30ec0a2627483513522c778e824dbc92801b74e01376cc78b56a3df0705347d7

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
Size 802KB
Sample240614-mnj3vsxamf
SHA256 30ec0a2627483513522c778e824dbc92801b74e01376cc78b56a3df0705347d7
MD5 a939990e53457e2ef115dab976c792a4
SHA1 c3eb7bed8547f5b48c0f2e16ea36e7818b18023e
SHA512 13beb2e10291a79798c72c73eeab00636653298d5512520c41e8e3b36c464902b4628df83204fb1b0a93e66c9c991862b10063f602d88d369bcb9ec66f1c9fe8
SSDEEP 24576:ZMMpXS0hN0V0HUSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NN:Kwi0L0qJN6
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0009000000023546-3.dat	aspack_v212_v242
behavioral2/files/0x000e0000000232f6-33.dat	aspack_v212_v242
behavioral2/files/0x000100000000002c-15.dat	aspack_v212_v242
behavioral2/files/0x000100000000002a-41.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
3916	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\W:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\Z:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\K:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\L:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\P:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\X:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\B:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\H:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\T:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\V:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\M:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\O:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\R:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\N:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\S:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\U:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Y:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\A:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\I:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\J:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\E:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\G:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened (read-only)	\??\Q:	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 3916	1012	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe	90
PID 1012 wrote to memory of 3916	1012	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe	90
PID 1012 wrote to memory of 3916	1012	a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe	90

C:\Users\Admin\AppData\Local\Temp\a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\a939990e53457e2ef115dab976c792a4_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:3916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=4356,i,4686244434963378549,11462511444150484980,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe
Size 803KB
SHA256 ef1f9a271aff7a172bd5da08c1eebff74cfdc8947e6743f713844b44c00faece
MD5 bb2688b33d162ba7aacd9bfaa2c69f7d
SHA1 934c66cc4cd67364cd67033e821fab96e0a6af37
SHA512 b508dd2253c5dd906d959d0d5a9fed0bdc51907ef936c6ba927f49b545823687b90192b182def2999903bb5a6ed5bdc6f8d2bbf4651852e57cd92caa3c0618b3
SSDEEP 24576:ZMMpXS0hN0V0HUSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NY:Kwi0L0qJNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d44015a4fadb2549019c54dbfec0e1f5022fbd0f4ed6dd6fb49bdeae40b28d47
MD5 d51e8d64eb633523ef7d2259b36bafec
SHA1 4acba2d05926b22434aa7efb09cda4c820bd4678
SHA512 2f79f3441225128420291d19c8646b179ecb440d35057ec70595dd3bf5fc0f2fa878c103671c8fc68aee1fc17f199045a972682c8590e3741c185a2b1605883b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 78410e95dcf6f16c749151836a7e4b001a2ea0706c48bbe0872979ee6049cbfa
MD5 61a903eabb9fc9516227be98ae2e0453
SHA1 262ccbbc19cb6e6c8360ee181865d5bcbdc78210
SHA512 949d8bf58ffc58f33482387169bebd97e552441338a4b786eac17c8a31141e56e8b35189b719765afdd9715af7f5cabc1e36f1bc71ba23d39f3f4193ad576b51
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 68e2ccd7f954eea3dddd800ba9cfa0b57ff5876fd80e7aa9b5ce58ef298a627e
MD5 2f4345da239370c4a1ec31489e189349
SHA1 359cbf7aafeb71ef74b28b7054d2ecc6a8229c0c
SHA512 66ffec4be3a7940cee462c07a7035b2fe1df0c3bc33ecb9ddabc603fbb58d4844f207c3cc6d54f5c7f14988ef41448db9f2eef158115b219c8100a137efcc548
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 39eaa280966bb270726bb78ddf246e2ad974f6e32a39c6c08202455f10d8fcad
MD5 7ceccce73761c80a734f89bf2695816b
SHA1 c7bb90a030e60c830fa15d70c427a02479b18400
SHA512 26bf81f02b8e7b7387af1f4fec87af1a14e54d295c5fa2005bdf0404fc7059da58e7a327e7904a25b1e9b796fa851c14f8d11b83b09010d7b96f1121d769f43a
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ca5f0a0d986bbae3235a383a5276a0e524e4896e22b30869c655d4e93ecc0420
MD5 16444b69442354bb583012ce9f01b86f
SHA1 893576106f43cf9d5455451206857e6995e1ccf7
SHA512 db5bf2c1fcd34b0727c4720f8023e841cf028a31c0ab807adbfe9cf1cd7f74468d7200c0fc10d9dd90bf60618253094d317d1290cf493d142f4424e09a182d03
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 69151b28d4118950821ef750f2bb5692234103aaa4cd5d1d462625edcb41a615
MD5 1c0346d9fffc2a6f3f2bec3a58603795
SHA1 3cc9cd6cdd56006adea124a470c12af7678990a4
SHA512 bb9698905cd3975deb322eb38d85076a0a7f704bdc2e10ef7662c8d2d8aa41d4ecd597e0ce83f2038c5d543bc00b22439f51d0435539fa8f6ba975c73e560ac4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 abebdce730bfc8bf42f9a194b0584bb67b9075af6ff4feb3a41586ef3065fab6
MD5 5243e26f6d23b342cd688ceea3047c8d
SHA1 7d35ca4caeac9431b90db829957953a2295016f0
SHA512 dbaf4815efeb6503e82501b17ab4c0bbbd3a75fc062a1f9f8a8b8a0f2289a690f7f74f718592f599a13321116afe913aae5af7ec3d66370d85c7e3e826080ce8
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b73768b10975d46d9f55dee46bf9731ddebadf3629c9f15528507651f909de99
MD5 56dfa8b04fde6925f45e243a90055b06
SHA1 c1e4818f1def0e6f34f674b8926048f36d032f8a
SHA512 2f487675cb276ef961f20b1c64f7ebf85906b6ad8b864b20806105cd8237bdb92ee8f22f0ff78e9061340d729d96255f77354af89675d9b20d13284e92ba8702
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 60bc03d69647c1279da23eb27884fc8c09666af5756890e573dce37ff86093b6
MD5 c5503a3b91b83751b26231b0ef74bb17
SHA1 982bbf751e57a04481632492d9890604749127a1
SHA512 392211f00faa0c1b50e7cc8b3cb1a0afc970e28b30085a248a40aa5ccf85f02149ffd2da85dbd082c4580f2696adeb8c28f1a886b2d758382dc7a7e118306c13
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9102db1cab9fad1a010ededca365b51ed694611a846620fd91edf71814127631
MD5 67abcf9be77a4c96561ccc28e3052d17
SHA1 a62d30a008af6176178c8f2a261c69db675d9291
SHA512 92f16cdc76b479426f888ac5fa402e4ba19fa5acc51c10670d56f878603f165373d08ad120c34d923c54b7b78a3e3e7a25ac68cf9cbd36215e76af1029559cd6
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 a2f955d7a9b777b07df66a5a48fe077a8ad12348b8e92df25184e045c6983b4f
MD5 0c673c52b3800d7e92bc4d4fe8d1f7f7
SHA1 6c6eb1cea57c9c714dbdfd8d73f99003226e437e
SHA512 1f02ba64aaf913b629675455ebe5890697350a3280d3c35acc7ae9913debbfac337949e69b7aaa8969098abd4a2d2f49c75448be81d3fc7e803563b56e1b743e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8c3f74b28db235a15e90a0aa2aafdbaa33f1a16d587102ac5037684a2cd6cf4a
MD5 59daf5d67c78cbd73ad00b446a0dcb50
SHA1 b2ef4581f04b3eaeb8e05aa8ce800d758ab0be3f
SHA512 63393e65c0eb8c7d97acbbe6c23239353944294462054aa48f7c6776a98c498f84ad3bdb8969787567da5af301ac5c5923788185197174209355192dba417b5d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ad9e7ac53a66445acafadaae761fd48bdf2634883fdba8b96db3662b63ff96cc
MD5 0d6da09979ff752ceec8deb0e849ba61
SHA1 48c65621489b008286b76224c198b4de7943e96a
SHA512 1d4f5116c0aaf67a013175c9c90e5232be7023cba749f3575ef3ef69a289e95545a71db8010e6633ae7cfcb78f9a545efe87e79d6ed95f5a8379414c1c19b823
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e0d459a89c260c2ce4be22fe2eeb9de0af1922ad393080e38d2e7b806e68b9f1
MD5 6b8f33cbba89d218de2743667a1884c3
SHA1 bf749454967c819b63a5185056227617bdc77746
SHA512 3a216390b9136b980c53e3a481b7abe82dac9e62d2f5cd1dae0b4950e7f3263ca352282fe3126b1ae120b3327d13228deae52291fd5b72511e9baeb2d12a54ab
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f7e9ae170b99e9acb7561ea5372aa76e74b09ceb81f43e0ebaf1ba33594b0673
MD5 f958e12e192a5e34a05cf0dd70635446
SHA1 aa8bc7ce4fb9825c0a5fb8c019de086bca980103
SHA512 26476f89018c283ca07003135b5c38e802d1c21db5185790a75727ac53bb80e2ea1ca36f4a18b3f115ba0d1f32c2319793f95c1ab34438501a5a9751fabe0546
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 4c27f53ac46ecba8938a4e620d18dcdb02717cc7716b98a0fbecd650ea9d0f18
MD5 6f343a44b849351abee32fa046de5dca
SHA1 915dcaee7125e5cf70b58323c75474d3de70915d
SHA512 1c95eb943657f9fc6ea2d4237c7c655809d10c973ff678d7b6710dd3a139a581204154719e7d298da010e249434ccb6cbd8e90991aedc4efd0d409682870f4b3
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d845608b9325e7ab4d25a55f134cd90e8bc7c547dfa85006a9130bf8e53f05bd
MD5 dabced65fd0588c079cf5a47ba754620
SHA1 a00952b38c3ad65b0f9b96b3dd31217c6a59fc33
SHA512 a819b20219ce33078427c31658a836d56a82f50606cadc28cd4378e2bbda6fdc3b00ac80c981d9fef57b87fd93d092debea79900849720c53402ac8130a47487
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f87c653d962ce6d41a8633ba7040f1105c0be57a0839181a7855a3f48344ca1b
MD5 6d61abe2a17de69cefb2500ec81cc308
SHA1 336acfc99e6deb673f28a0a5bf558401dbb680fb
SHA512 53b9aa9e9bd412c4009bb87cb1dde3828bbe0e094248a1c84837c786d4fe5cb7ff0a19c904e6b1fe47110f535d6ed67c84a5214dc7622a5a0728b206c9857637
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 961cb4cba81157e0cbb5805907d8dfad19e1ff1cf74f5442d04d0a8d099ae30a
MD5 6c39247c6f3821dd05125436080544c8
SHA1 bf267f5f7dd2bc5d3fead0560662929eea2c2745
SHA512 4411fee8d6c1d7d46733edf0d74f7ea95844377d3cccec42aa4f286d70a78b711783f50464604180218e95d772ab7732caf41807efb102c5b7d856b219d4441b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 dfa5be066012307621153ebd7422b6f13c07ac07c22bbffd813741cfea4ca499
MD5 acc5eb0e8273afe20a2d16aaee19d843
SHA1 65f8746368d4badcdb7eff93bdae5ddcc286b4f8
SHA512 f54055712bdd2fcfd81ba2946316be8cacefe0b693ae17c5240b5a5133e9524888cb3ba753c860caf3592db71aaee28dfc8696b0b224b4697506de8faf9e1b37
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2ed91d7febefff303b4941d9bd49e51e37219fa4871fa339004349717beeb836
MD5 a622eb1b5fec76ef957e3bd52743459a
SHA1 d5f530767b51ad29ae77cc0841254dd00c7879ab
SHA512 8d90c1f963abc333c0f8a9854ca4988a7352157927b45c772527a8ba9637d4f3a6a06c7c118419f1d17c9b6e83149d7abc7464d96bf04be83043c9bb31557170
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f9d5b6fdaebfe52f1b24cae296c32bf4dd303c193dd5bfbfaf091918cd37f444
MD5 86656e865b836c66550f10f6b9a4ddae
SHA1 7744f29fa1dc2c758cee2f4e4ce6b43b615cce2c
SHA512 370afe339915c66a035432ca6148d2092918120f2aa9b2a4fe7a38a439616f5ac16070972bb827c68894a0fe257ab0d4197337d6f81a3957cf52442923ce7381
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1545f4b4082c637e935a20334b8cf15b8901966d29f12808a414961abfbdaa29
MD5 335bb0b454a033bdd362ec2955465b7c
SHA1 4409282ea93127d203a6422c6b0505e1826939a1
SHA512 964c7e0baad8a73f24e965fcf75a2161320690a7b5febefa8ad8391cdd69845b8e1b7652dc31d029465e9d99c442a7c77dddcadf3ed372601b6d79abda6f17f5
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 063c12120ebb092614c95335620df7f01f05aefeb47005b75dd38767cbc41085
MD5 334d452950fa0188085786efc7eae9b0
SHA1 00bd71d870390a77baa476b8dd46056e3873c513
SHA512 5965008ec2fe4ecf0d5a2ec1b1d30298bc5c7aaa38848e48dabb5ab18a8f238b6d1d761b09771b1ea964b7cde056ec2db8fcc8627ca96dececfdcdb1480160d4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 bb874f97b120d864385af855274f1ffbb71a47bc90dbe6ce92f20d808c85ee36
MD5 2849586fb33a5be5db93cb72fbcfe9ec
SHA1 0b4db3b768141a904bcad5cf70cb8f2a7a9138c9
SHA512 7261c3a0c020ee92dd24c193447779ee3cb253fb2f8b6bac060d854968fdc14055d413e8afb8870c0307f384f411bbf6cd2c53f0afcd05663f75cf94887d9121
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 e07c5fbea2d810745be9d3aac3aca5358c03304885e90a3bbbd3b485adddba07
MD5 83b9b3c74116eb8236e74435e0df51bb
SHA1 f22334572a2aa864de489ef3991f5017c51b17bb
SHA512 32f62a8416c36bdf4b3678857a467bcea8658e7f07b4cd30f838d8c2de7f2e99d9d582eb866476584356b128eed5eb50f5e837d1808c245861a9e70f56675185
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 07620eba1352e153a061c452523ec56977948e427c40018ec880d69433728afa
MD5 f101cda8339fbf523659fc0f8ae07bdf
SHA1 4d852740811371b5868d12297faa62c1e5f63063
SHA512 a6b767b0e82299a2e931aae0c0f6c4943d68cbc40acc02cc75bb3edf31808e3ec762ee09c2f819a25db5bb491efbe7cd2463c18c64afcdc3d952b5459a123790
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 5c2b6b30f2c1974d06aafa924e5238255b674acd6d3d1854f944241fd71fb2c3
MD5 fe004fdd891917ac9adede67c83f75c1
SHA1 cbca150f9bdd73b2f703abd945046b2044895fa9
SHA512 ce8b4c1a114489b452e3711b11228b8eeb4e0a2c37e4eeb291fdd2dc6e2ab2fc8f9a05b48711d842a7e40f1f89f5b1c56fe0417e3e39031a15d352b4e300b195
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 593e5b60130b0d404a18ed99aee55d139246afd6f845c9f4ddac55c776d3db12
MD5 d2763de949909b776988da2e1a36c904
SHA1 fab6af0eea8c6cb4b12b5957ba30fcffc3a60d3c
SHA512 92df017f508c107410a79055c93d21072605012cf63cf097b818cd4dfd2decdd7bc69060a79a1641c67da741bfeae0a0c92034ea938bd286a3737c0124ae71d7
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c58b73163de58f7232f050f58e8cbdf892d4f72651caf0ffe2aafcbc680ddc72
MD5 ed136baae0497e5ae22c9dc39d940e67
SHA1 e848a2465250f19f625248afd3eebc9361026e6c
SHA512 28931335a757ba15b3ff6252c714b02c1a552a1b45f2f925ed0d67d7e9b381edab905424496497f2c10fa571a5d7973d4496cc24c1448b1cd9fab35435622c8b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f334c083edb5fcd536bca1412f9d7e28dcd8168ff8e70fffda43588e5a86288b
MD5 54616c8c1d0e87b4900a1bc786de00bc
SHA1 6d858c84467e598b721493761bb795dbca295f53
SHA512 547f4d19046b643cdd3d092d64ea9f8c142fcc1bf7117c616d232d4a0bfe023a2d0ddf0ed353f0a34c9ea9e08e73a021e856411392276f8942548e2aa9c705aa
MD5 SHA1 SHA512

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 610KB
SHA256 d95eb04f5480edde2664ef0e81dc51890cdd7340a5cb66e4c088ea56546019e7
MD5 ac5065437174d7c9865aca9fc2977d01
SHA1 1c06963a0aa5bfbbc4bb75928656330a9ea9ba04
SHA512 f7d4be3dcfbb02163604cb7aa79c6216afb9e4247c8f5fa6879fed810d1c7ffeff8878654afd71bbaf393c9eb90c89c8578b97338de37fd8b384a81b40491a43
SSDEEP 12288:ZMMpXKb0hNGh1kG0HWnAgU866w0B2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlB:ZMMpXS0hN0V0HUSGB2uJ2s4otqFCJrWo
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-1181767204-2009306918-3718769404-1000\desktop.ini.exe
Size 803KB
SHA256 cfd8d860bd09ea1122a43ac5a1a23f0b297e26cbbaeaa875a6bd50709534a908
MD5 8fcc0ee7ec30cb634657d2b5b97d5fc3
SHA1 4be0eec105852d3563dd91fac64c23ae37cacff6
SHA512 6e9d83e903371887d088804176c3d7e809ac9881753fd70fc30b008db02de22b090d772d4c56c019f56221a1058f0654d6ea5446f27001509381c1079f147236
SSDEEP 24576:ZMMpXS0hN0V0HUSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0Nc:Kwi0L0qJNl
MD5 SHA1 SHA512 SSDEEP

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
MD5 SHA1 SHA512

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 802KB
SHA256 30ec0a2627483513522c778e824dbc92801b74e01376cc78b56a3df0705347d7
MD5 a939990e53457e2ef115dab976c792a4
SHA1 c3eb7bed8547f5b48c0f2e16ea36e7818b18023e
SHA512 13beb2e10291a79798c72c73eeab00636653298d5512520c41e8e3b36c464902b4628df83204fb1b0a93e66c9c991862b10063f602d88d369bcb9ec66f1c9fe8
SSDEEP 24576:ZMMpXS0hN0V0HUSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NN:Kwi0L0qJN6
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1012-76-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-126-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-108-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-116-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-61-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/1012-89-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-169-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-100-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-70-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-134-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-161-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-151-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/1012-0-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/1012-142-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-127-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-143-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-77-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-90-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-152-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-50-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-71-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-135-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-162-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-5-0x00000000021C0000-0x00000000021C1000-memory.dmp

Download

memory/3916-60-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-109-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-170-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-101-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/3916-117-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads