9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9

Analysis

max time kernel
145s
max time network
102s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 01:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
Size

907KB
MD5

1f034a17091b7512212a6d875967f38c
SHA1

aeb5dd8c9a0fc2d938469a463c7e67ea8a89fa09
SHA256

9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9
SHA512

90cc130115eb72cc37e3ac94d127af46e159f42424bc1117524962ea0014e89838c0dfa35e4098308d7964f76b9494990c4af4ef9861db5f259cb32f58552526
SSDEEP

24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvl:oEs1hz

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
4476	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\G:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Y:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\S:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\X:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\I:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\M:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\N:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\K:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\O:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\V:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\B:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\J:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\L:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\Q:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\A:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\H:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\P:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\U:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\E:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\R:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\T:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\W:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened (read-only)	\??\Z:	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 4476	1808	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	84
PID 1808 wrote to memory of 4476	1808	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	84
PID 1808 wrote to memory of 4476	1808	1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe	84

C:\Users\Admin\AppData\Local\Temp\1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\1f034a17091b7512212a6d875967f38c_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe

Filesize
908KB

MD5
8eaa7485af01560157291cc6ae18fce9

SHA1
b7ae9ed542665866c3f1b1d80b2260696132edc3

SHA256
449a68190be6831663fd7e81a404f2e0cdc615da9ca4111d5773457043ff82f5

SHA512
2025e386b6070b787aee9323c1bff2498e778fc9aa066c9b17a919d96371cdf7f8f6c6c94f7d19d5a56c625af6da085bb0f6c43d7274fe3c043eaef38f8ce06e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
21dcb083fcef2dc5da6e7780ebdfb4d2

SHA1
c7151e69387ad4ea01640b18da7f86af52a7c222

SHA256
2d12ff5f075ba95321f0d528d1801004d1ef60f0c9d17a516d2a97de4ccf9353

SHA512
6f0d4cae1bfb808c533e47486c3be178e46fd6275831d03481e65e5e3502cdd9837b1a955acc2c1575c2916419bb3e157b95c0bc7d2578c372ff92a8a3a9e413

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
801712631c89ac1eadb1b9d2f2c09929

SHA1
710d5d5599eee235ecfa3d6caf86472430b6f028

SHA256
af776faa66d40faa5714f6e9ae772066225c4aa89a3141eb99761d5f8f76875c

SHA512
90f34553dbc3203784f3ddad59fa1029ff05395aa6f7f6d33b7f144e2ce362f267ce3a2bbb2341b760d611951fa025142e3e09a09f482e1e9861ab96c4d399b9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
1dccd625865f102949d2f273e2ab04d7

SHA1
3b89574527684e6725e8dd3822b76c326b331d92

SHA256
efc2ec81ddca07791f803f30273508395b578d805e5257d1f3a1f58f44fd7ceb

SHA512
3cc9367f1ad432add4670db2024af2ad397b78561361f2403b5934c22db142be2312c868d74a839f01d6007e06eb7ac68dca85c4ea46611e28ccea54c0269cc2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
ade4efed73378c6e4b9c0af0f1692d40

SHA1
d075ee8b08fe6989eaa94e475ea5e07c8fee3aac

SHA256
afe640ed795adc31e4754e2460c554a8d8b92c62ff4b235b9b544b10233f61f8

SHA512
c65d0a2c4fe06c8bef26c14ad9aaa5c8fd40f72de0fc7eb0a9100195a2c5e0a7a20ab59676b9c85f99d1c0511f94b81d4c47222ee3bcc6fe26b21beec9af2ffe

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
58b8d792f8ef610c1c51b7d79073d1f1

SHA1
eec4b87457e62347cfc7178907011cfa50e28ef4

SHA256
80d80d21256d053673e73be6132f67dc2ec14de2fe854928ba82f717e119c6e7

SHA512
fb307a8d65df6600d9ceacbd2f53110152d23717c64ffb4672534def1190fcf3e455d112c9f20f8bfeb4b158a5b88e18684e25a7834adff2db63ffa316d0d563

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
8f542f8d5ecc4adfca01c06bcd8f344d

SHA1
36d918796838c3a706500002233baa94c7183e80

SHA256
b6c0eefa3acd423845303bc4ecaab14b1596335060447ab5bb17a12fed57f3f1

SHA512
6946f5cbe389dfd1cd8ab83434596e74498e8491c708c7932c9c01ae2de2a88c9c6758d4fac9878e15d4a81bbe9dddc76e6c94282054e00f083d26d632956466

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
746ec074576815cd49b0fe766da1a4ec

SHA1
3517b4566eafe0895f0a571409b451121d3028b1

SHA256
f5e408c0f39797814f8b4e1ba6874cb73ceee183464aa31e9a5f80cff095a32d

SHA512
b168dc8300cca80b32e7e8dd5bc2c896568f5d5e1810ffaa297e983bba22ca3b855abd01c015db9e1ec06a74e53e7c9fbbcf7353990645678932901801c0952a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
3809711f6219cb9e8205956075a21976

SHA1
90e2149c7bb5e3fc421ed1414fe43096df8872eb

SHA256
b5da584f9b13c04d882493e5564dc72b09f68d54dccfaba26a7cd75e452104ed

SHA512
4a92eb9731863703dae3c6a910804f3dfe3131adb7a6208c001b54b70d0799dd1955ba7e09a152f55f5c4e10f21b09bfff78f803dc5551abb2107258003c1530

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
60bee292de90058c2d42b9454d4de25c

SHA1
a6907a7a2fe80e1f8ff36683861283ddbe563dd2

SHA256
5b01f9370c5799b93bacf025c34ee411433f5b37540890d93b8c1c8deae31bf1

SHA512
51d1c5cc24fc85d39ba1f59fba646ec2def7dc5c091117784f2ebf6b93018baa2fa203dfe973a032c548cd471ed310a7e95f4f70f5e8b189dcad6128c4952cc9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
018e62a7193602436ac9f94adfa61278

SHA1
4d768c1652f12296b54b8c9ffd6077e47a3e35ab

SHA256
1380fe16afbd2cf0b12cf2c8d3d68e1c3dcc656fb7e6056299117ff104551466

SHA512
32c57cacb3813c5b68c7fd60319a65c071059af28b8e8e618d66d37f6a2ae71a6a933340c9c3fa7703956b4286ff66cdddd462ba2a2819ef78c0f99cf28cc3ef

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
cc3663470505e197d8795ed9297ad736

SHA1
b338ebde408864a4458d52c8531f45e9a7b3660c

SHA256
9da69383790cab2ad81ccc65737cd1974305f0652ba656241384f1d9516362c1

SHA512
de675dcd2cbb482ddc77c5c9bcd465eb7d24d86cc60028c00d4620ee376b60fb36b60e3f651413e2af2804d78144dcd62fae16f384137a22cdd9b57f3d1802c9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d95bc7bad36ecc46d84d310acd016cc7

SHA1
e7deca265c18fda8b64929687fca11a753dbfce3

SHA256
e3e7760e648ead2c60f5b522aa229343c325da82317266d06b889f598f86b7b4

SHA512
82a39773ba5f400d4587fe6607d965a3e119e463c7cba9e2d889122bd14e86e66e261a204c0fabae0def31fdbef8a939d440681e34ee7135f70ddd778923e408

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
08cc003493b29414b819ebc784c0120f

SHA1
290432255b1b14f6aff439674113cc8a1e63eefb

SHA256
21a860cd661893d2231ef39b45d7f36f679828d9364934c1fed05ea9e2de0571

SHA512
69f3d0a73958410873dc71b0ee0de35d82c2351a939d2c6f07dbdad2f880d6788b2bffdb5063adaf542e626160f68168c7df70ef2f8c02d8f3598db71edf7506

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c023e00d21cf6574bb8c546644f1ac1f

SHA1
d099ec242b8c88b42d3e3a1a23d66952cf91bd7f

SHA256
ec352fe7edd1350140012c0ef9c66d77e00caf881598a71dae52a726053b6452

SHA512
d073421b9a0e7805bacf5122f9592abbc86462cbabf876040194a427d54e51f1e34f9c0afb1d43eb60f1399e5453293b5c6d45610589775940becde6e64428f5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
801e3497f7e9f91878efcddd65bb1f2e

SHA1
b4b5b761ec1ba2436e9b400edd6025b8a33dd18f

SHA256
fa50dd4ec152036a69abb68574dff9d2c1dcc50d48d628801447819a87adf1cc

SHA512
2ae04f9fbe758cfd1f483cb19761ffe436abea64d1884b283914f096759c136fbbbfe8ba4c90a07762b67fff2e48eac50adeb179ecf55b6f9fae54a51ce8d888

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d8b52471b3686db540fd2f20b093056a

SHA1
fc6e9fb8d110aa516c53e4ed8a32d5a743daaa37

SHA256
d9d84bce7ef3ffa82ec3549a4fb597eeec878720f877b1d5f0b1c74b298e93ae

SHA512
d66657eb685136f56cba738012ef4501ca33e36dd58eac7f4ab1ef4da5cbd28085856a7c516c5b788d5c731dea629b639bf12d864f4df46d61897f885d45bc29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
45ac1f0e01e39ecbc88c7396282da293

SHA1
2e108da108eeffed50b54b873bd29325fa1aaf3e

SHA256
7e2ab526db9b15635334e0290322651649f59f4bfd473aef3fc517ca86cb41d6

SHA512
0394347d7ab653af9a125f3e337c698f2f2d41b5682897f88762e855f5e5abb73ca14a5a0dea6722510928c2bf32f4fe588d2b390dbd22f071d45cc5b9fdf27a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
07ac5cd38de96ca303fcf2c4017bf335

SHA1
0aca74346cd2ff90df27353c8488d85fa65393ff

SHA256
630973b9c4f7e31be4d9850c0fc6b16d6f79d75b89fd257ab3c13242b7efbcab

SHA512
61b372b9df6af65664f4652e9585c8813f94deeb087bb06a87b25b49c1623c1479725bbdd886b094abbe492fd8d7dc4598f6a82d5e6f4c3dbf92c342ca90b473

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
bbf73e66266679e235c70b782c61070f

SHA1
de7eea3dd378be5c8e207ebd632125f3bf431248

SHA256
f60726dade926ef51c92d107d7950ff0b7f6f929aee48d2ed7eeb7ef7ac020db

SHA512
8d01ce9c68245dfe40dd236296ce363a24b8829ebdc06b24a55673a1df03c54d76d866fe29f158beb9827f4c0ec465d2fe975d7944cf5de652126db230f8cd9a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c4a27e9a03b4b14fe9694dce0fa873cb

SHA1
d582b49723d55e62b59b0c0f8a80d24f079629fc

SHA256
9176dd17e8d7e9d6e1af9f08d3d9688637739a77a40a0bf46520b6c7dddb9dd8

SHA512
9ab220c2287958ae9f250f0616bb4ee22a79310ac33e3ed829d99bb49a6a5273cf83e3c74e04b8545e951f802de546c3a9639519bba3809f1edb5a878cd40327

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
a93411fce243b7f048b1fa5e2c6ed578

SHA1
77b15407986852d90f8c9e032964ca72e5a8445a

SHA256
2c2332df79d45ae2746a00d5c5d7e0f07de3320317e3338e111b0c89e8d58573

SHA512
42dc24ec402d9f33c05900ed3b8a3581bc0b43cf418c6dd75c28ddef01f849197420fb9fee1e40eb837d78a5155722dc6542ec07eb7b7e6e77d8c013c0d83148

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
e5adf2b654e4d2e16910eaf5a8da399e

SHA1
7f8d8ad9ecacce6617523a5e812fde4d36a122b8

SHA256
10bb5843ef9621fafa4c9d3b947c6bcde3c7cb93049f851887361c9084a26e00

SHA512
4379f91d43bfec839e0dc17ef8d4e741e37bd21c8e67ed15666cc6b3d3e413e751fe9a7453cb879b70432468b635db66ec65a1e1367e56d0d91876b5fba3a56b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
c56a001c1ce899051546305a4d9359db

SHA1
7d70c3924a3c396e59212722de3a4f52f5762b8e

SHA256
c2d129a6a9900df8baf56f39b5b261f3a1ce593b3809f7e1b37470e0b782fabd

SHA512
919b0a8f8d6e5b404451ed3ddff0dcb3ca5703e913cf931757795a691de019aa2ad0c794dfc77a2cbd62d44e3d1796906e1f5000e5f63ba18e3d017695f9e4b1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
ea8a38cf7f5206b9a413720422997382

SHA1
e0cb75c7cb18646e833538cc1cd488765cbc0028

SHA256
32dd2185c9fc4d6fc05f81bd19731a1cadcb8706566714a7aaf07f77169e72c1

SHA512
e7864c67a3594720b8ae0dd7ee16c0d5decc9dbf7f64d3f12c6d7664000d140ba144dc4f6f46abd230d5d596f09f23a8161c3f43ca7aaaed5f2b6a7c352dd4c3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
23ec4141f1e131feb7191d95f8faadd6

SHA1
ebe927aabc0c96cd540c4b746db2cb49de9ff3ff

SHA256
8ff673108ab6e7e44a051e6928d5a8e70d381470c0ebef8b83c09d42c3240e61

SHA512
5a5c32aa7eec179074c0e131a16b7f9025ec8a21f7078808471407a5021bb6fc91f650302758d8fe29c1ee59268378d356cdfb20b0224f6cc5438f701ee3434d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
07e042cec69749f344e95dba1caab58f

SHA1
66bb7e09ea4681c41125d0762732b9075aea65cd

SHA256
0f7cc85caa1e5a3658c53da0cbd63c67749ed9ab62dc08f5b7af57cffb853132

SHA512
bf7316ead829ef234a167aa82324aff261c5a8c2d0d6d4ac1cc8fac388eb9578acd30aac3a5449ac13fececa08c6d285ffb1a52eacc0147a5890725d9c53b47d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
ed279ab5ea734aaa3e7470d4f48b86fa

SHA1
7e1bd43b1877bb1eeefe1321d59b826098e7ba50

SHA256
ffbb962729d556919ce239658df509e2f5df572882a770eeaaa653aa07509d85

SHA512
207a6db1b631079e6d4f37aba6a1449988721e53e834ed35c077cb1733d2fce29c4094a09c34d19ad987081e0bff45b0ff196cf83a2cf46417216a3297116731

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
5bca6908a7526567bb761fe371efc987

SHA1
7562edb7b425ada478f8a1c953de9449f52e2065

SHA256
100d84d6740e66df68fa29e384ac936a0a484b17b98d3a9f9bd2b3353bda8937

SHA512
f2818aa6b3dce625ca6cabad9b83c8eb9bbcf63fdfca7251165dc68662a817773c4fb8a7a485fd48ba1a4b86beabcb94528e330b6f2c6c884def4a92df3846b3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
a171e398d143b1809d7f09b3c104819b

SHA1
05f157d45558a3bfecdf1031779ea47c3732c987

SHA256
e9742693600fc67301aa698115c597e252cd38a5f4f8c26a1e282cbdce36c9ea

SHA512
62a5fe407779a96466a3f285159633ebe45e2fa13725e762717076fc8001bef07d3d3e3246a3aba9860305e1271fc122c07e9309482a78f0a7b240eab8df4f8c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
461e69f2c0610fc7c8694cdc345d50b5

SHA1
06646b19b2a5f2b146670bf7d0f72c96ae68075c

SHA256
1b51ca3a65756d70c61b203f7fe7bfb2b8eac860cbe7c44994d0e5fece83cd52

SHA512
df40e6c6f64ace521bbe844ec40bd1e14cadf743edf1efe21f75ec347941f03778d7b7ebf7d53e751a252b0b01791642fb94965742f75908911f77457ae60be9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
a4669457c343a6ef8961b24ab82450cd

SHA1
fa44255556d720f405bdbc1c6f1cd109cf7ceca3

SHA256
58fd0f12daa203639862ff0baec35d56a3d98caed80f4d95fa60164a287424ea

SHA512
5182c3d25569b88a31d59f0553f9e9153a685d9a557243b685834ad21b0ee392cb0b99c11f1bfeb51bc37bd589c085524b0eaa0b4593f9dc06eb93afa572d415

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
751d167dc7be90858f1c9ca17667bad1

SHA1
308a1513cb264752868e05801a73a0fddb3f6e81

SHA256
a1eb7e3d2f86d628d074c349343afa6cb2c5985d12f6727be2f3f7a2a05f5d98

SHA512
afc9f1e55eb61ad6c16f9d5d81746e3280bf065248b7b9274f9f25e2ab546b9e28601fb16015f822cf671a00b4d9939a4ab702f2fd7544b4f4cf278205dc36c0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
49925517ab3112bfd2d1adbeff66cafb

SHA1
386372f769a05350422702a4305e416f53f9492d

SHA256
bf1d38017e80e23c8336084850db9a2ec2c191a48a0621e8d353e4b52bdcbd2e

SHA512
4d36698f5b8db72291ed212524f5afae6976c101dbb94ee7bbb79d98c339d59d2e0a7e2705c29ab6046d3f510b7a39da6f866f7a55facc08a3846ffeaa68cf30

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
095a04e34b8cc57a6a4ce911ec2ca03c

SHA1
bab2b32c47397d97db7358749d4d03a25a23314b

SHA256
6522e04a25197e2aab48528ad127c3a82749e3e1b0d0e469e8ff709c331a3058

SHA512
c9122e9ff9ccee5b9838d72e186539dd80a6ea29ca5f86b53e9361d8e32823ae964c665215637a844fe211a91315f829000532120a3a4ffeedd60a51cb39d9dd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
fb2841c5676c91fa2f443a801c5828b1

SHA1
70f58e580cd1756797d89115c8951b147733316d

SHA256
7888df73fb6ff32795a2b633847712f3f6047e5f7cf16bdf83d715a6a70fed06

SHA512
3890d45da85fa6f52f99471bd301920d8046cf65b57ce859a236f2f010867b61171fa1281fa79e107ad6bd1c0c221584a86ccc7ea3c2a5bfa85453862f8f98ea

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
587596e34b52537d740782ffd8ccb9ef

SHA1
b97828fe88a19f6deda07b60208afddee0c24756

SHA256
89f955e64c4158ba7f2404b63ba0e85bbd5299e7834ecfe41c089274f143c953

SHA512
6c345fadeac4f94c6ff49de5bd46ff27d52e246fd4f16d9cb95ac0c77dde5c16d922ecf6f4ee8b1ac24a6f5c4364768792fcbc802a3744e49b737c8af96b44a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
2205637f406f49f0e657b1fac481178c

SHA1
3765c4d03c38c3a067f4fca68ada121223d3b541

SHA256
1a40f7a7d9a4b3b7b8cd8df43337899a0b3cb2ca6300b396b2c54883aa7ea5fd

SHA512
2c0ca933e14842281f67d61c4f335280c135fc002ea707f6d93ccf74d9aa508444d681786ba6eb476b7e4fd7c994164fe7eb5c168adbee7ad418a270c8800c7a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b233865a377837b077210928290f3b61

SHA1
b7fd24ed15e0b0e30d050d58ec0d3caea4fe1458

SHA256
a9b58a65ba2ace8bc6d155d87d2547b554f81362321723c2de7add7ae2932966

SHA512
08a61a5db4aa84a52874124025fd194a95b436fdab2637d23ddc1453d58f20f05afe5dd54e2baf82b7980f84c75ba999f3c351f628ca097604e12b3577d0f221

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
906KB

MD5
a15ff0c716a843450b42b8f28d432c1f

SHA1
ed0de660d049d9b419b7f8bd6fc0f7a8140c2c5d

SHA256
90d646054942eb8746c9762b7490d18b971d7e2478a64930ec14f4a86eb1de79

SHA512
27e75d7d7b62a4da875fb3b8c30c73f3c86fc1a19543a2c32bd9c1b47a0d17549e751ff1d1c647b7f2c2d7ab31a3ea2ee2af83edf372ad976a1bf46a906c886f

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-877519540-908060166-1852957295-1000\desktop.ini.exe

Filesize
908KB

MD5
132766035b2cdf440f51619e440703a1

SHA1
d3281c211155e2d048d2de18a5103345affa0f3a

SHA256
d4492096164625de6f6518cf270fc604bdaa406a8eb22f656361c9698d33919d

SHA512
04f87866bd655c7c129cdb2bf99cd8e85438847a4b314210c46e46982268e175bbe81885afd3c0fc4d9d77f18fd8cad1f99867196161ba94aa8cc0c969122a6c

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
907KB

MD5
1f034a17091b7512212a6d875967f38c

SHA1
aeb5dd8c9a0fc2d938469a463c7e67ea8a89fa09

SHA256
9b96179fdb2583c44dc0039d92e321ab3a44307ea045b7a98e3c245c0b2691c9

SHA512
90cc130115eb72cc37e3ac94d127af46e159f42424bc1117524962ea0014e89838c0dfa35e4098308d7964f76b9494990c4af4ef9861db5f259cb32f58552526

Download Submit
memory/1808-92-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-148-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-113-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-1-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/1808-104-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-119-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-175-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-165-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-0-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-50-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-130-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-56-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/1808-82-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-153-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-139-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-61-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/1808-72-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-63-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-83-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-105-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-149-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-140-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-73-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-131-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-157-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-51-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-62-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-93-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-166-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-7-0x00000000020E0000-0x00000000020E1000-memory.dmp

Filesize
4KB

Download
memory/4476-6-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-120-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-176-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download
memory/4476-114-0x0000000000400000-0x0000000000477000-memory.dmp

Filesize
476KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads