrid.v11.1.dll.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ink\tr-TR\tipresx.dll.mui.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription3-pl.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-pl.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdXC2RVL_MAKC2R-ul-oob.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_es.dub.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\api-ms-win-crt-private-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMEEXT.DLL.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.25\es\System.Windows.Forms.Design.resources.dll.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\pl\System.Windows.Forms.resources.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Client\api-ms-win-crt-time-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\fre\StartMenu_Win8.mp4.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\Bibliography\Sort\TITLE.XSL.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.25\System.IO.FileSystem.Watcher.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Subtle Solids.eftx.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Grace-ppd.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-pl.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\mscss7wre_fr.dub.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\msointl30.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\1033\STINTL.DLL.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\VBA\VBA7.1\VBEUIRES.DLL.exe HelpMe.exe File created C:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-core-timezone-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Java\jdk-1.8\jre\lib\security\cacerts.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\+Connect to New Data Source.odc.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\sqlpdw.xsl.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7EN.LEX.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.ComponentModel.dll.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\it\UIAutomationProvider.resources.dll.exe HelpMe.exe File created C:\Program Files\Java\jre-1.8\bin\prism_sw.dll.exe HelpMe.exe File created C:\Program Files\Java\jre-1.8\bin\vcruntime140.dll.exe HelpMe.exe File created C:\Program Files\Java\jre-1.8\lib\images\cursors\win32_LinkNoDrop32x32.gif.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\api-ms-win-crt-convert-l1-1-0.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\Mso98win32client.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Microsoft.Office.Interop.Excel.dll.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.0\System.Data.dll.exe HelpMe.exe File created C:\Program Files\Java\jdk-1.8\lib\orb.idl.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Grace-ppd.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ul-oob.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-ppd.xrm-ms.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\vi\msipc.dll.mui.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] HelpMe.exe File created C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.boot.tree.dat.exe HelpMe.exe File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.0\zh-Hant\System.Windows.Forms.Primitives.resources.dll.exe HelpMe.exe File created C:\Program Files\Microsoft Office\root\Client\concrt140.dll.exe HelpMe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1788 Process not Found 1788 Process not Found - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1788 wrote to memory of 1256 1788 Process not Found 92 PID 1788 wrote to memory of 1256 1788 Process not Found 92 PID 1788 wrote to memory of 1256 1788 Process not Found 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\13915d863b77ae9962214393fc8de08b.exe"C:\Users\Admin\AppData\Local\Temp\13915d863b77ae9962214393fc8de08b.exe"1⤵PID:1788
-
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Program Files directory
PID:1256
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\HelpMe.exe
- Size 93KB
- SHA256 a8c84c7fea2b07d49b860ff899c69271e34d61528bcc596f01c95ea653f3f816
- MD5 4d659e7c9a3194b13041dd124051fd08
- SHA1 5fa60202f135c3f31af67fff93e6670620c13a39
- SHA512 71d9c7f0b7405d8ca32d7866567a1a0680d78da192fdffa1036efd7e758710fd0b94484975c4d8db9679ac5d04d90704f2fe7a5114cde386f63f53fe93a11e76
- SSDEEP 1536:yCqkQHeW2qhdpPW1/poUFTjNZv6s+804DIeBh9Hh8FaXYBWB3sBKyxsMI0S9V:fm8qjpPWZpvNjrvv+804DIepHiFaokVr
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\HelpMe.exe
- Size 384KB
- SHA256 b23f3b5e05578899d247a9b4bfb5aa8774ad751a04184318aa5ac917327f2ff3
- MD5 8beeb5c0f7c161b766e4baed8421a257
- SHA1 fd23ee296c4b98994f22b62579ba58bded920bde
- SHA512 d41141c3e5c96756be2382323edadec1833d512c914554ed6161e625b5b7925075a94f461cf5927092746572fab4fd1ca9bc0e2be9f9db11f37ea2f456fa3936
- SSDEEP 6144:+82p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYB:Yp4pNfz3ymJnJ8QCFkxCaQTOl
- MD5 SHA1 SHA512 SSDEEP