Overview
overview
10Static
static
10001a09a29d...ad.exe
windows7-x64
10001e9cb57f...ea.exe
windows7-x64
300ace607a4...64.exe
windows7-x64
70a20f03af5...77.exe
windows7-x64
10a6c62c139...b8.exe
windows7-x64
60a747a5f77...c2.exe
windows7-x64
0b02c55fbb...c0.exe
windows7-x64
70b716abe15...7f.exe
windows7-x64
100b997e8b0d...46.exe
windows7-x64
100bb2957b2b...1e.exe
windows7-x64
100bd9556e36...74.exe
windows7-x64
30c0c9a19db...c1.exe
windows7-x64
100c7da4e446...86.exe
windows7-x64
100cad47e2df...6a.exe
windows7-x64
100cb554caaf...b2.exe
windows7-x64
100cbb472b55...43.exe
windows7-x64
100d25bbbeb6...09.exe
windows7-x64
100d9ea4a12d...0e.exe
windows7-x64
10dbfd3479c...8d.exe
windows7-x64
60ddcce08b7...35.exe
windows7-x64
60df9bd640a...72.exe
windows7-x64
0e52434683...e4.exe
windows7-x64
100e767dfa6d...e4.exe
windows7-x64
100e82ed8dab...a4.exe
windows7-x64
10e98661ea6...29.exe
windows7-x64
10e9f24d9b1...d5.exe
windows7-x64
100ec44257a6...68.exe
windows7-x64
100f18f6547a...57.exe
windows7-x64
100f3d700c95...90.exe
windows7-x64
100f54e0f3c3...36.exe
windows7-x64
10f5ace8adb...72.exe
windows7-x64
60fc4a985ae...f8.exe
windows7-x64
3Analysis
-
max time kernel
145s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
13-07-2024 09:29
Behavioral task
behavioral1
Sample
001a09a29deab5195eda46bad91e51b234655325b641e211ed8234e934956ead.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
001e9cb57f9e922d7b0d92ec43b8b5e376c5ab6e4ea827b84c76e13c994fbbea.exe
Resource
win7-20240708-en
Behavioral task
behavioral3
Sample
00ace607a44cbcd3e0bcdfb0a6b5f27c834fce66b95ee987c28eb651da9c2464.exe
Resource
win7-20240708-en
Behavioral task
behavioral4
Sample
0a20f03af50d14404b349279b3dc20886b1bf91419ede3f1b0c7fbdda579ae77.exe
Resource
win7-20240704-en
Behavioral task
behavioral5
Sample
0a6c62c139aa9baf898add2a10fada3d49f78b3089507b84e613868242e169b8.exe
Resource
win7-20240704-en
Behavioral task
behavioral6
Sample
0a747a5f771168c0c32e944da6d6d996f24284e4fb44eaea562b21266a9e3ac2.exe
Resource
win7-20240705-en
Behavioral task
behavioral7
Sample
0b02c55fbb40d7757b5808efe3fd1343f943bcefb92e0009689f4995e3eb26c0.exe
Resource
win7-20240705-en
Behavioral task
behavioral8
Sample
0b716abe15b17a114c2f12fab954c861f82165bb0868f863cfb8dc634f76be7f.exe
Resource
win7-20240708-en
Behavioral task
behavioral9
Sample
0b997e8b0d0ff6cc4e6f1919c6c0f3080eaa0d08c8fccdf50f7648bf05cca446.exe
Resource
win7-20240708-en
Behavioral task
behavioral10
Sample
0bb2957b2b8ed0a1c458da6edeaf5a48b2c1ecdd7d7ed33d00749ef1f5653b1e.exe
Resource
win7-20240708-en
Behavioral task
behavioral11
Sample
0bd9556e36c620bbedfafd2e76bb6703f069aa654e34008f2aef3b4a0ce6f874.exe
Resource
win7-20240708-en
Behavioral task
behavioral12
Sample
0c0c9a19db1f89d94ddcd8af54fa631798e3ccc82743faae6d9818759f2dbcc1.exe
Resource
win7-20240705-en
Behavioral task
behavioral13
Sample
0c7da4e446a97f08bbf6c0abe987810047163150d70f0a282c2f7cea674d7286.exe
Resource
win7-20240705-en
Behavioral task
behavioral14
Sample
0cad47e2dfd2538735f7affa42f9aad5d7bf453d88dbeb901e9b06fcae871e6a.exe
Resource
win7-20240704-en
Behavioral task
behavioral15
Sample
0cb554caafe5c2d40c1f882ca04710752194ebf300e0050bd7b7511312ae61b2.exe
Resource
win7-20240704-en
Behavioral task
behavioral16
Sample
0cbb472b555d4cab454948ba900675db48b120afaedf246a14d87d970b233a43.exe
Resource
win7-20240708-en
Behavioral task
behavioral17
Sample
0d25bbbeb68847cab4f3805bb8028ca901aa569abb038660c5febfe2ba24ec09.exe
Resource
win7-20240708-en
Behavioral task
behavioral18
Sample
0d9ea4a12d29d79b00bd3d0788f531642832b799bdc3baaebd0ee213cee4720e.exe
Resource
win7-20240705-en
Behavioral task
behavioral19
Sample
0dbfd3479cfaf0856eb8a75f0ad4fccb5fd6bd17164bcfa6a5a386ed7378958d.exe
Resource
win7-20240708-en
Behavioral task
behavioral20
Sample
0ddcce08b727ccbbae208459032f010956794a84b7f35e225b5bae927b0f6835.exe
Resource
win7-20240705-en
Behavioral task
behavioral21
Sample
0df9bd640ad5bb636095c524e54f9152bb84092889e720dcaa549e65dc3c1472.exe
Resource
win7-20240708-en
Behavioral task
behavioral22
Sample
0e524346835f7c208667a18699df3faf34fcf8a3cceab8a7418d3f88e87211e4.exe
Resource
win7-20240705-en
Behavioral task
behavioral23
Sample
0e767dfa6d7887e832225433ed8866195df94607ccb474868b9abbbf20843ae4.exe
Resource
win7-20240705-en
Behavioral task
behavioral24
Sample
0e82ed8dabc9bb697d3e2f7ba1ee8d5235d3501796fbc1cd79ccffe7df11d9a4.exe
Resource
win7-20240704-en
Behavioral task
behavioral25
Sample
0e98661ea680708e9bb55f32131f743811108e826b91cae99d69a8fc1856d429.exe
Resource
win7-20240704-en
Behavioral task
behavioral26
Sample
0e9f24d9b122f16a0817890872ab88e91cfddeaf1bac8a1e41a724f5eadd9ad5.exe
Resource
win7-20240704-en
Behavioral task
behavioral27
Sample
0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe
Resource
win7-20240705-en
Behavioral task
behavioral28
Sample
0f18f6547a1c8e86963a9e9f9dd9e6e42bd506de21c034ec884c3b55a789ac57.exe
Resource
win7-20240704-en
Behavioral task
behavioral29
Sample
0f3d700c95b21e5437c0aedb3cacd787ce6701c49180d8d564e4574dffc42190.exe
Resource
win7-20240705-en
Behavioral task
behavioral30
Sample
0f54e0f3c3408647bf9844f9d97b64dbc62278091280b3d7bf1db5bdde3fc436.exe
Resource
win7-20240705-en
Behavioral task
behavioral31
Sample
0f5ace8adbaf1f05d0f5765166537ff4b77ea9f038cffbc08c16afd4cc869972.exe
Resource
win7-20240704-en
Behavioral task
behavioral32
Sample
0fc4a985aed460862a8f70dd982fadbd65ea0ad88fb58ced2d909f4264ab98f8.exe
Resource
win7-20240708-en
General
-
Target
0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe
-
Size
2.8MB
-
MD5
dc2906e5bcdea645e2339b9f74027a20
-
SHA1
26f846b2ea394b0005f2254fb6d56d5534f467d8
-
SHA256
0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268
-
SHA512
6e28b4e954eaa3f246ef334cd4adfd9e9af49e7fc782cf254b5934c93423b93b113195d8f98bad46587a5dca0e876f5888559bcd486c9599ae7e4fc13c47d100
-
SSDEEP
12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCo:eEtl9mRda12sX7hKB8NIyXbacAfT
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe -
Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe -
Executes dropped EXE 1 IoCs
pid Process 1176 HelpMe.exe -
Loads dropped DLL 2 IoCs
pid Process 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe -
Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\H: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\T: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\Y: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\J: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\P: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\U: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\X: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\I: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\L: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\N: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\R: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\W: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\Q: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\G: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\K: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\B: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\M: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\S: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\A: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\O: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\V: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\Z: 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened for modification C:\AUTORUN.INF 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File opened for modification F:\AUTORUN.INF HelpMe.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2472 wrote to memory of 1176 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe 30 PID 2472 wrote to memory of 1176 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe 30 PID 2472 wrote to memory of 1176 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe 30 PID 2472 wrote to memory of 1176 2472 0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe"C:\Users\Admin\AppData\Local\Temp\0ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:2472 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
PID:1176
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.8MB
MD5f5364b1ad642edd2583a5029c4d90cd7
SHA10963913d6999f0b3285724208cb27b48e71cbd11
SHA2567de1ae4b05b1c44155cfd4a210689413053098d2486e0108118a32a4917cbb43
SHA5128e986bfc7f9a50ff6baec0fb327fe7d8cf52ae7da01788cc49769d14439b6fbe09d301d563c5da9d9e5104da56254af11cf3aedd9d5b7aa727080ec1c059373a
-
Filesize
1KB
MD527c1c17e4b5001205e1681d9dadb29fb
SHA1fc2bdff2cab20370bc8c75ffcda257647e6cbd91
SHA2563b3590cd47521ef3d953ab122288065df3fc4d3d26088fc6215430357d0294db
SHA512c5b4181171df1ddeef29be66524e8819bb615917a9399125dc6b24739398fd745592c1867841b66bf172724ebbe88ad0dd414a4ed4d835859099cf56bd8b7163
-
Filesize
954B
MD58cd3659c28547103a5a3e127858e2886
SHA19e8947d49771fb1dbb42b4820dd42980a2c4f971
SHA256ce1a7bef7fd4c3de0ddf29ba3e3760593e11e8dd81021488fb8b2a7abc317bf3
SHA512332e8fb5a801c7a4279ef58653bcc2576085a5a447aff3a60a7015084eef6654c7e112213a7d57ca0769278393e4d0baad19539b955aee8ece3153bbce57b599
-
Filesize
145B
MD5ca13857b2fd3895a39f09d9dde3cca97
SHA18b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA256cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
SHA51255e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
-
Filesize
2.8MB
MD5dc2906e5bcdea645e2339b9f74027a20
SHA126f846b2ea394b0005f2254fb6d56d5534f467d8
SHA2560ec44257a6b4c2827476bae68cd30ecd9ccfb9395dac3671df6a1b65f20fb268
SHA5126e28b4e954eaa3f246ef334cd4adfd9e9af49e7fc782cf254b5934c93423b93b113195d8f98bad46587a5dca0e876f5888559bcd486c9599ae7e4fc13c47d100
-
Filesize
2.8MB
MD5a718f62d99376ea4673829bad179f3bb
SHA1052a98aa66c1257b3093af116870ee38def63e66
SHA256b421b4d3e540d8a2fcedaa5cc651734de34d87a007e5e870e73623125b909f6d
SHA5126d9d8b20c9632e023e25b167017b58dea373986acba0c198eef3014b15171fa9c7c61a8910f553ac9a2fb7d0a5507e13e21aad42f5b6ef5af033e2d8882d0f69