74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e

General

Target

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
Size

1.1MB
MD5

56e31b6e96239c162131733f6118c8e2
SHA1

9fd012f3120dffcfecf22f01bc01cdd73fbe0b05
SHA256

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e
SHA512

b367d8a0ede24061b46433fa81a49f4a4a97806d1baa261476566916ad87137529c6830716cf83643f22715e1c73f9cdbe3a2b99eb9e9a633c0a34783f50f938
SSDEEP

24576:dMMpXS0hN0V0HiS3WSrD5PDZb7oWo0KB/Ay+aZK:Gwi0L0qX3drD5PtnoPB/t+aZK

Score

10^/10

aspackv2 persistence ransomware

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

Processes:

HelpMe.exeÿØÿà

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	ÿØÿà

Detects executables packed with ASPack 3 IoCs

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	INDICATOR_EXE_Packed_ASPack
\Users\Admin\AppData\Local\Temp\ÿØÿà	INDICATOR_EXE_Packed_ASPack
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.exe	INDICATOR_EXE_Packed_ASPack

Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

ASPack v2.12-2.42 3 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

Processes:

resource	yara_rule
\Windows\SysWOW64\HelpMe.exe	aspack_v212_v242
\Users\Admin\AppData\Local\Temp\ÿØÿà	aspack_v212_v242
C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.exe	aspack_v212_v242

Drops startup file 3 IoCs

Processes:

HelpMe.exeÿØÿà

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	ÿØÿà
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

Processes:

HelpMe.exeÿØÿà

pid process

2840 HelpMe.exe
3016 ÿØÿà

pid	process
2840	HelpMe.exe
3016	ÿØÿà

Loads dropped DLL 33 IoCs

Processes:

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exeHelpMe.exe

pid	process
1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe
2840	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

HelpMe.exeÿØÿà

description	ioc	process
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\H:	ÿØÿà
File opened (read-only)	\??\K:	ÿØÿà
File opened (read-only)	\??\M:	ÿØÿà
File opened (read-only)	\??\N:	ÿØÿà
File opened (read-only)	\??\O:	ÿØÿà
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	ÿØÿà
File opened (read-only)	\??\W:	ÿØÿà
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\X:	ÿØÿà
File opened (read-only)	\??\G:	ÿØÿà
File opened (read-only)	\??\Q:	ÿØÿà
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Y:	ÿØÿà
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\B:	ÿØÿà
File opened (read-only)	\??\L:	ÿØÿà
File opened (read-only)	\??\R:	ÿØÿà
File opened (read-only)	\??\Z:	ÿØÿà
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\I:	ÿØÿà
File opened (read-only)	\??\P:	ÿØÿà
File opened (read-only)	\??\T:	ÿØÿà
File opened (read-only)	\??\V:	ÿØÿà
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\E:	ÿØÿà
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\A:	ÿØÿà
File opened (read-only)	\??\J:	ÿØÿà
File opened (read-only)	\??\U:	ÿØÿà
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

Processes:

HelpMe.exeÿØÿà

description	ioc	process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	C:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	ÿØÿà

Drops file in System32 directory 5 IoCs

Processes:

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exeHelpMe.exeÿØÿà

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\HelpMe.exe	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
File created	C:\Windows\SysWOW64\notepad.exe.exe	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	ÿØÿà

Drops file in Program Files directory 1 IoCs

Processes:

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe

description	ioc	process
File created	C:\Program Files (x86)\Internet Explorer\iexplore.exe.exe	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 1 IoCs

Processes:

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe

pid process

1084 74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe

description	pid	process	target process
PID 1084 wrote to memory of 2840	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	HelpMe.exe
PID 1084 wrote to memory of 2840	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	HelpMe.exe
PID 1084 wrote to memory of 2840	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	HelpMe.exe
PID 1084 wrote to memory of 2840	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	HelpMe.exe
PID 1084 wrote to memory of 3016	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	ÿØÿà
PID 1084 wrote to memory of 3016	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	ÿØÿà
PID 1084 wrote to memory of 3016	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	ÿØÿà
PID 1084 wrote to memory of 3016	1084	74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe	ÿØÿà

C:\Users\Admin\AppData\Local\Temp\74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe
"C:\Users\Admin\AppData\Local\Temp\74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\system32\HelpMe.exe
2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:2840

C:\Users\Admin\AppData\Local\Temp\ÿØÿà
C:\Users\Admin\AppData\Local\Temp\\ÿØÿà
2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:3016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

1

T1091

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Peripheral Device Discovery

Query Registry

System Information Discovery

2

T1082

Lateral Movement

Replication Through Removable Media

1

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-3691908287-3775019229-3534252667-1000\desktop.ini.exe

Filesize
487KB

MD5
df9203cec45aebe04ce4a7e8d265301a

SHA1
1c9a08596b5271b5cc4cc8957663ca1e1573175e

SHA256
cc61207b7a3d651bbed6a67875b6a68b23748737d593e1cfab22b3186a39e38f

SHA512
1444ece36e7b61f77cf3efaf87e04b411d3e30d42922e9be0a1bfce512da40574cc4a05402d7afaa5ab3e11172ab320e2bf8c5921eb0a36abab670835c31e710

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
954B

MD5
4b5c794d9a040e2c8434349d468d7884

SHA1
d471a89286090eb9abf90da5fc5fd89453e17c3d

SHA256
99d240b3f2676404ba323f291799f16a2b4eaeea7d8a32016f17930829823dae

SHA512
1e9849a62fe74f0702ee73ab76a2191875ae877d2fc87572b7e74152a7ebb412f705ee9bfc7877fa6310be427ecb830545176706b2bb5d24d44152330f371fce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
999B

MD5
69c02e4604618450fad6c354d0021437

SHA1
5388fac6474e23c6444e443b6ab8f65ffec94d17

SHA256
9205b5283ef912fa817e1d6fb5a481facb7f02227ff8c520a517f0598e4a4e5a

SHA512
fa3a9f9fbf488bc9a7d237b7cb017a567d463c4e9950e5adde7dbd240c8a669ecd4dc5ecaa0c6639f0ac4b58487b325330c78d3fbf003c300b209362bc13ada0

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
\Users\Admin\AppData\Local\Temp\ÿØÿà

Filesize
1.1MB

MD5
56e31b6e96239c162131733f6118c8e2

SHA1
9fd012f3120dffcfecf22f01bc01cdd73fbe0b05

SHA256
74bcb753f4da68f4147e2d78753f0b229787a62b8c998c9d3c893599413f5c4e

SHA512
b367d8a0ede24061b46433fa81a49f4a4a97806d1baa261476566916ad87137529c6830716cf83643f22715e1c73f9cdbe3a2b99eb9e9a633c0a34783f50f938

Download Submit
\Windows\SysWOW64\HelpMe.exe

Filesize
487KB

MD5
e401078843c0e44f6d62897de167443d

SHA1
73a19bbfa828c62620e197d04290cd1de3b122a7

SHA256
0cecae5642c02c65d95c14a98a338450b1a5f5d71bcb0ffb96fe6bfb1eb5b0b9

SHA512
fa4c63d23122a3c4ab847b5f7f16b905c0e745ee046521737ff9dff5d5a1076f6317097035a516dfb23ef614b5504160b3628671c3982f92b77e12de6c78e117

Download Submit
memory/1084-0-0x0000000000220000-0x0000000000221000-memory.dmp

Filesize
4KB

Download
memory/2840-10-0x00000000003A0000-0x00000000003A1000-memory.dmp

Filesize
4KB

Download
memory/3016-20-0x0000000000230000-0x0000000000231000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads