c0ce4187cd5edd6933c3f33ec59b5c27aec6d846d30fa0f2777c1900a783767b

Analysis

max time kernel
146s
max time network
127s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 11:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5357555a362d46343601b6b9dc6fa33a.exe
Size

939KB
MD5

5357555a362d46343601b6b9dc6fa33a
SHA1

b66a013a7485290bed5d5df3fe80fc45c22cd4e6
SHA256

c0ce4187cd5edd6933c3f33ec59b5c27aec6d846d30fa0f2777c1900a783767b
SHA512

102b8811babfe97485cfc6afea4fbdd523bc1d37c5dafc5cd2d385d8985c888a2fc78af5ac9ba17281266a9316e53a8efde24062282ef9bbd3a933f5cba35254
SSDEEP

12288:gp4pNfz3ymJnJ8QCFkxCaQTOl2GVqCw+57U:aEtl9mRda1VICwWw

Score

10^/10

persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	5357555a362d46343601b6b9dc6fa33a.exe

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	5357555a362d46343601b6b9dc6fa33a.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	5357555a362d46343601b6b9dc6fa33a.exe

Executes dropped EXE 1 IoCs

pid	Process
2392	HelpMe.exe

Loads dropped DLL 2 IoCs

pid	Process
2188	5357555a362d46343601b6b9dc6fa33a.exe
2188	5357555a362d46343601b6b9dc6fa33a.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\R:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\X:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\E:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\I:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\K:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\O:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\M:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\S:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\P:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\A:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\G:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\U:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\W:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\Z:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\B:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\H:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\J:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\L:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\N:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\Q:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\T:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\Y:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\V:	5357555a362d46343601b6b9dc6fa33a.exe
File opened (read-only)	\??\K:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	5357555a362d46343601b6b9dc6fa33a.exe
File opened for modification	C:\AUTORUN.INF	5357555a362d46343601b6b9dc6fa33a.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	5357555a362d46343601b6b9dc6fa33a.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2188 wrote to memory of 2392	2188	5357555a362d46343601b6b9dc6fa33a.exe	28
PID 2188 wrote to memory of 2392	2188	5357555a362d46343601b6b9dc6fa33a.exe	28
PID 2188 wrote to memory of 2392	2188	5357555a362d46343601b6b9dc6fa33a.exe	28
PID 2188 wrote to memory of 2392	2188	5357555a362d46343601b6b9dc6fa33a.exe	28

C:\Users\Admin\AppData\Local\Temp\5357555a362d46343601b6b9dc6fa33a.exe
"C:\Users\Admin\AppData\Local\Temp\5357555a362d46343601b6b9dc6fa33a.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2188
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3308111660-3636268597-2291490419-1000\desktop.ini.exe

Filesize
939KB

MD5
3d65e43816bbd47c1acfdeb5b04fcfc7

SHA1
fd4063e16e061fc477c71757b913771a4657ea47

SHA256
c6815cc84e6fe277afd9148f076be588a9a773872c928118dd97ba24e01a6fff

SHA512
3f3c9709c36be4c492c657608d54ee5a5efabda71b173cd17b7cfd978c032f45d647eff4f6177a6e57b6a1a184e14d82efdc9ce51d177591c4f4c90bbae5c0cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
20d03a752a6a691fb2755a59a39cabec

SHA1
0f8d9b99be5613376ec52a7c081a5b81c639cbb2

SHA256
ff3fe57ef764613522df42133f5cbb6493ec8c6f0b3d0acf28b6c46cf3f901a1

SHA512
da5a5b9db7dae0875f2ae87d392700c36950b31010571a53da3f50707e9fce6ff92d509078e3b3155f468fb84e82211768e8ca9f2fc228abedc7e4aa6bf6defd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
446b98bb0837a4260a49b7bd190b4067

SHA1
d051e13a01c4e601124ceaf8132252654d1c0465

SHA256
5a316650891797dd7da9f832376e880d1f76e4ae9374c1b9a4226d687463dd72

SHA512
bedf76f4654f6527a019da6c4399eaac85da1e7ec207384008786c907643064cf97b619b97c78b56d9593bc492f15852444b1843d8c0e05ac79349218a382bc2

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
939KB

MD5
5357555a362d46343601b6b9dc6fa33a

SHA1
b66a013a7485290bed5d5df3fe80fc45c22cd4e6

SHA256
c0ce4187cd5edd6933c3f33ec59b5c27aec6d846d30fa0f2777c1900a783767b

SHA512
102b8811babfe97485cfc6afea4fbdd523bc1d37c5dafc5cd2d385d8985c888a2fc78af5ac9ba17281266a9316e53a8efde24062282ef9bbd3a933f5cba35254

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
824KB

MD5
c853a168279977cd88639426e1af524d

SHA1
b7901437e3c439106b6fefee2ac2fb549248d402

SHA256
e07428c9a6eb8f2332a668b011a432b61f736ad65c0516ed2ffd0ffe436aae9a

SHA512
82eae8c0d2e3747d643cc8ca9c79cad608d7956ecb1c9c7ccad952643aa59a837a89d3551cc16e9236f28b7b409347f44acb7f7a7c41b5a2aee67284bd1f238c

Download Submit
memory/2188-103-0x0000000000400000-0x000000000047894E-memory.dmp

Filesize
482KB

Download
memory/2188-4-0x0000000001DB0000-0x0000000001E29000-memory.dmp

Filesize
484KB

Download
memory/2188-1-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2188-0-0x0000000000400000-0x000000000047894E-memory.dmp

Filesize
482KB

Download
memory/2188-152-0x00000000001B0000-0x00000000001B1000-memory.dmp

Filesize
4KB

Download
memory/2188-237-0x0000000001DB0000-0x0000000001E29000-memory.dmp

Filesize
484KB

Download
memory/2392-11-0x0000000000400000-0x000000000047894E-memory.dmp

Filesize
482KB

Download
memory/2392-13-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2392-242-0x0000000000400000-0x000000000047894E-memory.dmp

Filesize
482KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads