5ec1fc4422be18f26596289d05af3eea7c91ac87e767229de02186ff46ec07c5

Analysis

max time kernel
145s
max time network
94s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 16:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
Size 1018KB
Sample240616-th713atekl
SHA256 5ec1fc4422be18f26596289d05af3eea7c91ac87e767229de02186ff46ec07c5
MD5 b46020d229d7561afdcc0af900f66679
SHA1 3c82ea43afb56366c30ec4690989c30ab95e32fc
SHA512 96ac5c4ba13635517553539c92e3b23f6301fa9a2e162101c78f02b53f9089f3590c57a130d9279616e467ff2ef037a5d30ecf620f9f58be093610f24fa5f9af
SSDEEP 24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvJ:oEs1hL
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
2356	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\E:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\K:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\L:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\P:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\T:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\X:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\A:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\N:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\Y:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\B:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\I:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\M:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\U:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\S:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\V:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\Q:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\Z:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\G:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\H:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\J:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\R:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\W:	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 2356	4256	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe	81
PID 4256 wrote to memory of 2356	4256	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe	81
PID 4256 wrote to memory of 2356	4256	b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b46020d229d7561afdcc0af900f66679_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:2356

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.exe
Size 1019KB
SHA256 4db4072061247e743af82de0f5768c0887fe0f9da9fbd7fb426ece85081c0929
MD5 a78612764b095743ba44437d2e26e4d1
SHA1 7b0bf5c5235c06e9e96693cc7ad01a30d20d3a77
SHA512 c20cd9cca2b13ea19ab548e946c6787668cfaed28523b5d668a7fd35d8bb76a7b956df01349dd52d3a6ca48080429ee0059640a3bd59e193c4764289eadc53e8
SSDEEP 24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvq:oEs1hw
MD5 SHA1 SHA512 SSDEEP

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 064804ab36b72cb1a153de338fedfc6d948e39e90f5a4a634339399468241350
MD5 fdcb966a7fa8aaa06bae8b52e1a615fe
SHA1 035bfea94e4de536adc9dbc952149d5590b95428
SHA512 7e1316ae9f6dd90a2c06c021ddb142059f89ed097557951214665c3064073aca8f0636b5bfaf444394db46827842b0df86bb06f18f2b785742605e25d7137345
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9ef89f81e7ecf2b1c171c8ee838ecff851c82da19545f60091a8f92b3cac16c6
MD5 e1a6f4b15c836dc765e117095e4e85e9
SHA1 c00ddc64211ac867a91113c2bad1c65df35f7de9
SHA512 6552a891beea3a28ff0570ae03c0fbffe268824911b649a0e4b374a8a10cb805030245f62cedf52c9c2bede29bb3d32737d369ddd637d72270357ee07da7a9f1
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e736409d67435d7b92ba3362623d23f1b5de2243a239e0aa6f0febdce1a53640
MD5 d5e45863b117ca8f286f4b73bb7dc5e2
SHA1 1677230e916e193612630074c8bb6095194d697e
SHA512 172ac13785ca1388dc842693d2db9aa01eccfabded0719848934a7249d61c1e3cc04541cdf2d6d2b4377c47a431cfad1159c81d50152889d2f1c6efa2eb90de1
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 84dfd6ccc47d9144bb271b7bac257362818b4d07d7b45ca48cc73cf21c018f55
MD5 012a6994bba68075909523600c75b46c
SHA1 d58dfda506fff3bd5d012bceb06b7a97e0bc6292
SHA512 6e04e5dfbe5ca5290f8f58e33f4b09daa9e47822f669b218c0e19c448106db07a7c18ef03f3a51c889e170c8510d0a6d60e736159f174eae0d1c8727c25a9a00
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4846bbd66ee398f948209c65a00808dc283ec3f2716a59f58a8600385fe747e8
MD5 b0c802e108eb26f48cf76f126acee41c
SHA1 81383297f41a8afb33a6992febbce3c291a2636c
SHA512 491bd9835c24ac6ec81a66a751588811d712346a8e18a5f5378ea73f9d06e985394aa7adadaeef4cf98d79955bd7a7f60a3acfa0da3b657d956277eda80a2276
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e693d1f68a603e3aa0bafcd0c4cabec7dea40244e443465421d3a3b1cae695ad
MD5 9c78f4d1cdde8a46d38bc8167ac8e2e9
SHA1 c4287a6c33a47f33782dfe7271212847b421ed0d
SHA512 1d5659645eb090d2ca3dabcc3d63e36bbe1c9af16762c46a5c46d23bb33a075c5eaa7b0d600c03f53a11ff353c547711e287c9d08df3be59bf8830b331ba734d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 05dae7dafdb75ee472d2a3e0d6ed1771fff2d4e2736478a49d8d99ff5899b384
MD5 ed83e98b9dfbbb02f7ab3aa38809f582
SHA1 5fb11eaa55aa7ec11c681ce10b988d2f4cdf0429
SHA512 b4ae5755b09b3aac50ce49c9ece3415ffcbc4bcecf9d594c6090ac70df959ebb706e34a76c486281feafe1b62265801f2ede1ce4a34f380d6583633f4be02cfd
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b5f0939aba78b1ba716bcdb6aa9b4a983488bb450d3046d905216b4c77f0272b
MD5 87cd77df6fb6bf2e34e55059b0b69b76
SHA1 4c249dbeca71b774565f3a5a13e0a6f617c472a2
SHA512 e8f74d4e2c59e5854dc39fa67a0b17618545954c08b3423a56842f7be456f809e2caea4747a874b8be57e394e10aa7f8039aaa43ed4586620baa68f09f5abcd4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b3b95fea9eddefe49b4cdaca450eaa8165502a81ea9f2326658690ebd4ffa277
MD5 1614ce1a54a97916180bdc663c4c2340
SHA1 8d149505b59d8f7c70e1b18e61a44eb8717848e1
SHA512 ea5bcd6dc779a65aaab001d1c11de454645ebde5ccce282e726979b35ac85e043af223dc138f82043b97511649b75711b0797e89a72c7e6e18965fe6c70e7831
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c2f76f3e4b9d71063ee8db62d3c7f6f6a2894fc2d39470951ca48520167f3e79
MD5 d1f5cc88ea3aafd2632e36765f5184e6
SHA1 9586b1150a17748d13ef6f691d63e2053d2fd56d
SHA512 68b9a7561294c0d04202fa254b1ec5423c6900ea45e1dafe3b5d4391361ed4a1b685521eabe6861ca8ca58fde9d87d86f44c32971897ab91ddec53b9f0e74c1f
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 adf8b73b4d2c7a6143bd333b325dcf3e8c38ad643b26147b19b168bbd6070fce
MD5 d14c11e09f6aef69921d6ca793fef261
SHA1 5f64adbf8f2fbabb05590097f596a063bf346971
SHA512 543d429d9db2b1ec6d7b64dcf790680c5eeda66fa3a44c3eb020dc286781814c87b030d51829186a2b7a23303b435f9c00416af7df55bb739be1bae210fe75ee
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 b64bfc9bfcc386b7c33ccdb894b489708af987f3ace3ad79322dad33f65f4228
MD5 e43decee219b05a451ac5c5aa759c916
SHA1 aad7f3b3ea465d4e64766675e39223f974e82206
SHA512 29c54e0519859e5d05004bdcd01f739f9d9bdda310919c55ea0da56aae233a4da9d532502cb315fd21e87675f41475992b67e5d34574cf99bc364c0aaa59db4d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 9aca3a12f67701c4356703bd3496093bec40786477a5ee65b1d341e7b8735bdf
MD5 4462f91a5f49c5bbf74a8736b56ebc9b
SHA1 d66bb412af7740850b9493dba84d0ea57436aa5f
SHA512 8f185afba6edd98be2b488ab37ad14c70b779648f6d516aae10d067f94406e7c3bae6740bd23ca86ff637617300bf2fc1b8050676e781b971b35d87bf683a05c
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f95ca2e1003ed8263781933831b6f5e2b36244ac2132a1135dff4deae7177965
MD5 0f19ae9cd6aa6e1a8036931ff697cc10
SHA1 6994ee5141292c452156e35f1975532e6f052ef8
SHA512 3e2c84827ede8d532da38be7a1e39ff3d687bea631278bd3e03eb922504f00eb4ff417538021bb45b7ed5405cd25f63b4da55bd0bbb21102ea55b1d22bd064cc
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8402799d9891e83a1ba47cfffa95b54354d5d338954fdae10dfeeecb17f185cc
MD5 3426ed5f74c62ab9adec13f6d93ab2c3
SHA1 5deb9fd860811811c04a963cc8b05bd29867a2f7
SHA512 069f3f69f866f4e69d698911f0432830d8361c3295f06ac720070ac0291fe3634eb688a51f699374f24a3f0df7e248963fb3a9fdf0b763476600d60f4f0f4079
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 7c92f38f13b5d85b3f41eab3d78ea5afb9e7be47b497000d55869b6d05b687e5
MD5 50a03103ba18d7e506a97d1ca26b6a21
SHA1 861324bf85a1fff84d7b9d664f2b6c2f61f11d02
SHA512 99973318404f31f52a601b01bee3a60d4f57b5620b5fb1dad1c60feb98761f3f8376e22f54d4430982792539b96b171b7f4795f3bd07fc9b8efeaa153329a619
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 e768ccffa12c0e3fd98473427b06c71ccdb4ccb143c0540216d152d7f4ef8d41
MD5 c12b83ec7ca652d16d1b507f61d31722
SHA1 5f7565159d91f6d504cb273558775d8c11f406b0
SHA512 bbe64e6357647c97fa9868d14d7dfd7fd62a4eda90381325f12aade6a5f910a8cd81b87e95d86870982e084044479ab6d023e815e377b531bed1c420dff1e858
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 04b3fc9fad541846d2cd08030dacc97605cb16e45e4c5b3cd3a40fc764e7d96e
MD5 91a621ded328bd9c13900b3a04d3ad06
SHA1 e02658b5e3a1ba53b26522f7f2ae024a7a4e6519
SHA512 7b03101e769f80ff7da6793e4aa71ed52011e86a81ad7b997562bc43ac5f8ce4efe5a306c3a0e229d76941346950896a4beafaf851c10f109cc0a279dd38bf90
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5c87a4f45fc29f775cd520f91e8925dfc6ffefbeab6495ed381a10bdd0c9967a
MD5 4103a99760c54631609231b090087c51
SHA1 786dfc1b701749f9cf556ccc4d4bbaf1221d7adb
SHA512 021460e630c278824c9dea4a606a7c03ad6298e2dd335defbcca0cd3806580ee17e8b4ea532fe96aef20b7dc758dc7bc09d7490b455451244ee144109b9ad3db
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 6cd1a4f91689c11610afad5f2f13e0c6b34e7b9535ae939c90e3080e927a7109
MD5 84a4953185ac8051583331febfd5ee0c
SHA1 a4efb0302b4fe03e4f17a3d90cab26d747563ee5
SHA512 ee6cf56371f929972fabfa62b16c21a87b986a14fc8664580f54a624dfedfc9c48f8b5262d535fe8897efeaf10b0f1ef451173d98db39f4e0a8dca6f94bd05f2
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 12020ef090f7d26e0b95ecae1d3dcd81b85ebc57c2e39c7b1fb34e1ddce4c1eb
MD5 87120592ded4e2771fc579b74891788b
SHA1 191a91af07af55515344e9b99090d6718099a5f1
SHA512 807d74dcf90426f634b4fe50e957f6c78c7ce23cb28b418aab9a2525b5dbc51a199c10dcb8438eade2e91be5a4316e70c51b587d5f39eed3856a808e54980fda
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 3aaec0b1371538742419b6beed4c7142f2c0be1e17bad43b1ab2f2f68a42e724
MD5 9f7c9d24187176386556680d1d52a73c
SHA1 08410a3368728a117385e6965e32083f9b61153a
SHA512 1acdba4d17a34895ffea2a4e53a017e72425fb3cddbe8890b67338efff64896b850b0a6614b960a7cc9a2aa6fe5d8fa1b24c061440c778fffad8c6065658dc04
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6097b9366f0bb7c0650f31f806da990fecbdbf31b43461465be72b8b266848e0
MD5 6cf0092ada9b4f8d8e203ba62c980446
SHA1 1d4be6a3904ac53638ae6341c2957e9666c6cbd1
SHA512 a9991a145191789ea930025a5b30b9fb08a3e7fa11d8392cd964f7aa964d5e8505f228f047fa831627e4d4cf9c87f1641c437848e59d5109d33feea2bf7a1dec
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 f9725eeb0f98efeb415d336292ec3c0ec8b2c7e0b578f070982059a6a2a8590a
MD5 6729762a0b2e31e0f5363b60de5c835a
SHA1 87da661628bfe83747f737fcb58a3aae2da95dd5
SHA512 43594700070ecd437b93fb0f59e03f62e0eede492c5b6a7f09cdb2f2bcc3faabb7f93592e74eb01b0dd0f8f50c6794529d1b4d9c132c320c3134f9ba3b4e9047
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5abb63ca0ad6b2be9a70f5373412038f6846b684b896a0995b20d115533cd7d4
MD5 6df9b5017d06950689aee2f165184cb8
SHA1 3d69c36cf4772a7b9600c00f37a0f1f2515e134c
SHA512 46d6908ca1009f871d4e9f9eed8e9785f8b5eaf8fb0f00bb3e9a75e292fcc5bf25781aa2f0165bef38d9e349f482c259f2733055151918650b05a0bda954016c
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 df6c628154ddd5ba83a675c933887e93e2da68ab864591b0a4408a8f28c05c2a
MD5 65538ecd857abf2cd2ad971fd482b821
SHA1 5dd6f8d9a38ed69d8901fe730b1116ebdc69d25b
SHA512 aed7c78a49ee0a83d72aaaba739c3af6c80c59bd87a3630d04b4597d156523485331fefc887205126a5cdf87ca7afe69c1264058637a2684fe970d9ee9570c84
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 20d12206764b4fd3764d108aefd1bf3c351edbad0ace7a333092d28ab2606e11
MD5 27e6975f463a6f9c60cd83ee6bc72550
SHA1 039ea1590cb83f547c84df59213d2d7634cfc013
SHA512 255ea806111eea918953714eaa53cc2d8e5b504712bcec37c55d27b1d17d5f9fb77ffab19daed9bd395e0d2ffd8e25cd9a5c13eef6d828b572efd6b9a2c11690
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1b37748b993cab6f0e777d76c5b2f4ed21de8a78203426da86d49e2b38def380
MD5 254560dac884e93187e942ee7bc6ce53
SHA1 679880f50ae0ac1ae9ea36c0afeedf540be1e0a3
SHA512 882560041337ed4fa0f3dfdaa583256714cbfa8800cc4eda7682a437dce79fbfca309d24b7cc784c9c1c330d10892e7a1a2b5b2b29b5209c9ebfe708b230e6a3
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 dc7090e13c3f4a4e6abcc93989d21e2ab2519b194cc73cafad5a8923e0c4ae9d
MD5 72620c53b5f1e53295d52845763f52ba
SHA1 c20cd38842b59489d64e8a3a5a2452848699ad01
SHA512 a08779bd3f9f8b14a8642b83ef36c7cb139280e0938e2d98d14776c7c5b60b7a37461bc1badbe85b5fef0c55c80e4fe56e5c853533cef3a28aa980209caa88f0
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 cc5a3314f5edc7ff2a8c66512982b8670648c5efdedec529d90b58ea67dcc081
MD5 03b5ed6ee1b90529389e20cd83aaa003
SHA1 1c9beb628e9c2943e3a65c1d5fd0f9eb73ecb133
SHA512 85f05e4f3242046b28c20531b66dc68854e631daca14fba3d2adf83439e52a146be97112db930c664ac8b1cf08df00f91c4771cd04a76fed68c7643def3e1eb2
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 5aee7e9373dbc04b68f2539fc42cb43bc0767f6bb0512844a86c7cd7f7722df4
MD5 cc28a7eb6572ffa3b976ed96d4d932a0
SHA1 39ffe0ccfd13d7b8d93de1e212828db0e2e9b04b
SHA512 bd75217adc1936207a4ff48a92cddea5fcdfc12656d703d6c170f3f922a1cd36f67d7077408a68a2880aa86d2ac829b0a9d24c125d2081c4019d72e64edbb174
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 314f945d365f2f2a23841652f239f2530872bd65fc0e4a67fd0e01cbbd266a8a
MD5 9244175fd4671e9f187cd6d025d863d2
SHA1 8161bc86755132915c650e750b16969ed0cb326c
SHA512 8a3db67ef21b50d09926d99ff6614f82378fabef879fe18a6438a3fd814bfaab58832ea0cdafd1acd307dc8ec4182f2c4923b0b9c63df12303fbda02cc4898c1
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 33b13298c944f2fdd60f9c888f06782639ddfdac0c4a55f844029b4e3ff13589
MD5 c13ea89499a07b3d28b3f9fa12994656
SHA1 927d681f9e256f8ae1e0250a4d06f2276b597aee
SHA512 a4b3f7a510593fbd71583340324965c3db5228ad0d42bbcec34fd8a27ce36729360084c686413490378f75cb79d695983a782e013e1b590086a7d53a771bdd93
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d28061dd104268e085763ac7b45cfca4bed06f0615433aceb16e7216e082680f
MD5 29db435b18340e86dd2b006516128821
SHA1 5dde4be3e22a29e51f293c1f6d36a7a05842da96
SHA512 d33defa5aecc040704e02cceabdfa1857e28f7c485c482f715ffddd74abf7cff9060da8f2ec59a4d32fec42695ecc646bb0825da5e1c1c237455305a4a9c2a76
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 98d092b6e2f97b9772481510b8fe9f1f332623f661837957f728ee10a996631f
MD5 3419478cb7c366a79a085a5db23dddd5
SHA1 30881b946b2ce0744f9d65b42ed35280baec28e5
SHA512 015593d7a79ec1ef7634ba23147af1e8e0e9f9a189c6750a8665e71bed65932f0205b4af88c6c7dd1d9d5173034fe322624b333072e92dfb2ed818c63fa4634e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 22d818da40dd67089c50bdb260e56bd664ab0d90b6d38e3cccd8304abaaa3607
MD5 04d18febb9535ccb0e753941ababf876
SHA1 df64b6098edff1f39d87bc4e9d82ca3776f49b57
SHA512 ca0db5fb7f25887f7ac0493f7781e6028402cdd228068182f8182ee405654f7c3eb37df7975f82ff1ba73c1a6999272524f769a7054593e25b70c7a130bfd5d8
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1019B
SHA256 2493ff8e2fd3bee021ddb0e0cac72aa56e4f78e9a20dad5b7bb122e86bc44c5c
MD5 2f0d010e41bee123b8ab2179b7274584
SHA1 0f2c20f7c6d194530b8e694a88194536d0f52053
SHA512 a96c0271843decfb86bbc4f3c8a9a37543c40fa7d2ee319bbd4ec85239f7428d6a805112d0bc49f2f0f14fc1c0cbede913f3ecc3d7b08f953c14f2e7f8abdeac
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 eb1f8e3bd29c6d8d4cce82882fe0558dab77c105dcccf9f4edd90e0467bab5aa
MD5 e03c49c9a1835367211fb582d2bfe427
SHA1 ba2de042a0f6b34293b97f89f0e0ed6820148564
SHA512 91147337985fea27398c389a6b828c48d370232c51449224a5cf61e3d798184bd0d0f1203ccd3f84e4057bfcacd65644f59f70e6dfbe79e0289fc1f329aa28f8
MD5 SHA1 SHA512

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 1018KB
SHA256 385c4b34b5931bdcd055fef081908d27e9f8379bf1ec3b9c7043bb23b017571f
MD5 0ba8cb1e40609081ad93b52f37df26e2
SHA1 f2ce2ff42e6f1e7bec5fc01a4afbb310be837a60
SHA512 f86c8ad46844b05e703aea36b108ea06fa4f065f818c1c85c8968d2235032c0f782422bea6c423a6bd23998ef5a863620a055b50653f118e1d0b4fd8fcee0cae
SSDEEP 24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvx:oEs1hz
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-200405930-3877336739-3533750831-1000\desktop.ini.exe
Size 1019KB
SHA256 5c7c7a466a1e3d81e4f971c3aca9ffe4029529860564c547443faf0eb6f07efc
MD5 65a0c3b111b8961cc09b1d533e72873f
SHA1 a3ea115a6051034532817aabc05bc0c6e7ace80c
SHA512 d2d85c0f2d00812308c94bce6937fcb360499b0a82702545ebbffc6869d252d91875cc48005805c30b9b3eaac9c606fcabdc29d34401b6e7635984d9786d83eb
SSDEEP 24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvD:oEs1h5
MD5 SHA1 SHA512 SSDEEP

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
MD5 SHA1 SHA512

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 1018KB
SHA256 5ec1fc4422be18f26596289d05af3eea7c91ac87e767229de02186ff46ec07c5
MD5 b46020d229d7561afdcc0af900f66679
SHA1 3c82ea43afb56366c30ec4690989c30ab95e32fc
SHA512 96ac5c4ba13635517553539c92e3b23f6301fa9a2e162101c78f02b53f9089f3590c57a130d9279616e467ff2ef037a5d30ecf620f9f58be093610f24fa5f9af
SSDEEP 24576:TEtl9mRda1cSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFHDAGtlRXZ+CP63n0NuJvJ:oEs1hL
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2356-62-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-51-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-176-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-112-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-7-0x00000000021D0000-0x00000000021D1000-memory.dmp

Download

memory/2356-6-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-117-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-93-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-166-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-83-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-104-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-129-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-152-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-73-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-63-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-138-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/2356-146-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-145-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-72-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-137-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-151-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-82-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-61-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-56-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

memory/4256-128-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-50-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-165-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-92-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-116-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-103-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-175-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-111-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4256-1-0x00000000020D0000-0x00000000020D1000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads