Analysis
- max time kernel
146s - max time network
122s - platform
windows7_x64 - resource
win7-20240221-en - resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system - submitted
28/02/2024, 22:39
Behavioral task
behavioral1
Sample
ad0a291d7337221f412af0f32f7403ea.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad0a291d7337221f412af0f32f7403ea.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
11 signatures
150 seconds
General
- Target ad0a291d7337221f412af0f32f7403ea.exe
- Size 293KB
- Sample240228-2k5bysfe9t
- SHA256 8db8d8e5e0d5835754875ba1d7b048772a018af991a277a18d92d538b4a3e7c2
- MD5 ad0a291d7337221f412af0f32f7403ea
- SHA1 0a680cb9648b77d5f7e9ac49a9f8884eb9316edc
- SHA512 a4ec6e15c43b9ddbf36df687d697236f20f447d02cea5cd7964374a20ba255b0599895a8d548f637e467ff02fcd89f897b56a12c878f35ac2fcece5fc0e795d6
- SSDEEP 6144:LiMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyApHhP+gDzvR0:5MMpXKb0hNGh1kG0HWnALb0
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" ad0a291d7337221f412af0f32f7403ea.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe - Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
resource yara_rule behavioral1/files/0x000a000000012254-2.dat aspack_v212_v242 behavioral1/files/0x0035000000015c4d-38.dat aspack_v212_v242 behavioral1/files/0x0001000000000026-55.dat aspack_v212_v242 - Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk ad0a291d7337221f412af0f32f7403ea.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk ad0a291d7337221f412af0f32f7403ea.exe - Executes dropped EXE 1 IoCs
pid Process 2492 HelpMe.exe - Loads dropped DLL 31 IoCs
pid Process 1460 ad0a291d7337221f412af0f32f7403ea.exe 1460 ad0a291d7337221f412af0f32f7403ea.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe 2492 HelpMe.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\K: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\A: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\G: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\L: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\M: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\Y: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\I: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\T: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\E: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\H: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\R: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\S: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\W: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\J: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\Q: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\Z: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\B: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\N: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\O: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\P: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\U: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\V: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\X: ad0a291d7337221f412af0f32f7403ea.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe - Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF ad0a291d7337221f412af0f32f7403ea.exe File opened for modification C:\AUTORUN.INF ad0a291d7337221f412af0f32f7403ea.exe File opened for modification F:\AUTORUN.INF HelpMe.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe ad0a291d7337221f412af0f32f7403ea.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1460 wrote to memory of 2492 1460 ad0a291d7337221f412af0f32f7403ea.exe 28 PID 1460 wrote to memory of 2492 1460 ad0a291d7337221f412af0f32f7403ea.exe 28 PID 1460 wrote to memory of 2492 1460 ad0a291d7337221f412af0f32f7403ea.exe 28 PID 1460 wrote to memory of 2492 1460 ad0a291d7337221f412af0f32f7403ea.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad0a291d7337221f412af0f32f7403ea.exe"C:\Users\Admin\AppData\Local\Temp\ad0a291d7337221f412af0f32f7403ea.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2492
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-406356229-2805545415-1236085040-1000\desktop.ini.exe
- Size 293KB
- SHA256 89fb96a8d2ab44d20c0b21dedb0f0975fc51468720a9d674b8bf7d1c24659e53
- MD5 2595fc8fa65d71b4cfbc0445af30ae39
- SHA1 84a0cda5008b6f4a40f65d422e572415121b4f23
- SHA512 a6602f30e73e5660d54152e6f8f6e18354fbd354910342a731b424aab913122879f137471dcebbc3d7f40d45c284799c8b4db1cdf0d99e208041ec793f89651a
- SSDEEP 6144:LiMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyApHhP+gDzvR8:5MMpXKb0hNGh1kG0HWnALb8
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
- Size 1KB
- SHA256 122859923698ced7a62f70adc1a9015236921cfcf4d0b700009add030033f683
- MD5 b16083816e83b0a3b0f16b55a889aeee
- SHA1 d48acfbfea1e7428f8dadc8bfa4941ad101b57cf
- SHA512 6eb819709caa1aba7a350a04e86ad2bed9b3a025aea30719c75ca79193c822ffd7eceb8e5d407b90fe67f876dd9f6cb7c88b2f1f0ce7aab2692ba44a88f2dfbe
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
- Size 950B
- SHA256 2914e36e284fd3012944de1b83f6048404a6c0acd32375c7d40c8c01d66145f8
- MD5 88f0b6023f3e4838c2be797b8b6e3fc5
- SHA1 b3341ca687f7f8fd196f2e8476c765482cb77acc
- SHA512 f25c0efca550ac34f428fc5cde6becb713374e4260a2541d2c8c74aff6159422e4d5bd18dabe2388002d23c00cca8827792f03b223d0da069c02b4b909823dba
- MD5 SHA1 SHA512
- Path F:\AUTORUN.INF
- Size 145B
- SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
- MD5 ca13857b2fd3895a39f09d9dde3cca97
- SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
- SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
- MD5 SHA1 SHA512
- Path F:\AutoRun.exe
- Size 293KB
- SHA256 8db8d8e5e0d5835754875ba1d7b048772a018af991a277a18d92d538b4a3e7c2
- MD5 ad0a291d7337221f412af0f32f7403ea
- SHA1 0a680cb9648b77d5f7e9ac49a9f8884eb9316edc
- SHA512 a4ec6e15c43b9ddbf36df687d697236f20f447d02cea5cd7964374a20ba255b0599895a8d548f637e467ff02fcd89f897b56a12c878f35ac2fcece5fc0e795d6
- SSDEEP 6144:LiMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyApHhP+gDzvR0:5MMpXKb0hNGh1kG0HWnALb0
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\HelpMe.exe
- Size 292KB
- SHA256 02315676ef3f25283f27ee7073279b5da73c38eecbdeabb2fbb9e5b0c728ac4f
- MD5 aca69a7d6681067e8f3f2af25843a04e
- SHA1 c4b169b8f1da62359d9c39bcdfe6ce1195922a99
- SHA512 1942449bc848d97268094c574bf85c672a24b6198467c1f1f09427449983f506c1cbe69762e6c1f72867b2e27be7940b9bbf9b58bcdd05f9ceeb54670f08063a
- SSDEEP 6144:LiMmXRH6pXfSb0ceR/VFAHh1kgcs0HW1kyApHhP+gDzvRU:5MMpXKb0hNGh1kG0HWnALbU
- MD5 SHA1 SHA512 SSDEEP