Overview
overview
10Static
static
1001aabfaa41...50.exe
windows7-x64
301aabfaa41...50.exe
windows10-2004-x64
301c647838c...7f.exe
windows7-x64
1001c647838c...7f.exe
windows10-2004-x64
1002f5c32fa2...d6.exe
windows7-x64
602f5c32fa2...d6.exe
windows10-2004-x64
61a05cba687...a3.exe
windows7-x64
101a05cba687...a3.exe
windows10-2004-x64
101a8f35d0f2...b9.exe
windows7-x64
1a8f35d0f2...b9.exe
windows10-2004-x64
1af797776e...13.exe
windows7-x64
101af797776e...13.exe
windows10-2004-x64
101b2b369f31...2e.exe
windows7-x64
31b2b369f31...2e.exe
windows10-2004-x64
31b4a0b685c...db.exe
windows7-x64
31b4a0b685c...db.exe
windows10-2004-x64
31b4d73a9a7...89.exe
windows7-x64
101b4d73a9a7...89.exe
windows10-2004-x64
101ba8934b2e...4d.exe
windows7-x64
11ba8934b2e...4d.exe
windows10-2004-x64
31c2a51daa5...5b.exe
windows7-x64
101c2a51daa5...5b.exe
windows10-2004-x64
101c8bc3890f...45.exe
windows7-x64
61c8bc3890f...45.exe
windows10-2004-x64
71ce9fa5304...ef.exe
windows7-x64
1ce9fa5304...ef.exe
windows10-2004-x64
1d51d46e07...cd.exe
windows7-x64
101d51d46e07...cd.exe
windows10-2004-x64
101db9ec5678...e0.exe
windows7-x64
101db9ec5678...e0.exe
windows10-2004-x64
101dbbed25cf...88.exe
windows7-x64
1dbbed25cf...88.exe
windows10-2004-x64
Resubmissions
08/07/2025, 02:15
250708-cptctazjz61014/02/2025, 20:11
250214-yypxmsyjf11014/02/2025, 20:11
250214-yynpksxphn05/02/2025, 09:01
250205-kyy9eszjft1015/10/2024, 03:47
241015-ecgjlashrh1005/08/2024, 04:49
240805-ffygys1eke1005/08/2024, 03:50
240805-eee4jszepd10Analysis
- max time kernel
145s - max time network
123s - platform
windows7_x64 - resource
win7-20240708-en - resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system - submitted
05/08/2024, 03:50
Static task
static1
Behavioral task
behavioral1
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral2
Sample
01aabfaa4177d8d4953a65e8c0d92df98d5eb9a3b8d557a369301660a252f550.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral4
Sample
01c647838c374e91e8f9fe967fd25235d72264414bb0d5b82c4fbd4151a9717f.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral6
Sample
02f5c32fa22fdc43924718b66ff5aec3115f5d0e1d7bb873b1cd2440eee016d6.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral8
Sample
1a05cba6870798d2e73001bf872e4d579460c380c060fd051f33a703f504b8a3.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral9
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral10
Sample
1a8f35d0f2b1a11a5b30e6f05ee5c9e93542fc2f559f8e66cf67f2a1b6ccbeb9.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral11
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral12
Sample
1af797776ec72874e6519962a5cfa3cd64c6061270774f7278755c69333a0813.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral13
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral14
Sample
1b2b369f31591f5c8cee55fd278c3d8a676b827d35737eb59b4d85e2b5d9be2e.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral15
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral16
Sample
1b4a0b685c317d6032beb3e82660bc57e0bf2dfac99e9d3be2cf3bfe78e976db.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral17
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral18
Sample
1b4d73a9a7c6d2163e7378c97f01fed223be9daa6acb71c81b11491907473f89.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral19
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral20
Sample
1ba8934b2e8a41efed574f3bf16e3d754daf254fcae9ed658d9eca51529fa34d.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral21
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral22
Sample
1c2a51daa50a0489a8734d3577b43bcaf78f32ab34a404d2f6026af5ed33cd5b.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral23
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win7-20240704-en
windows7-x64
Behavioral task
behavioral24
Sample
1c8bc3890f3f202e459fb87acec4602955697eef3b08c93c15ebb0facb019845.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral25
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral26
Sample
1ce9fa530436fed6a2cc1bab08320ff7b1ebdc8d80545bd298af8260535cdcef.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral27
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win7-20240729-en
windows7-x64
Behavioral task
behavioral28
Sample
1d51d46e07d1aaaf34b8b43371bb71aa87812b226341944ab661c286e66de4cd.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral29
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win7-20240708-en
windows7-x64
Behavioral task
behavioral30
Sample
1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
Behavioral task
behavioral31
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win7-20240705-en
windows7-x64
Behavioral task
behavioral32
Sample
1dbbed25cf831114c926933b2cff5b4a4760dd95c7618f01cf5b27deec7b1788.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
General
- Target 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe
- Size 2.4MB
- Sample240805-eee4jszepd
- SHA256 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
- MD5 84e2bf751724e3b0acc70b67ee1b8e96
- SHA1 2e1c9638b022901d67c69ef17c6acd12fd6e493f
- SHA512 56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" HelpMe.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe" 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe - Renames multiple (91) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk HelpMe.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe - Executes dropped EXE 1 IoCs
pid Process 3052 HelpMe.exe - Loads dropped DLL 2 IoCs
pid Process 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe - Enumerates connected drives 3 TTPs 46 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\P: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\B: HelpMe.exe File opened (read-only) \??\Q: HelpMe.exe File opened (read-only) \??\W: HelpMe.exe File opened (read-only) \??\X: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\I: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\M: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\N: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\S: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\T: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\V: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\W: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\Y: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\H: HelpMe.exe File opened (read-only) \??\M: HelpMe.exe File opened (read-only) \??\N: HelpMe.exe File opened (read-only) \??\E: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\O: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\U: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\K: HelpMe.exe File opened (read-only) \??\L: HelpMe.exe File opened (read-only) \??\G: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\Q: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\U: HelpMe.exe File opened (read-only) \??\X: HelpMe.exe File opened (read-only) \??\R: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\R: HelpMe.exe File opened (read-only) \??\Z: HelpMe.exe File opened (read-only) \??\K: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\A: HelpMe.exe File opened (read-only) \??\E: HelpMe.exe File opened (read-only) \??\J: HelpMe.exe File opened (read-only) \??\P: HelpMe.exe File opened (read-only) \??\S: HelpMe.exe File opened (read-only) \??\V: HelpMe.exe File opened (read-only) \??\A: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\H: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\L: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\G: HelpMe.exe File opened (read-only) \??\I: HelpMe.exe File opened (read-only) \??\T: HelpMe.exe File opened (read-only) \??\B: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\J: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\Z: 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened (read-only) \??\O: HelpMe.exe File opened (read-only) \??\Y: HelpMe.exe - Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\AUTORUN.INF 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened for modification C:\AUTORUN.INF 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File opened for modification F:\AUTORUN.INF HelpMe.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\HelpMe.exe 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe File created C:\Windows\SysWOW64\HelpMe.exe HelpMe.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language HelpMe.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2432 wrote to memory of 3052 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe 30 PID 2432 wrote to memory of 3052 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe 30 PID 2432 wrote to memory of 3052 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe 30 PID 2432 wrote to memory of 3052 2432 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe"C:\Users\Admin\AppData\Local\Temp\1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Loads dropped DLL
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Windows\SysWOW64\HelpMe.exeC:\Windows\system32\HelpMe.exe2⤵
- Modifies WinLogon for persistence
- Drops startup file
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:3052
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-940600906-3464502421-4240639183-1000\desktop.ini.exe
- Size 2.4MB
- SHA256 c25aa843e158e4b1abb68ae3c55b889d93c3067401fa1a1daee88a3885f3ba22
- MD5 201b32e2ed7f87fa4d5a699ed9b98550
- SHA1 73e8359bcb7bf340718f4317aea19518e7e70111
- SHA512 7200dc7a4ef0f6653a2209e6c6b4be3ba9022afb1818657509c04df6138f6c1e3c3b29c213325597dcaabe7a2661d0279aff02c69a21d768bcae206b910883f0
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCD:eEtl9mRda12sX7hKB8NIyXbacAfe
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
- Size 1KB
- SHA256 02521a3f65233ba4f39ce19e6e2feca6a393a1001eedfc329f427864e5138f24
- MD5 d5445b45e6c39916cd4fcd8a19006106
- SHA1 6fe559334a831268ef9f86153fbb695b5e34b850
- SHA512 be3f15698f8e350253044655a4209caf262179fa0df36664778278a7515c20bf665e5715e16ce1f806a669f4929fdefa7415e5ea0bd0410e1cd603b6736ff1f0
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
- Size 950B
- SHA256 7fc177754ba9957e925703122a855a806a97d865f3b2d296b1a585fc3ce54d64
- MD5 dd757a06497aac3ad5bd92ffb3446add
- SHA1 05a2d635bdd08d39833bd8cac5ad4e2a771fa7d9
- SHA512 3097a1afe47d91d5847c9d47ca0038ee8517fbc3ff61bc53ad29b439e8cc3c5af83612cec9e900810fa10186445ccd29c63c6cb507df0ce69b5a9b0fd319c6c9
- MD5 SHA1 SHA512
- Path F:\AUTORUN.INF
- Size 145B
- SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
- MD5 ca13857b2fd3895a39f09d9dde3cca97
- SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
- SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
- MD5 SHA1 SHA512
- Path F:\AutoRun.exe
- Size 2.4MB
- SHA256 1db9ec5678e417eef3d6e080a031c8adfc1fc85127317b952bc33733d93841e0
- MD5 84e2bf751724e3b0acc70b67ee1b8e96
- SHA1 2e1c9638b022901d67c69ef17c6acd12fd6e493f
- SHA512 56a229897c812cddd7f0b1847cf439f910350aa11138f7165b7c7f697095dfe5ee64e875e4262706c20e7bdbb59a94512386965e83ac9327b0b6967377882aef
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCp:eEtl9mRda12sX7hKB8NIyXbacAfe
- MD5 SHA1 SHA512 SSDEEP
- Path \Windows\SysWOW64\HelpMe.exe
- Size 2.4MB
- SHA256 7cdbe203acf89434221c69804bf8bd1e44b413376fbb509301c80a84d73e3ee9
- MD5 3186b2fa1bccd38746b3fa55865556ce
- SHA1 37c87959085f3f2903592330b8bb745d8917c79f
- SHA512 81b61776570826a77acba1f44ab6cb5fb64721a8d2848521b8b394b3d957840261becb7bf914ac4e64e8f68f1c4cb2a79280b375f0f63aa1dbde69b926800dcb
- SSDEEP 12288:sp4pNfz3ymJnJ8QCFkxCaQTOlPes5Z76k/L/KB8NIpYJTCihq82WFpXKEVFA2MCj:eEtl9mRda12sX7hKB8NIyXbacAfg
- MD5 SHA1 SHA512 SSDEEP