dbc40ebfee3142451c4f99972cc67e9d2b112419cea76cd4e547bc67928a79c4

Analysis

max time kernel
145s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 18:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
Size

435KB
MD5

0bea8d3669e855e32547b40dafba6fb2
SHA1

82e7e06a3005489895ec9580c7d466bb7beb35dd
SHA256

dbc40ebfee3142451c4f99972cc67e9d2b112419cea76cd4e547bc67928a79c4
SHA512

33d8851ff99937c92efe8ff248953fe22b42d101afacf223e174376ba065e7f9d4cb61f99cb34adaed1f64029f843df381bcf41f17dbfbb98737ec6f20dec393
SSDEEP

6144:k82p4pFHfzMepymgWPnviP6Koa0nArn20l96tCF2eKNBDRlC8HQQDhy5OwbYBilz:Cp4pNfz3ymJnJ8QCFkxCaQTOl2z

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
3832	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\Y:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\K:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\R:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\V:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\S:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\T:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\E:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\G:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\N:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\B:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\X:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\J:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\H:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\O:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\P:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\M:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\W:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\I:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\L:	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1644 wrote to memory of 3832	1644	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe	82
PID 1644 wrote to memory of 3832	1644	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe	82
PID 1644 wrote to memory of 3832	1644	0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe	82

C:\Users\Admin\AppData\Local\Temp\0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\0bea8d3669e855e32547b40dafba6fb2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1644
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:3832

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.exe

Filesize
436KB

MD5
958a7132e21cbc6ca8991582cba78bd7

SHA1
a77183fa7b22873f7bfbf0393162b85114025fa9

SHA256
1982ce6b95bafb4aee0d2b6ec1d1d25bd63231d7ac5116cd05e2556dd3f5356e

SHA512
728d897eaee49a74c075dc614fcd4ce9097a4080c1a508bb7b9fcf7b1ee500338586786d070da52009c7bd644d0d3f6121644310890ffc1a3f5ed191b033e29f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
d50c15c7d3044e6290db42aacff908c3

SHA1
898136d735bfed6c7760639a87bacc1714d4e208

SHA256
e0a6d9db7d12a376817e30ab219759ee79f0aeab4ee46f6f9c24a33913d86974

SHA512
5e0765b8705305a30e29d123a264066e5842a198324ca0a1a6ed460a21444d89ea33651ea25df539e0f8d5d7293445a37a718794234585be67da81a242a7e77c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
79c72736c41c1805fc6eb030e6d2a48e

SHA1
5ddfa56a643f25d963464d87e3c6bf2b0f15ff09

SHA256
d08aaf1707603b340733c1483ba3e6d8722a6acb91f18e852582839978e5255b

SHA512
76fcf4d6c80548fb4fb9c47ee4560e8eb5ef5f2e6730d54db9c1dc08c1b4b35e9c454f8a179f2a6493cb8cda27f0c0e9f978261ffda8d5c86d1a66052bd12491

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
5b156a3d8259c4fa7f2ac0be845ff6b9

SHA1
e34300ac15983ec3882bb51a7c2d56ee37877e1a

SHA256
296947bcee82eec5355218d346c6eede145029bd8294a03f6c56ff5903b7bb68

SHA512
d2c019db188b138be83fb671798409ea4233206e7fc3b41e7fe74464b3161b4c4daff2720dbd134dd449f212711a01b00b3def812dd3a33674df3de2862ca833

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b4310ff65441be5c23676c04fc0f3f71

SHA1
098182bf80c6e821ac8e73b39ef8037d31adf3a5

SHA256
0b4e7664a0b8dac8903024ce0226d2a27ab966d537b6027a5487b8b83ad5c4d8

SHA512
7bd26a416f9db435465ff45e0a108c6cc9160bcf8ea48a1fa336b7ccf8876df902e90f7228cf7e8174e8139d0db11596bb946347f82c79c5c8d5050f4e5c2794

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
7e44972def54c4fa2249367311f9d9f6

SHA1
ba11aec14b35d5c1ab7d5c1e0953d16153d1723b

SHA256
58fd880e4ed3848d7a1eff8afd5931964bc9b955433ed7d2a73e24c75ab81816

SHA512
506958f3a7c52551d5ac7e853e5595b3ce68a2208efa3d402a4bedd626f7b5f7e91f5b74fb2281cfb6ed42b58e061ef814f95055c5d3b1aa5d9067fe589ce8e0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
5628b547c91d2f1e94fffce4b4179b15

SHA1
c3f8a52c5897568cbc64feab6445b7d63f0a35d1

SHA256
272ebe2a8d6ec77e4d4209ba9fa20eeceb13188469bc8561dd124e4720cb517a

SHA512
5dceb24b43f1b6efd9e34f183c6bf28eebbd60e5980cc5deaec9e416d9e5ab42c9a53293ad7560fa8057160b884bb790713b1ca0e9f7178ac439b818891b2181

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
5c5ae18acbabff138fb425e6e779c248

SHA1
e16a0459d15ad11dc2177ce46ba181749906cd4f

SHA256
f00330d60491b3ff7e2c439483ffd9916a43e663b8b1b0fd9475ca6a242678f7

SHA512
523f5e0d4ddbc4e0c79c995c5e58972d3a35458aec1c77669bf470d84d2930e41c1c375a55dfd4ddcd19dbc9ad25590e9472ca229fb67bdc68dbf59c12921216

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b8a5883ec6dca31f84b809412bd159f3

SHA1
fd8f195ed6e7bd64b7aa1c9cd81f20e5d74ec573

SHA256
5a22817cea7facfa9146a3167e1c5f7f1ccb5e5f34eb5e27e8bef9844a9a898f

SHA512
f8aa8b2c994a18586dc826a788d661039436ddcf02256cbd319e5b09c6562f53b7f28c3349429af6b39aaa9756675de7a4734b7fc18019a0115b94f05f0ba7e2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
f70a1949d35eeb9ee2adf78899bc0659

SHA1
f2d9856b28923391135e9060f9e514eee5824c24

SHA256
648d7969ffdf66c353ebfa0b3c59a4f3dee60be0e3a4d2c74da491b92a5005bb

SHA512
3c82f8c66ecb6aacf26ecd2b24225cfe7acd583399ee940a29aef658bccc47090169bf8868b115f754945dee8e550c67bc5ffe074c92f765a434080dad85b077

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
9b1260ce3654127306eab670a570e9b1

SHA1
62818c24e7fd2926022974bc729c3936df5bbc11

SHA256
182373fe716b69ce8979a504dd884dfe0f89e50d22997929d4c810fd8adccbb2

SHA512
682a201c2db472871868bde6ebfdfe1b98bb691ece73253d69d61bc1ac7872406385eee45a7717a0e87a5bd0276bb7ee99889a5e559af3064550709bd7a81699

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
65bf7dc65d7b628f749427020dc05302

SHA1
b96b68eac6bc0b08be9f3eb00491dc8ed1fe8248

SHA256
2839f36c5d8b244df84b3aa1078ed3aa5d512a3dbc19193b652197c71e74eddb

SHA512
c183c3695f722f2315f8c6b3f6e2e17bcbffe79d843a472288ecf60a3f5243cfba9b66aaf983b5c9489e89186eac320e98396a047e6ad1ab084bd279bce55553

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c4f496e153e7bada43c68e4d99664378

SHA1
ceada13561964121bb6b7aca9b23dbb676b38578

SHA256
8541fa7372a5c414e1ca03933b1dfc4f4bd084212378b7573ba92a5afc7264d1

SHA512
48477ce43cdcb771e46dafbf4c4dbc8b0601df34b59d5f6d7a386bf8e03b45cdff0ea99c6b259dfbae636b7d382b0dde4d7fa4a05118d71bc63c0e711d0652dc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
da06371ea0503fa3c68c0700a451356e

SHA1
860af5cd35564e691e62b0977b86fd5c0f265826

SHA256
c9517a6bb98ed13b68af7cf23c9ec6b0dd08621d91d7692300ebf55c40d22b4b

SHA512
70b6facbe4620b6d01d86d2d6e2a6bea06ae0f634e7bbff2a185517b3ea5872bca3e80cc49edb66f86f0d0554e14dab6e796895a7fb761a51babc18ce471255b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
a1c13448432e33f3870a0c5b16ba478b

SHA1
83ec7be438b739bcd1a28970912428f52198defe

SHA256
7a0f2ea8f78f7b04d9033c31a0a552e74dcbe1f673e8429776b2c2c819328e64

SHA512
e59f3ee2a4fc89d7d8a79800964bd75a4d5c27f1238eafc2f4bfd12c16190ea6643c5665ceace75fcfe330de726f831a5fe50944587d08039aaa477818031dce

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
f6ea73a2a4b1aa0f379c16ab07942ca5

SHA1
acac331fd688062aec503d2ffb792c5293f5d15d

SHA256
d1df824a5b409bedf69f703831b36435f77481ba5d4a0eed1345054b09f26310

SHA512
79cbbf9c91b59ce3aae5d89fc65d42fe80c876ce1eb0d4cc38e54c5e2a20a3ca381f6ebd7c411ae1e30d86fe8a586ba7925e519bca8491551c33c007e3412a43

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
63afd1556ca4774e6e9f554cdec6b684

SHA1
e93c56ea2413eab67f37819e86ea54977862bfb7

SHA256
59c451088cba7508a26d3cfb95ddd418d84b84f3ad45cdad419a5375ceecfedb

SHA512
df897275792a24a3fdd90ee9afd9da214c1adab333c18019564025cee83a3390277a5ae1f8f10f306c9e48ca7a65af209bb003a357acdb8d7696b36247f0cdad

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
828678c49fa9ced01f1ffedd970e1eb6

SHA1
01f1d1b341eb3a4c0c2a540eb62f8fbf7054b473

SHA256
c1277282b1f4b2329923a5dd8cabf0956e5144f1b78089495c8ffdf026a13584

SHA512
f0fd1e2754b29ffcd52ef1c2c2164cac4a1b99eb44e9f828dbeecd683ede0196e42cefdf0b271e24495d93e352470faaaba4f0cbf6b1c0c2c8124efccc4483bf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
0294d8ec31bfa3df75764ac5177dc627

SHA1
b95872056c18f97f6b2b628f28c5a036f029ce0f

SHA256
2ae8e78af52070734914dfb5c867b42401cb509d90d0dd8c9ab565ce35c3f81d

SHA512
a34f7575b8ffae3327264cd5dcc5ff5e3602a99161faf85aef8f5d7f182f800a4c1d7378d08667e4486d842e7f39bc6bcd56680f31523ccdbe78f0d3bd9ce236

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
50ca58ee57f3adc61f072a5ee15e4f5a

SHA1
5c04447f653321d2d71d6a00f48b2e634be191cf

SHA256
dccea6f5f224ab824535c7cea4e4898080bbc2c5c64cefbf3e89ee822658bc7e

SHA512
18c7fd8751a7ebd2016ac776a16146308e5e5892d2e5a5d5333f90855a76663e8fd9b4837c2171753a5df396147737f6d8487259f6a9bd71b751617dfbe7415f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
f6f234b4f7ca3cea9d5645c3ecf24404

SHA1
ede0eef45c13e75fc1fc77bc2f8291eb36733123

SHA256
202636e445a6286d8ba40da761cc54244b5202caa9cbe99cb2dbb994af6faa55

SHA512
6497e0b9ecd4534394835a599b31ad31cf6b09c31b468c4f6576931aca33f51b339c0c8d3ca17e793507a9c3cd79028267f18b0cf43bf46ac877d26081263ef4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
4ab81052e63a5b94fdc54c5f38a70946

SHA1
bd683b15c024e3536104bfb20e3e342fbd1b416f

SHA256
ca75a546138290955d8b7a29032cf0615c97d91f9b6421c2e95ff23c7ce6da63

SHA512
6e6a7cc9b2a31bcecaed28015811350c200ab91928092864e4c0d7618eb7f8d8384bd0c67939fa3d0ac083c48bf51a8a59a0687754058d06ef3926ec6efb1a61

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
28a015936c6a5b17214af12c077ff75a

SHA1
9c42a145980be571a3d7ba26a733b08862d9bef9

SHA256
2bc09d835f6e93ed7a9dd2026a511ce4be9f331c8238ca8cb1791a77800db315

SHA512
26bf277bc7ddf8844ba21f876bcb9876424e880c1bd97b834ce6629a0afc17ddc8a1f78f53b80c12418c0581801f8e531e2526aeede56fd6eb8e106bebd20d8f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
4aa2e40c11af00cecef4e713de9dc385

SHA1
6c79d7bef823fe82ec97da02d5529c82056ba7cd

SHA256
1bc6d6c5fa8604206ea8d410705cadea222cef99dfa01f7307ee298776ade966

SHA512
e8afc9c989edd45611a8617a072c01596aebbae9e47a804b5ca93ca1db8426aa5bba546c0645ee93b44a814157d3b3fccaf4d1b22b7dada53c273537beb5108b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
cddb667170085ae89b07be049b5c9722

SHA1
84fd530e31f320f21e957f4c025986d28a478e54

SHA256
506c7a49003ac660428149c55b42c274fba12aaefb7fc6cda62f6ffbede6c88a

SHA512
02ba30608597d4d85a8d1f708a7131c0744cf9380eb065f43e198d0550f9dbb8927c263cb1df973c41309480fd43402b781b2b76e9a9333fa14799f6f3951e0c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
48d12c553460eb5097a2165d69ae95a7

SHA1
14c69731b7cb9215d8607a548f337db57c0caa99

SHA256
86457821ad91e70911ad468f02c0b9267bdc28be9b58303763a37d5e00f512f5

SHA512
4bec15bcf169ab7130c9f863f3d8464b5ebe640fc3e5517d0a28c7474389f7655a5be77f7b825fed25fa94e746277210845bf7c6a2670de291f125de99c30298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
60acf5c1c23b972ba534d335ea454dc9

SHA1
ddfc101b2536ef35bf981c7d8aad2d4222f3fa8c

SHA256
82a12ebcf8f3e4f0e3ebf70ef68b205b9d20ddd929404d9394fa29602d8a59c8

SHA512
9998795d669bfc24e0f7f481cb0df7d8c5f19b2fc432d19150a4c9794b671874479df33dca16b00a0a3a59489f3882d5818fc0cfddf4d811353d5039c6575714

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
0bb62c5a87ec131ddd79bc5785950eb6

SHA1
58605bfa601f968bbd55451f71741af4e513812b

SHA256
f6a48a0c492ffdeded99b74992686aa0a9c73ec2e5ead246c1b6033f32ed749c

SHA512
fa13a059965b9fb8eee7b53d8913a7be89cf39f2ad6dbb6ab1529b29c692b570fd54d189d7b1603cb85e8f9bf8463627f217869837c884072279d222c1be8d88

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
d3c30326817fc5d10b58f5a947d97b7b

SHA1
fc7a987e7716ea8debdfd83b730771ea145baa7a

SHA256
8c224f828058a2917efafbc69ebda3dba68cbab52da6423272abd5be98c8a86c

SHA512
af5fa0fdc1d740c5b99c520941724a8b0f254f74cea7fdc78e36ba09e72dd94eb1e3fa50b2aab6c8a650bcfcb6ecafb18d286e8afdcaa32a1f40cbc484c22602

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
a8b7bc6e5b95233fbaa19659137d69f7

SHA1
132d97a7803e53eca4366cd8c2c97dc3fbb211fa

SHA256
76b1952dddf2e8d1c1ef5b92ce98fc486c8feaedcaafe1ad569f0a528ed2038b

SHA512
d7b8d8adaaf409a9f9bb57a2928f72ed21b2abb755d56d26cd1df11e965691888de4528ea5f77c72f529ad2d30ecd9846e8efa660c880ef7899e8dc03431055e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
19d08e62ff656c7f615c49ad31d0bc32

SHA1
8e00543dc5fa2e0615143a65a54ef5e959c5c0ab

SHA256
d6d4a3557529fe7678d0c92653a071ab5753f1dae28d336641850602eb91332f

SHA512
b5ecb9a7ceb419224c10751a2c450f5d851a091454862e834b30c21b09e98f04e2d2757d8dbafa9b09835610c6c65a568b5a75252f8e48f8acc28835b6daa141

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
13abc0aa9e6ced4e0c6c79afaa7d91be

SHA1
d21c65dcd86a852abe1baf0c5246218cf941f8ac

SHA256
42473e880e68d82bca40652ea9f16c87ebec02440dd61b2099de47e7d78668cf

SHA512
16db47942f60181f13445b2a706b1d3e2f5bd23481db48c21d4338b757de2263454d3e237ff3f43e1cafdf9cd62f7636e42162a2e96ce7386e57a60f1068dee2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
0a1388df4a2ed1ead2390849fb06b63a

SHA1
7fb7961174cac5fd361a183d9632a2f8965a8bd3

SHA256
3ed1c8212ac098baa0bc5763714e8977c9dd70ce878c2791ee9114b483c46c62

SHA512
08c6a5bb08a23f14af9f1b2bca78ffeb62eba3e473707b7c8a9ae383895c884fb6825c58e5c3074308b881b446c3a604fee0ca95ae880369ab302386ce891356

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
e3203ed615af67b05316f9b943d4ae08

SHA1
0d7e0dc11170b7c5e337aeb114544e3db3377c7d

SHA256
772117547ef339fefd18b8f9fff57a953ccbf2153a2962f60d7dd669c7988744

SHA512
65fe182511a64a2782493f52829e6f03e8fd245376d13d092735ea22651d6385477fb795381471051ded309101b287f522d66c55decff27af2b8b274a1eac13e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
1fb19e95f0e99cbb6f9b4dddb5f2ad62

SHA1
da3bd4478845cdcf93e8305ae4e0cb4b38cb353f

SHA256
7f1986bea154dd782b8c12edb98f1f34058eeaf3dda3f1f338561019ee60068d

SHA512
e7084d013c7234ed1b9e4d3c0bbe3d64f8da5d033d46edd47f4a8763820ddfc9bbc052c1caece18d671fc03b971ea9ed06af6caee7cf10f57ddaafb47683d9f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
1d009d201f9834aed0e5409d72abb4c6

SHA1
1459fd81e3a2814cdda4e617abfb9d826db2b007

SHA256
eef03cb75042af0796c11e16cc0c051847c4f5119abf089b76430acddc4c983f

SHA512
b76d753d8365fb351be981c8bb019377c7a1cb4cb2f5e616dcc37b5662cfa3f0e3ff7359254848d60121afcbc8550e230f5870b000e0dece3d24fc8cb99da980

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
40cb2fd3eee3e004bf4f80a9ab266337

SHA1
f3ef3dba0b8e92b42e37d5665622cc4e49bbcd4d

SHA256
6ea961a5219312c2c922fc58f7401b1301c7b036b29b9b7c7d06723861ee335f

SHA512
56c2e81e3e7b82580af4fb473a5267319ee26b01f3ee0c723de1afc291ac2e7a90056a54964fdcdb9f8ef35dec3ae931c5d72d591a69bff7bbf29e13cd46348b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
503de047ff5dd350368446ab39d80b15

SHA1
5da437983518f588d23ef09786d51269d3472e63

SHA256
9a287ab54972e694566f039e7b2585d464c5fccc2ecb4f51da021a655393fb76

SHA512
d21f98cca13829e39dc0cd157be3889ff5531b0e8667881a9c383ba08bc6011a097b23d0c31182c32c41fc4aaa8aed5eae38049f69e38264c98fa6b52c6bf3ab

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
b3667aaf543845af1307db2a886c46b4

SHA1
9b3642b6ddff77d95de42721660c3bad02c97a30

SHA256
bd0fa775d25d16702c42a76abe6672fe6a9e2eff85e8b34c5695fbc8b973ab6f

SHA512
41e962b4fc80ae826e11fe1cb9c545b0f7858159aef5fd114f95036b294afdb198da20d7c0d224b0851ff4a1623bea5f72ac294b89299419eaad28c14a31438c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c458a6b05637db53116f349fcde1385f

SHA1
2c5d5b9277ea4395d5d95d2f4630bb466ade8d3e

SHA256
85cff2331e637ee8c809fb47825abc337464f18e653e0424b17d2e123bdb082b

SHA512
c3f6972607f074f1989f14323146a3de25f4194e47ab6e69e65eaacfef7f236dad809689cc1a0c6cc8f0c5c5b59f6345a1eb378598dfb7b41bf20bcbbd15e416

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
e4636cae56aef219e1bde60b2cbe5dd8

SHA1
2393a6d3fc1cc9cd3c00a59cad0dd8bf6fa39df6

SHA256
6c5ee688ea0a8dd982bba9d9482d5e3fbd2fe2bf79da3763c497c8974a3baef8

SHA512
3db1a746f3817d5e6b671bca55eb0880d7be71a65f889b22811fd7675c48bc0b9f36ed613a952a0b4b2740161ef1da54022fca2f56a66ad82d8a87ebaeb7d898

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
fe284e8fb88103821f45d54c558a0406

SHA1
922a017eea5d60a888deec48fc4c80f3ad940d67

SHA256
958dcfb8547d1ad87331c0100827fd03dcb501a8e3ec26cf7a6e178a90aba0ee

SHA512
48e4f13cd986a5e950252d977701a2d8ce0e47f39b7cd54660f093d6f468f276ccd73b40676f2769639ace75915f2916d047164aa21b6c01eaffa72319a32da6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
ba0daa87ad036ba606e76ea37be50b63

SHA1
c6b694a2ef9f6ff620e397d733234ab7828705be

SHA256
6c1e368e16c3c63e1a61c94c90ee1731a3af636e102b759b4b6f5a2a566a73c7

SHA512
8ffc2ad055cc4fd68b5b59bfde3ac7e5dfc45b27fd138700fcc2ea31b131bd95450b0b64b3280557187dcfafbd9ed68c1af6ab1b2def699fa26b60b230785928

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
f36333061b4f3202ba9be69debfd016a

SHA1
6c007c5b99a37bbc389cfe82640aaa6dd230ab08

SHA256
a0aa4fd45c592c4509492cabc6721ac655f44fec2e9e3235e7c77747b9078065

SHA512
70d313d84b1a867ce2ef4ec07617e6ea50491716bc193429020235f0a45486d1ffe3328ec17fd603ebfdd5f20326cc4428aaa09079f4832cc04cd34234fba7c2

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
0083b0c352b19411d33662ebb6ece4ce

SHA1
4c7766769338be93cca2bfc755900755699841ba

SHA256
a80a008b8e9c927c07e9bf35c1b5bc73237c1562e4ac675649007bf7e84cdde8

SHA512
94e32e4213e36ed3703fedccc4b494f936a6bcacca8ae2efc4687c9d9c4306fe9f3b21038c9e04af58a7e6f8f4076ab7698f172eab48f7f3cc37a6d5e09f18a9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
777d8b82f5e4d504e3238caf54cfda33

SHA1
18d699f7a04f791ed383bdc9d260ff1523cf50d0

SHA256
d218a7b7f4f7f5d86212cc29c3bf16f47b39cdd073f483347cff9df2c26e7978

SHA512
ef2bb22d41f175bf01cd1fb8ec1925378cebfedf06d0aec6d4e93b9070959a5b0c2c74966c6f170c3884e91b0a6e383d126bc5a5ff00d65048e78d12d1bbeb7f

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
86df763afb818ce7249cd1f58a08203a

SHA1
bdd3052eaa7a16206ebff95c5035aba26d9423aa

SHA256
68409bad3fd9d66d6f306457b037c33139f3fafeb12dce4153c8c5366ab556f5

SHA512
b96ba363c1c06a616996c886c661b2e17dc5ee01b18698461f436438608bcbdec6f3a9147d342e6d30966a09c0c322a7c483153e3e8e0be910004137d26ab835

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
a064c67714b863da7db5ed4bde203e6d

SHA1
4428c90bda11828459d6322762ecafe35e6f0b84

SHA256
5e0fca156a24bb7a4bb5bc1fd14f181957405dd97947ad92a11b1fd3f4e4bed8

SHA512
d3fe73cb98a5befe6314dc622b03f29167449d82ebf7ef8c1f0a375e3f033de37f7b0c3df79a6f50c93d197c484ad289e6cd608f3af91bba4e6f58724b2daee8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
6dbe289090d20ca16b1fed072c788750

SHA1
9931fc8dfaba499f3cd3afd95a028c65b3d36bdd

SHA256
af933706a2f802d9661eafd55f10046746edef1ad8e21d9cdf32c03be106483b

SHA512
5df9155c497ee2da1452b92e783866095c039928aff62b3f36ae726be30248a86cfaca6d88ac0a1df3a8cd5be1432376392d541c9c3dc0ceadf3cf115f78ad95

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
263efa2c9af99bf8d7a70b9c578fb5d0

SHA1
f4598ec6fcf72e8a11f5514ba92ecd1fa07b02fd

SHA256
89db2d6faf63bb03378a94687b917a023859a0fe1807573bbce7af04669f0447

SHA512
54162c04e6326882a702cb5b7fbabc43ef892cf67c29220738d34088ba75453e1426d80679b56cd7411fac1ef9814e4ecb69b7e7bcf7de4466e7f3d6a9691ed4

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
323c52ee7b5c28e0b9c6f3d749dab08f

SHA1
9f9f88136f5d71cc5aa3ff2dff5faf191e8de845

SHA256
3f5b26a760af7b4585d81d464652a21fabc8733e33f69ef4af2b5811b2d9c511

SHA512
a132d048c1b4b46b94cc9aa749679b3de083634bd452ac4547da834e61878b877b9bb883567e5ec1b1093c88be5555764a0e4db611f8fa4a79a91f6397a085d1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
203592eb26cf7371968e2e405242d400

SHA1
8158b7880673ceabe3ade4fd25f191cc65e6f2b0

SHA256
2e439b2678fe9790290ccdb3eb039b4471de5b98d979387c66a49231ec8cd20e

SHA512
148abc0c04ae46ffa9f2477a0a0efaf24d09528c01e012ec573e3b6e353809c87eedde1647b2f39506a5eb8774d6ba2da56daa307c754be3266e05e25be5f1b8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
5ccf5816202991abb66dd2d9f401fcc4

SHA1
3e3aff126a5a03220c80a41ff0d8775aaa5fef93

SHA256
7b00c25c86d6d078cb8381701a36c824c7aa0ef5b2867a283baadfebabf4ce0e

SHA512
37ab5ed25c3ff6dbb2d813b388f4ce8cb21c32961e6501304116453536046380505a8f6916ebeb8d6adb20967014e23d1276d52d79ccacc4ceb27fb0007d9dc0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
0b6cf7f79e4676303dcd7f436af91260

SHA1
1bfdba720802507f306cc777217723ae6c6a24da

SHA256
f86ec2f82e0f3e56ccc7d6e4c44753bed40105e6f45f0a4a3d72fa028b2bdce5

SHA512
11a9c576a0bd3cc6671584aaa7106d0cdd9e52f7a500e9f14ce57fb607dc6ffaad730198971bd25be6d0803d5208769ee8dab067ddfd7c859f6a40609a378d82

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1023B

MD5
3a24bd7be8e1d8fd22ac1b63fdec0980

SHA1
0d81e57016a4c7f8aac456801cdc44c11903ace5

SHA256
378d22795451ae06b06b72c9d668d9b7576b5a213480fb1be7448c60001c75db

SHA512
e3f7f32f5ca99c57394aebb6d848e22043ff869dc7df3dd6ab5fa19cf9641f930f29fdb6ee7526beb6b117483a2b813a5c795224affae7c971cd86479a64307d

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
435KB

MD5
73165a3b64fea356419ebebf93e78687

SHA1
bdec62cf2d946543a7649262dfdbfb595402615e

SHA256
7d46374fbc379a7e4d878b80f6f97fd1e9f46539f6d21e8c6b89dc650ad06a08

SHA512
f2ed454fe06253c6804cd49929bd15ef32d4e6ae8d529b2a0fa2fc409b179c36e161c16091f0cdab951e1ba0892847ac5affe04ddf7b8839bcd77dbb58568f0d

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-1194130065-3471212556-1656947724-1000\desktop.ini.exe

Filesize
436KB

MD5
58cf94cfc2489c107c7fa9adaec51bb2

SHA1
836cfd444cce86befd5baa45a7dbf96749ed56ca

SHA256
f9c46156ec9274323945ee97c716ebd064fb59dc026bc7f11c00d8ffbe8596d2

SHA512
15ba832f5e8ecb0586978508c684b04986baf7730a0d221692c6042d5b50f6e2eab55311172d5f0f0eba2edbc94a428421a12008876665c2e2a0bef00ff244b5

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
435KB

MD5
0bea8d3669e855e32547b40dafba6fb2

SHA1
82e7e06a3005489895ec9580c7d466bb7beb35dd

SHA256
dbc40ebfee3142451c4f99972cc67e9d2b112419cea76cd4e547bc67928a79c4

SHA512
33d8851ff99937c92efe8ff248953fe22b42d101afacf223e174376ba065e7f9d4cb61f99cb34adaed1f64029f843df381bcf41f17dbfbb98737ec6f20dec393

Download Submit
memory/1644-45-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/1644-0-0x0000000002320000-0x0000000002321000-memory.dmp

Filesize
4KB

Download
memory/3832-49-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download
memory/3832-5-0x00000000020D0000-0x00000000020D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads