44377943f0c50f89bc3f40145e3f01ff73c9355da42552263419e7e82d3b2dca

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/06/2024, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
Size 987KB
Sample240616-yn9jasyfnl
SHA256 44377943f0c50f89bc3f40145e3f01ff73c9355da42552263419e7e82d3b2dca
MD5 b4ed6b723d6c339af439377d95d270a8
SHA1 9eac2a929981abc3607ac97abe56da0bc4f7bfac
SHA512 256a96fd0a8222f73c646d7c6d52a20a674baa6ecb8df8285f769464ea2dac919ac32700743abd79372dc4d66a69c18b0dc19a179a494b3bd972ef764c2c46f0
SSDEEP 24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFu:Kwi0L0qlFwi0L0qlGB
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aspackv2 persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x000c0000000233be-4.dat	aspack_v212_v242
behavioral2/files/0x000100000000002c-15.dat	aspack_v212_v242
behavioral2/files/0x000b00000002336b-33.dat	aspack_v212_v242
behavioral2/files/0x000100000000002a-41.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
4028	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\T:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\Z:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Q:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\N:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\G:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\I:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\M:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\O:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\Y:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\E:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\R:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\W:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\J:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\L:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\V:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\A:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\B:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\H:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\K:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\S:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\U:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened (read-only)	\??\X:	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	C:\AUTORUN.INF	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 4028	4296	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe	81
PID 4296 wrote to memory of 4028	4296	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe	81
PID 4296 wrote to memory of 4028	4296	b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe	81

C:\Users\Admin\AppData\Local\Temp\b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b4ed6b723d6c339af439377d95d270a8_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  PID:4028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe
Size 988KB
SHA256 0b738c51713e736eba4347480262012911ffd3b587fbdcc70bc1a3beaed41041
MD5 cc76816b986920cebb35e0dba2e3b264
SHA1 b1c96b6cf708b4291a0525d12ca147db71b5c221
SHA512 f9958b0c8a86a2f4f83204b87c04d7b9225b350c5030688da2ca241451a1bd467f2a3ae36db0bd46711b4cd7fa2fe52727292781b4fd8ffee281391c2c726e3f
SSDEEP 24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFj:Kwi0L0qlFwi0L0qlG+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5aa62f174f69ea37080f37826977afbb5036f85ad8c56b74ac3281ce6335334c
MD5 f89eb9bf98b3e4d8848d401975609cc4
SHA1 1c14d1b38b4044368f274cb810c7dbd1604700ee
SHA512 da10768b504a1374cf154fefc3063fe7b9b7ca5780975d1ba7e5b4016ff93dabd4fd84914b31ec9faacfbf287e6f38e72c423e6b991e62dc7b16609801f3ad17
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 acd5afd692bd89e3509c8de51766eab8956d2cb0ecdefdf69f44cca33b8ea4da
MD5 24c9c678c3d6eb247dc8cb255018b16e
SHA1 f5c0fb778fe97dc85c4d4d64cdbd605d8b854e19
SHA512 d0b4c6f3dc21464d88ccd3142359231283ea8ccba5fac34444a4ca428f16f57c95c6f610848789c1a73e02d20d91c1752057613cb4d677832cdfcf0f66d2dc18
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f87eadcfbca216be7b867ddb35ec7a611373c9c875b7c62a2858586d1f2fab4a
MD5 a9fd3cb2af2d4a72656d8e20b9912d76
SHA1 9772e753b612280c1e9a2fcd7ae6e1e52fa4e98f
SHA512 2ed15623626fd78702a3aaea1c233de998653b5865e90a8d4ce0ab120c1fe10abbeb3d783d8ad72b0b14b72b449234dcd14f923edda237415e0ad4eca1fc348d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 895fea79d6f12464094798d17b67f4c2f5e67e1c984bb95ca48e8eabb7e3cd17
MD5 8a07b58e43a4e82d6d2425f7201334d3
SHA1 93ddbabfabb01ed6a182ada0ec46c6b07c505596
SHA512 241ac5126c676edfdd48e6c454ca37a453bd9d2d56622f3972658f44a0d6c841313a26fc1acb390e32e6080f2bfd5db3ac5a7401bee08dc015d8cb0773478e5c
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 fab0c207ecfb5c9e628e8d935788ddeceb9575422d1cc4cd8e33d7e6d7ec07e9
MD5 5dd33f846f8c5fce0ea2d046e4f35a52
SHA1 d56c81ad4770b8ed1122bf0a977d98fa615a7955
SHA512 853d39b6329998dc69d1cee766786606979a000e7c4cc6422e964a7ceb6d3eef9f598abfc17bfbd8315b103c88b315a11bcf1ae64b4488688aee133f24465f0d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c315171b3cd93af77480a0ffab589dc097e5a3352cea6be0820c988a46a9578c
MD5 e5081b92381087dae4fec880be3865e7
SHA1 7e373da34f4215580ece77e855b5ed5822c3d8d3
SHA512 1cf7f05d3635ed80ca82b626b8b69901012b6ba4233bd67ff42a16c2fd0cc9658e002a5099ebd71810d578aa17b4cd01398eae2e23cbdbafeb84ecfb3d1d9041
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3a81c041c937a9d5ecf7e7a6c32700745eb90ba2a98552dd67750776390849fa
MD5 08585d45f88f3bfc80ed75a8fa72ac35
SHA1 821504bd07c43e0f9931fc80c4929b20a07f869a
SHA512 9ae0be003ca425481a4d3cde5c92eb1b9b2dc8040bd1c766cd322e6d1d3b7d17be2ccd7e5ad5bbc645b801d4ee09bac6a921b356355f69c05107d5c219c262e3
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0a6eccc1ae0a6cb71e382b6aba2a39b0379582eb8a30b70d5c582bc637280760
MD5 3cb836b078a7957c3c2336942376d59c
SHA1 befb9cdd94a818d26044d57ea9ff387cb98d832b
SHA512 93ab8d45e9aca7504abd4690a20bde1894c42c61e8c83d2a03181a7038031ed4275adfda05e2b1e72db4feb00ee833dcec9adc0b790b37646646b18ed4854b1e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 88a9cc14fd01531389622142b66530d6be373585a3e974439e6334b103d7444d
MD5 079320dacdf1a1d763d5dd80d1bc8286
SHA1 4056a37ac01e60b64ef53339a0a9b04ecba337ca
SHA512 674ac7992593644153db8500d022f2bd844f03feaa5db1b336d45e7851c1fbfc24149d77e03e62f7b093d066b5a75859ea7ecae97e52344392fe74c69f0e7b00
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 5d77668fdab92e9b577c309f2852e1f8e747d3314a28e4e737520e59173fe005
MD5 38804ccfe16002a7a27acecf38c2c8f1
SHA1 e4749a4640ce2e1412feec625533cab4a22b9368
SHA512 26168e31a963c67bef7b4ba2a428d8814c4374308acf27dff193a0e1a1eddd48661c396c734f557b4cbefabede7cee42de50a2e8a328994de317ef48f673487e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 477df0912a41ef13ad8505a064fedbdaddb72b714caf80b3f3d6dcd22d2a9106
MD5 ed279d8805ca2b51f1434ae74ca98a14
SHA1 950b9378fa65c5b613565118dba6ee92b4ba76d2
SHA512 0a595096a954324d0446f1ef6eada898543e35da40e7581ca0a7d1751d4f11614807a8ea7ea503abf54158608fbfcc675e535d6e7441eeaf197b060273a301eb
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b4c5bda60e4c5544cd6f70a09d16bab3d06f5de0ad734127f46c1a02beb3135b
MD5 db5f9218f855fa39d04a9353436f6e97
SHA1 7ef982809e95c3c421ff27abeeaec2f9c0e85e31
SHA512 b66581a7c004b3eae2757de5818af12f31eb2bc05088697351066de2faf322f6dd4a41243a604a1e31d263bb875d51a03f6acc9e5a4ecf1c2de47180e6a00db7
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7a43c84be5541b84692acaa244de0d679db13eeb8aa3d5eaae3533bd5bef77e7
MD5 7ebbb35b873e3222df1e1fceaac62512
SHA1 1d8ba43b644c317ce2d86227ee481c86534b83cb
SHA512 f5a65c507aea9db9f09970b6e047e20169a956594e30d8f2107cfdbee4cb0cb01f025d97097886e2a21888b6e8468975062f157de28f141b1f972668e3a50ef9
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a9dfb7326d23ca1f8820a2fe05826db0717429952ec3e8cc6283bba9dcce5f86
MD5 23cbbf03895c52b484fd558eb94f1abc
SHA1 c7bf4fdd7cf8c8c096eeb118e503214d9244c4bb
SHA512 31bb3fee5e8239576ed145ae83db1b22cc2ba61f7dfc03b359794c42f624fb62d46a77768ccd2665d6b9be755b587240a8da30fb1bdd30b3fe4c2bc79aab5423
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 758d434e0aa0de90c40b7615203697a7985eeb317de6f430620421fcc3210803
MD5 c7ed5236ded653d1e7e259ffb9ee20aa
SHA1 d92b4a552de3a1ab1a486db51779399cb96c011e
SHA512 9b03b87ff1b549481e14cdf8e7d5f90fb874e214d3350de606f1f4b3dddfb82275d90eb8613bf4cbc885c4fad70dfc648e617b2ba6c14dca50d1d10e50b8544b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 78ea1714581876750a723ef65256c0c18894a9d72bab8557d9479e276381dcb3
MD5 d179e33e589d15b4d188b5250d28c144
SHA1 9c496ed8ecd785b9e55c191d652261f75f116f7c
SHA512 3b426d9cf1bdd620a8228391160fb9fdb519074c04030327ef4f149259aef8d64abedcb3860a3406f3e3a6c3fc73bed340d8d2b6e92eaba71c63ba84f3e78b05
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b882763a1bd24bc94fea4c9b19cc367be4019b511dad8068bb271ee4a5610265
MD5 edfdaf4ea862781d5b4d805689c8d597
SHA1 a47b3f38e7a6cc3f7bb426aa1c5f7bd70f1dd0ef
SHA512 1a7f2b474e0cca494a79a086e1f8eb7a1d47fac8d4f42a7cb20a54f3e2548b9bd3c49d29109976c085239827f71d32956c952d2365cb356fd9bbfd73d214678a
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 58e567bfe19a7f7f9b6bba0c2ac59d405289603bb520bf7e649cddfa1f4ea446
MD5 25c6f83a99353fbcd9252fefad02b12b
SHA1 d3041c93cc31fa1bdb8d18a55905296659d440eb
SHA512 c94d7bcbf228b6bb568844991e30684220227283b0493718b1fa6c49f09eae35f05b0e2326cd4f5de84df09ee9e507ca38fa6ff4b00d4a52d04ed9b37cbca436
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 fde5fcbb2c64780dcf6043bb6a1f6370f607cf833d518c1783fb8da31b5cd6b8
MD5 87cb3287ccd744d338dbfb40f39ea55b
SHA1 107c908fb49a4673a384636c7a3db64f7570dfc9
SHA512 cd359d552be004d9122b313390aad90014c1e0cab4462ef1e674268ef419a419cc1dce217730a7c579dadd66239a9c5046373a2ac81774af92efe1fae794d4fc
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d563b8a4da97f2bebd32f4c2de96532398ec88dc8f2df5454a4a1d664f6370eb
MD5 dd447981bdf900f0e047166f8a6907c8
SHA1 26f1d25b6415aa68cb0d2ed901ac011c20135d9a
SHA512 9d4e9daf825905fcb8a328f27ca95d89789b496fd0beb0148fd795c3298c5e6d70159ecd7c1eb76d7f7d4413efc0c70b3c50fad78dbeff9cbeada865c8b4939e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1e90c154c9370552cdff246e674f7f1c964e2e8a8526c0d5c9dd478b508fc01b
MD5 bc66eb319677b5742717e7ccf4d6b3a3
SHA1 eeeb8830bf6a36736226021f00512563534b7f28
SHA512 f4200cee8e38bf72894c2de08e8364c4af93223f24c8b4d2551fda777f650acc80584d054857487571b34eab7cb1dee8202e952da4bc9729b54382c4b0b27a31
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 53fbcfffa31f278214dd7d8de38f01fedf8217332dccdfe6b2f553199db2448f
MD5 95b2af1f2fc5a574597591df5ea2d5d9
SHA1 f68e59f9c546367883230d307f61d8d42261a939
SHA512 eda0ee2bbbbbfeb2baa648e05daa0fe9a2651745d8ef747c9edd9ca8f5ff58799869a43874f6695fa0b8e461a9d748432dbe4ff8f01dd48f4d6448e516a52b7f
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f154d63a07722f5cfa030613fb399f59e8ce80521deefdd4421027dac663cc31
MD5 217d13de635d5b243689e534a0d34641
SHA1 bea11464e4fc536e1730e0f5a6a6456d29454e77
SHA512 7d1a5f8c62dc57fe84368d3b7d87ed996237a35aea50f5a138658eb4d15dadebbffcddf0a1a00acf3be64a551e7a2844bdb2e0b37516afee9039b8c7ec4cd319
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ba32fa40eef2307c9114add7fb42cb95d274b7dddfff1b91c9a0c22d22870898
MD5 6c58b0028b8549c0b8a596b83c6b02ab
SHA1 9381b865fa8474a4733e87c188183d277bc1e80a
SHA512 bd549cc688bf05e460644b84b1dbf47fd95b7f0462e6e948557f63ea6670d5c6074ceadfab735476dc43073fc0fbba91b8e7a85d1f9e256a53df6e23ac0a54df
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d039faf882a9edc7af08b1cbdbe86d6d2e388fe6c6c0ceb7c6f2642c8ec286da
MD5 8546690f87dfbe33f0718092d1660ec5
SHA1 9c65b454aeab80d11f796b586f8a4d6a4738d31d
SHA512 34e1e0fdd7ef7a17f2719969968baaadd2dc20857bfff24a1d700f7b99f011e9c955cca04a06cbff865e934f7f701805cc70a010ab69b98a85c4134a49986a17
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 e9475b231b71dc8b17a9906c13655c629a312db4aac054c111bddfff13539df8
MD5 e5ba62c04f345df264c28591b457e1f3
SHA1 0a264bc3abc655cbaf5cb646d93e2823d396dda2
SHA512 ca6ed08a14b69bababadbd63807986b9580891d8fdc700afb08f75a9e29fc9a93a405237d1fa16f5885b93247f55db030206f40d144184a9d69859c4bc15b8ea
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9873f743cfd3a507f3443cbb560384edbfc5f4d8903022f70f399a9523956e0d
MD5 6ac960463fbabd4c3d4d757f79f3bb8c
SHA1 120e2c856aa0685c88afb8b9496e61a2e98169b7
SHA512 1cb64009f16da4d266396e19f445256b43be3e5aacd3de8fb819ae90a44812ec468b80e5a30e1daf5c0e14e6e54304c220dcb41b5f048afab72cb3788f3a6da2
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6aeb4c55cc86c2b40bf843a6323fab541beaaccd749fe563f31d0c4b5f73b29a
MD5 21040c748fa8540a56ff3427eb64fb2e
SHA1 93a387f6c8b2812cf77547efc2d1e7cc3f1e97de
SHA512 0e90ca9eae841fd9cf87e075ee4a55a756df982026dcd6a72b11940f2f9361edf6e8d95dee30d0469e2b6aeca0efb34ad6143fc918f576acf6882d8385e9fe2d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8a687ca22c9d11677c4a34ef12d7462fbe31ca85f31dfafe85e8b8f1150b9172
MD5 1e6f1fdc32746c1a1f5d36d5f0f8b8d1
SHA1 988c32cf484a3a63eceab09273bc3e5d34d585d7
SHA512 d1d002681d0c3edc819bf46ca65fa85d6117bdf9287ca977fa5f4df70fd5597eb97d2cf7882d9e4b0b5e1db6764370cdacf6240d230a48455c811f6331ecdd9d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 6adebc5ff5873e3827c92be4751d3750be402d85563b2e77e5f399bd08993471
MD5 581319bdec0de394cc59352fbe8724f0
SHA1 edc6334c7a4748443bd7b2cc48c7eb6f91a4d2b5
SHA512 9f331c2910b78e8c8120a5ede91e5ffa0aa3b0c8833dec1f23098ae03987f4bdaf07bd0071259c17ac81f2b2944af0b8c779bbf9cc0d5c910663b60d7e1d9df2
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 7c2a8a0f77c4f25a3a3e592fefbd23bacfe5c25d925dbc32dfb9c8ab48b361a3
MD5 9a826b3cdae46e545d039eec8804a4fc
SHA1 9e02007504b0e1690702c69b1b5e8d26cd256a1a
SHA512 b2e15e7f965e3582c2d4f739089bfc25bee8b9cf3370a413d940cbf99aaeed65c8bf279402d3acdd23828eb0f728f6e8b6dcb435fa92ee06c54bcd6af3b345ad
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ce228c06fbbc055afe578ef8426bfe7719fd337aef030668f4d526bf05783491
MD5 8d77a8c27e40f4ce8bd8201e245d1038
SHA1 b7474c03ad3012362aa26ef65f2c23fa9eac2475
SHA512 4936f0848dfee9d8a655fc67e1fad1e18888710ded49712d7e21cd979b5566e345040399631ef4c1339e67597bb8cd6a669f68909b2478b5c474bade5e83c98a
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 98e0b9d79723436039f798bb2cb27e39d0dfa9593456b30319636743bf6d479d
MD5 c4f68edffc0ba47fe3abf606f7d2589f
SHA1 0af4ecdeed22be22665c7e584c073094744fc194
SHA512 b850af08b4c2bf0a3dfdf4a430e83d6c0bce096484af643ed468e43837101168f80bcbd7ac65607f0cdf400328fad8ef0e36a9dc23b6f595bb920d40657c228d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 75ed0b52ad3931438fd7304e583b1b651da6330f70487d1bc6df2cc225cf2572
MD5 b039651964eae08cd3a14c95038b475f
SHA1 1c72a46659205f69e2bd0e8d5d924dd3202c473d
SHA512 8d9ddf4f6b8365f3fc06f108fb159bdb2f3c4b7a1e2fe45e9ac5897e06f17734ab992ba57b5080d2bca9c919a5c099f982ee13d1f404e45ee9ddc0e17bf0567e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 417786128f704eb714639ce4599f639b9343952a652acd339f1d579b7fd88032
MD5 a713d6bc74958575a01ab25f8ede34fd
SHA1 fd836b4e98c34dfd10f22153eccdc53aa14bcff7
SHA512 7e8ec15b3db2a35c45dfdab5caacaaa00f621e73019917feaffb6ca03e2bf7efca051d7d3612fe6b6f070ab46568f0379b665505f90eacd6e457465ee4a1c848
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 dc8a3d5fb75d3c50ad81e07e69a06f36663d5ebb456ea8fe72d49671e2754124
MD5 afc509f714e51bce2219ec8b3abe6ca5
SHA1 c41f93588d094e6d853cc6273b0a53025c182825
SHA512 3dfd2320ddbdd86ec40f767e841c980cc94e03ac503ed72fc425f3d63db91effb2eb58aa8f7c670977d66e69082d10dc2a798fb65ca17719ee8f2abd6cc5a759
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 0c155c253ebe50f9f6552cb3d7d892b6a28f3fb656c9222935f0576f3b0e9b93
MD5 9568a0d4a45234ce105d14c4502f6c03
SHA1 aa4cda24ddd9e7290cf22d0e3357bd7ae44c57fc
SHA512 c79d8418cb9e5563a6a33f80cab537a662ad26dde34efc334825fab7b1f2e1d002601881193e24a789ad4e4bd634f0a244469b5aba3639cfe9b65a2080d40a4f
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c5ecc6d409092c22ff2dc87ccad50bacbabbe1cc50a0bd6a5a2f5f8880c39fce
MD5 743bddbe4e9c6e1e76f5c07272a3d57e
SHA1 5d085f790055c7392df0832f1455a355f9a33206
SHA512 d8361c19d332a53de3a8ba350b49d08c8c967517f39343bf8a7fd72633a0e97136729b2e2a9bf303ffea23ac8dccd08cf5e2d25956804d9bc85f0d3de31e4e04
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 3844a1c57b6257112c6688e71c87c67a4d3b1e9564a8143953f94a374e7f78d9
MD5 b772997ad63d0897ba78383d8bf0af86
SHA1 1c5d8cfc6b2c7991375910fac2bc01477e42d085
SHA512 47980ffe36ea1d1149fc1ff26f3cb5d628d7b304d844d4c6f5e374c42730d1baab36f332f8f1d12a5e49de2279b76e77a990199fcfe0e66026487a5ba36ad364
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 88241c95a4d3caa07154cac225b48b37e369fdb252ed50819fab63d43206a83b
MD5 2165e378fccccb6b3d324b318aeda53a
SHA1 eb883f3cd83f6f9f7cafa82dab8a9e73ea3a2267
SHA512 9ea0d18fa4f8ce40c34c15be998866934fc339b0ce2002586fc3530e4622a5a713ef09f8a20da0427945eea6924447abd0db38c8c4cf9d2e1a6137f74f38eb96
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 bdd7567f9043c5e9829e9312afc9f0602de5e859082678bb29dbe9d2f3bb6637
MD5 77633acce390055261c904267fc8fa5c
SHA1 897ee9469608a1b37da394f03b6ffa077c3cce39
SHA512 dd6181e14d2f1cd91f9e025bc6be4b25b50298a581a5c76e7d42173e589788bd3cbe7ee2bf293defdfac0c55a66fe04e47a656073e7c655a1d21cfdef18cbcf9
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d13df455dc5785451f36db23663bb30232adfa6cc2a8807f447445ca5928e6f2
MD5 143c578c23dc9b0bb1e1a580baec4494
SHA1 83cce7fe544f4438346ffd9bdc18b59c11a5ea0f
SHA512 7242f761357f082eead1abef631e0be0c6f1d2ebc990055ec9dfd1e2917388e91e867a9d192e5cf0e34c865ae6051223be3e6b90db875fdbe3f40ba5b62a5b79
MD5 SHA1 SHA512

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 981KB
SHA256 e7a4686a1af0845e9766fadc2db9923e37b0bcfdfa72002b79dcbf85a85c9141
MD5 f593fb825dac6105cc8d916b4155edcd
SHA1 6b4c2ab60f65457ab0e44a94b5b4053c722b85fb
SHA512 8e9a7d8836d51e3ded66004979c6fe15c1c1cb710f5626d1fb25a167e4b05020b83095c71e201cc9a9fdaf4bf16df637c29df1f105d9ff729693519aafcce275
SSDEEP 24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFf:Kwi0L0qlFwi0L0qlG2
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-4124900551-4068476067-3491212533-1000\desktop.ini.exe
Size 988KB
SHA256 3dfff1999be19209e00fa52a97eb5fb177b7593d68f79fc949bd79f950dde268
MD5 9ac06d274f309db1bf3cea42ac665de0
SHA1 c7d712b14be060e620340914f69894d8f16d8aa2
SHA512 0e998181ef8f642049e2d18df2f4e6ab4db490d96df8d577f706bbc23466ffaa8a95d6ce5c00c2603ee64c10ec55f860afa8316164de44455507e80b202810cb
SSDEEP 24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFR:Kwi0L0qlFwi0L0qlGM
MD5 SHA1 SHA512 SSDEEP

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
MD5 SHA1 SHA512

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 987KB
SHA256 44377943f0c50f89bc3f40145e3f01ff73c9355da42552263419e7e82d3b2dca
MD5 b4ed6b723d6c339af439377d95d270a8
SHA1 9eac2a929981abc3607ac97abe56da0bc4f7bfac
SHA512 256a96fd0a8222f73c646d7c6d52a20a674baa6ecb8df8285f769464ea2dac919ac32700743abd79372dc4d66a69c18b0dc19a179a494b3bd972ef764c2c46f0
SSDEEP 24576:ZMMpXS0hN0V0HoSMMMpXS0hN0V0HoSTSGB2uJ2s4otqFCJrW9FqvSbqsHasgXhFu:Kwi0L0qlFwi0L0qlGB
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4028-140-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-121-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-59-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-174-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-49-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-5-0x0000000000640000-0x0000000000641000-memory.dmp

Download

memory/4028-69-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-131-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-111-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-166-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-77-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-157-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-89-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-101-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4028-149-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-148-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-76-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-58-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-88-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-156-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-139-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-110-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-100-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-165-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-0-0x00000000020E0000-0x00000000020E1000-memory.dmp

Download

memory/4296-130-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-68-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-173-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-48-0x0000000000400000-0x0000000000478000-memory.dmp

Download

memory/4296-116-0x0000000000400000-0x0000000000478000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads