a9b94093b5b8d953f43259f470b79a56b0582fd856e56905f831d5d94719ac93

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08/10/2024, 21:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
Size

9.1MB
MD5

25d7c9ba82bd909ce4224177a87424c4
SHA1

cdbe6272122b68ec2d666c3068733b3f17c1941f
SHA256

a9b94093b5b8d953f43259f470b79a56b0582fd856e56905f831d5d94719ac93
SHA512

0b2f205f048f7c4e691ded300176fbdf40b1413f998bc85eb1fa1d5d239d8c55a92dd65965350f0ca1ab9ae5cbfea81a0ffb24a3df715ba5f5a86b2d2012cfa5
SSDEEP

98304:PE2cJIMzKpXOMGQ+IM/E2cJIMzKpIkMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMu:PnwI2ly+IunwI24I2ly8

Score

10^/10

discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe

Executes dropped EXE 1 IoCs

pid	Process
1760	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\O:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\X:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\H:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\Q:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\S:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\E:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\G:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\P:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\Z:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\I:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\J:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\B:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\R:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\W:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\Y:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\N:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\U:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\M:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\T:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\V:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\K:	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1760	2028	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe	85
PID 2028 wrote to memory of 1760	2028	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe	85
PID 2028 wrote to memory of 1760	2028	25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\25d7c9ba82bd909ce4224177a87424c4_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.exe

Filesize
9.1MB

MD5
85b22acd1360eab0484a6f24396d460e

SHA1
267fe8f0703154eb3e0215d3bb718004b240b589

SHA256
4bd41154039bc360e350abb45971cc8a7e07d0090d227a0b9c852f668cd3a6fd

SHA512
d59f78155d0372d0b617d258b52742de41f145cb20a79574eff1d8886cc48c0bfad707335f3b3531f9217ada52d77e4b437755a105de064794b54b6b73f2ed41

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
34689d94fe05f64663cae677e63bd0fc

SHA1
5fe65d084e912d8c1ac76b1407016066638b9840

SHA256
9681ffc2700a9ad085e66167af6944720f49c127146a281c14fc1e40a4eb37a8

SHA512
bea285401abb6cfef797f8fe76e310fc7f8406b7e057204da7b2a44dfda54808c7de71dcf748bf76d9d634cfad3691a4350004556ddfbce4bbae6ad0dae13431

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
e56184ae21f0e42b8ccb373c68641f4c

SHA1
5679a2f4bfc053086178f8303512d3c99a012941

SHA256
edeab96fcd6340f85a1c9e0d393c38ef337f2816e4854c35312888a31bd8d3f7

SHA512
d59840ce344464c3b065188c9bb48b106e49a315b5b84bd612051e658e6e60686a23959fb91f69aff62414acb3fbe40458a59faf3432bf65a08da20431533734

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
08da6c72cd5240d27926a16b7198f1fc

SHA1
ea8090672a080643a569e9fc726aa938e1490550

SHA256
b387eb58ec9c547a9be5529fb9660d1c9d9ed20b47b44ec61f61027726c012c5

SHA512
f37f42f639068724b5cc32420cacacdd86144225af8a54d176ec9b64904bc47298619155b4ce315d5826c3b70be4f4aa0265e74b8494b459668e68828524b376

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
08e7eb2096d28db13b1930bc16afc339

SHA1
e44fbfa6904f7bb3dfc22a06d65a6cade3b800dc

SHA256
6493ef50cb1f5068cc94021a259ed62b15ea6fabe64df4777f9a22e03e550146

SHA512
4a5d11922ab0e208f15e04b2a7f411928ade5fa02a02a1b001596059ff2f8ce7bd477ed0134fff418c600c3c3633e02a93c4614592a81bae03a5fe06f75c472a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
a58dad3b428a2824ec888e35e4bc9cea

SHA1
ef00054c73298bb7e1fe0f55d8e24a9e9b6ed015

SHA256
e5a70aa55bc0cb39d0fac09cc9997d77a0b0c8d5469e50b43be369ea50fb9d9b

SHA512
c4158b39df99ec56ee14c23c74aa536bdaaf1248b1c7cd1eb0fce2ca0b479937fdbf3092d969835a6e71b55c1dca6c4bd54a47266b07f01157216db1180105b6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
3bfb72b2fd4ff337f95945e5f60ca29f

SHA1
771e2faad29f437940a7c61401c516a3fbd327ac

SHA256
009960f683966bf5c5aa0c86b5a0e0d80314dfc36e0c4219aadb4f1917e1362b

SHA512
d91f613d006d06b81d05abd68a6d250a7b189597f5b82160eb257a2bf4dec3cad8999dc08f0ddfb94726417c5ed2378e420742120865c36eff664a870e761815

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
337296dfd08a73baa7a138402c386651

SHA1
b6fe309f825edd40cce73cee223843d3404af4fa

SHA256
7f83d61a7de06684bac037fffdfecb5b331801db989bb92dad360ab48afe197f

SHA512
80b67cce2159c8d899948b02ecbd750fe34953fc34f959ad12f7d3fa4bc23b7d15f1dd2c66cc5f717b38869806fe270923fb560c9fbba05392845feb92ef61ba

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
92755140ced215506fbf1566d0b7e816

SHA1
47d56aa6cca2d604875a086f8d3f75998711db08

SHA256
4b44e38b893425cd1e80e69f7e9d7bb2010ea71d628ed91347b335bb9cc12616

SHA512
8418184c59e9ec962e499c33bae931a19a653a7cc47dea6658729a289dc2fab298e52f604ca6b9b25735dfb1666bf130a5059e8590f30baeeb47f148ff3a6875

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
c2a1a8e4c7c8a1ec2525ab197783b011

SHA1
80586749ce95c20b3bad580eae540d5390430e19

SHA256
267716cdab19744f1adbfa5daa475072754b164290bcd541ae0835a6a8bcae3f

SHA512
c6571f508d05ae4fd137fbdfd538a019bd83df272337416cf85b3a6b2af7da324b3607af43e516e91fe4fe14db54d9676d82f8f740f7fff80145d0d76c6f5298

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
e964d8ed1f222657ca4cb203595341c1

SHA1
fa083cea1c49a978f649f5fc16ff025848511c26

SHA256
731e61e9ac7cefdc0883c475703bb65ab56f64b0cd92f8c38b696f493d0b1a6b

SHA512
0095fd0b14c3991a075a94a512e8b4c00b5eb7ebf57e08e9e224a680dbaa089192c4fe25ffa0de22ad62ec945a671dd540cfe6cee7f800f498bcb112315b0a48

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
b4621cdc15bfaf40596dcd0b110385c2

SHA1
e825f61c6ba450b88a447334f20cfba5e11893a2

SHA256
48f800b86dc4219c9ce1718cb5031931a7335d060c1142a07a2a644438ac3680

SHA512
7eabf8ced6db41570a67b1aa6d3ba5909fbb8c17fc012d682712eba46a1e836f57fcf86658dcd8d495859088a91ac59ea6e1159c76c06a6c1303b3552bf1ce1c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
bb27c591aacdb630a1c1a19e4fd5fa3b

SHA1
3461b345dd970aa26747d41a0d70554909ccc0e4

SHA256
08cf3f65dd8ea04ae02fa206dfcfa6135341b64d8838425e76f88e1012a4be78

SHA512
9d4e188c8f1b508ca0a8c483c6e0829d28ef078d3b8deaad0e4526fe3fdcc62c9d7f2de4b19b86c0c0abfdd3d05594186b0e68463be5abd78beee239c0ab2435

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
e0d25b8d0ca9ff05753a73be9967dee7

SHA1
7e99066ed6ce374ccfe4e4f85eb057dfa0d343cb

SHA256
5b3e3d3ba108b69056153e0048faf9a0048b4ee0e8b4b606b715eeab5de41a90

SHA512
097e88229bd852320b17d398bd88dc7f6903415919d5e86060e8900382b3af2a80b2c585e89066a59a6aa6465aedcede9991d60073955dd718dcb92b238f2df9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
1c8bda683866187520e398c26c123ba1

SHA1
fe3111ff8c4cd41f41ac2ff8c8fdb06f38cdce4a

SHA256
147e846ac0653ccd5c82e6a0c618ff95ce6b78248f6fe7385ece7ece3ec32b80

SHA512
09d10d554a3bb115919f793ba56d9cc9b3d560d5bdcd9b2b53de8c28ffc694a92ae446d63826f2289ed1a96ea1de4db8eb5a7a71e4eb06875a03455e1a6f5e76

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7c03af03995d330107c1b8399e3491b1

SHA1
2f834537103e0c25cf68789a34594e3c6192d0b4

SHA256
7cd6b2ead4774b9f6493ea6d7c78cd186a925f2e4b22cd91029ff81cce3fffe4

SHA512
f3caf95b404101730af79a2fa97a9f7ec2cb58230dd0821bcec90fb89f3319b6ceff833e7d6714d1aaff8fe40ae5c5b8bcc8a973e29781142d4ddd552a48babf

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
c32c41991d19016ef599632a71229828

SHA1
e00322b35e5a9e1fb0b9772547d2ecc4de1283fa

SHA256
2cc3ac4e07e34b42f498485069c7bdbec72e68894d5eb0354235ca1905e1a9ef

SHA512
ff725edc1b3dbbcf52f153c2984e601bf77e584813b941255d8362807aab9751447b89385afd3862005e906976d790106106084fa50488b6c5a9fcd20f1bb992

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
e9e9d74656977bd40d876d19f3e38fa7

SHA1
0fd786dc41b7c9de412889d0e52cefcd48170524

SHA256
984a4305a5853546a23159a577f7a817effe5ade6e5fb8a0331cebbc65ba4cc4

SHA512
d0a3d69ded8f73dfbe5e6918667d96fd1cf73a9d9386b8e58b9b5631b1228a8faf6d80d013eb3f78d6f60f14ed18d6d707990f62086ed927403125ceb561ff62

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
32a9c5245d18b9f834e82cf2e49a6a52

SHA1
7933287461dbd14d862dff78cd22bb658359423c

SHA256
24f14d5f862e0aa26437727d044dee613799cb48125e4a9818810457f53a5bf0

SHA512
a322af977e36a3780a73b019df6163f18650813a4d722536cc921c77b5ed23d0d2d0e098ae4dd2bed43d876c119c8835f44d712418fb25ab435c06228f3da2e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
8cd29f6b455c4f812db26fbfaac43992

SHA1
4895689a643b464406523869c8713d247130890a

SHA256
196409875476db93ada764eebff95bdf3c41e284afde4a57b86947ceb97af743

SHA512
b79fc5fa79424952b3b6841f2035533c91b15c17f73501df344c255f1dbe69e318b26d844c796e3723cc07b5b1007b6a9085b328503e1f263f5214398a27ead6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
9e0258367d3081d5888bb23cf8037a49

SHA1
a2b50833facddfc2327ac44e40665e2118ef6b43

SHA256
992afb88b2a09d894679564d3736f23975a27f30b0980c667ca8f7125ed8577b

SHA512
e061df3104a730bfc147eb66b05c10e68ff7d5d7d6dbdc1ba0ec7497360ee277b5a67e3c00f3f8d9ae4add15f66c480a3e687e4ba2af468d095fa972da7127b0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
06e80feb271e6d14c1ef725397bea491

SHA1
0d78b795de669cf78e5ddf8cd9176c6bb555e244

SHA256
b10cbdd2afb46adc6605702d6e45a98b6a991a6010970d1ab8990f78bedb36c5

SHA512
ddd2ee8f1d9ad8c0072532b24617207a236482bf18423197ba14909d7d06e769c473c0913cc1f8f06bcfcc3614da094f8820d5652c498371e8565a1a04626824

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
b1b20ccaca194f7349ef334ad2626961

SHA1
ccb48598eba94509a2f1526cc62f3aa4865fb724

SHA256
64f60919eb48fecd146beedc9bfa29c8cdec47a2cb13c5076eedaf710e6f8356

SHA512
e712666ac91c3cdf0c51b8eb0481204ff84e598abbbc11abe77bb94c506d09c3da077d6f134e579578fae763e05a634ce9271d786e96ca7aaa5d04c39fde5531

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
ff0eed829e4fa4fa4da41bda2b71f7a7

SHA1
f0ce941fc74e3b9afbc17120ee777aa6a6c6099a

SHA256
0ece0afeb05e6e36fa06bca168b8747a20e765c1b232e8b69017e9e5d9f3ef79

SHA512
ff2f0e144e6bcda707d4095e58e74f0e014ca3e3f876732ae18576c9ea31dd62e70c4e8b98698867db49ed13e3203b3f510c8f4c2accaa6ba17e3f3715a7d581

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
39d161b779393b0190190cca00650f1d

SHA1
56e31d912fb625d8cd47b23d5a22b32681799db4

SHA256
86b174b70f6094e82d6bd9499231043048404ed190a3c1f71d7061c64cfa484a

SHA512
5688cd1a15a39afa4ed2ca02dba40dd83684367afcd1bb28ac4ea1fa970ab73c649115fe09127a0354181877a252949ee79c463a79f3cf930124db487ad92f02

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
adbfb4ac82022a108818226c480a6c73

SHA1
7e7f6a8905b11b5ef5666dd2c04250c4e8b675c2

SHA256
c00b47e88592c9002dc1787de55f7e99e2e8bbc29725d6a0de58053cb259aa86

SHA512
4e0039d2879e51f90d97ee6d51729c280279afe34522a2df4667d318ab9cdfb4c8a9aa7602aad40daae7ba2b21a9efe0d638109820ed688eb54f0944dfbf1ba8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
beee4816074a77b15e171793d8ce0e9c

SHA1
ac7ea01a9e79275ce14aaba68f67110551f1c3b3

SHA256
f9c49c7f6850157198eec12a6c1f84c65231642710c55d1542a4340e2815b0f4

SHA512
52d05b28787d30011d3a7e27d7b74f2cd020b26a010a3f29274b31dad59a36d75992fbaeaf82e254f3cd15d08ed978e3027dbc0c3710fb320dbb5d7294a4fb92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
9cf379cacd26f187b5f2d759a2dfb0cf

SHA1
39ff3cee4c7121ef5af2992374c0db4be5df1474

SHA256
b08baafff5ae9e42a18a6a3056a1b0745f52784e344d59f9ae31df7542059531

SHA512
a79ac60d89bd99daa3f364844e6e653dea2c4de5e0f64cf6f480c0dac532d93dce3a907811f35244083e6bd389f618fd640c31b439badb90e4b8f8c79f72a41c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
44ba4fb54b827af10e526c462b13a248

SHA1
facb8d4ad190763835c84a0906043ce1982bbb8d

SHA256
a906867d2dbc27d765b3353e78db1fd06ec4d2151148338c337edc12decb91c4

SHA512
4b047f66dffa0ee67f5d0670f3b30d814a189e9d3590b91296a24907a46e78a6b80574942be084420aa2166777502d80edbb0e3d53068b77eb6a34f4336601a8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
057ac03f4b6ab18dc2007e7088233c63

SHA1
d0797b1afa05aa6f7af89131fa7fc6d24ad88067

SHA256
e44bd6ed7744b9237012f85e36c704f21212666516cd9ace8e46d4011678e2fd

SHA512
d353bc3dc4e11ddd4b3272c0ab58b956dceecdb57207cc82df17561ee1522850e206acf3982e18bca0d29d38a24a8fead9be2c1c0eb5e320bef942338f7243a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
0f5aaab8f59ed96d2499a98de655fc73

SHA1
febaee37a4e66be6a1fa842b6322f96d7a20a255

SHA256
15a9758da1b567a52ee15941ad840d8b63739577e87b7bd0fc486e00095f674b

SHA512
c852cd162800fa3cc3f436189414d16a36c73c35628e0c5e80ea331d349084ae2df639811de33e1d3f7a0dcc99cf18bf7a4c1e044570550d0dda1e3f2990ec74

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
6a3c101413337642d83d782d33a07c12

SHA1
69238bc4e41b6e2fa2015c1e7510ba9cca2531ea

SHA256
adbf7c7fa50bfca20e017bc13cfe59f5ceefcee66e8a234ed1bfdc7ddf7f9357

SHA512
d17d70218a00af6987de982eb10d9010cdacd64fe7c1850dcdabe29c11e21f2766bc7da2fc5f7ce64e1b443ee193a88fb743d8d1cb5705439cc089a6bf5884e7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
2edd8c7fd7b0522d5a8d77079ffc9dc9

SHA1
5ed033674a7f296afc5c46168557dcc4ea2dfe93

SHA256
1ea3b98107f6ab14c8013350b41cc0b105cfe96c563c352613fe6e6cead3dfd1

SHA512
a338465ed4c57b6910630b781af783b3751385615d1289f89199a3c3d3f9a405ce54bb5c3f4479d86906718a7a8334e3b8b32263c4f5e4c0c2a094b2e32265d5

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
eff047424287da3a6fb4fa00b2358d43

SHA1
192803b58ab7092b69803d6e2db16240f19f41f9

SHA256
31fb2f4a066b5582cdea1e4b4de9d6d12d59f46a2231837808230d14d6b85c10

SHA512
878245144c259be6f47ee985001c73b8a21867b40f679a19fa4f044fb9e2f25761d8aaca9d8c2a3a11ea229806c41b45043da62ea7775de3f7899f04166e0e39

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
609944a71f909040ec39ad71a18bcf97

SHA1
f2a70a15744baca3f188318e06367cbfe9cbd3d1

SHA256
defcac21443b77bb1ec70b64f27bd4af31ed51f174dc689084f48ae369795425

SHA512
b9322bd4397a4a0832d7974d8133b36c52cfa80a3081ca9e5050d034da0023d832320cd47949b53d9778fdc25e1b279b2a26fdf91572e8c4fe94e02eaa3bd89e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
706085dd4f16af5676544baf4542b70e

SHA1
56eca9fe167a7f2a6b53dc8a4eaa83fa07bf9c60

SHA256
80b11fd34cbad544bdd14f4289c7f49e24200005e745ba2c603b91b0fb2d2484

SHA512
ecc9f1310ab0f983382d53db1d56c8a7af794a26c6c1bb486eab5cb48d898403e8bda83dd7a093e65daf1fa3934be9f27bff79cc244a5fff7c1745cc1e1ac159

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
4388f9ff81dff9654fede6a24ec6fb98

SHA1
1f8609a4283cc76e7e06be200e559871a9cccc48

SHA256
a3303f1f60a6ff82bece81254ac86fbcdb5ec860b10941fabcff57543e819c62

SHA512
919f82ac9435faba68d4cb61219ce3eea83fb7afd3e2f0f2a2d1b34f3d59a0844803132ea90cf5e47270f553895d0538922a784ddbaaafbe4250a61310af9593

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
5d627b8920af532a6143e3fb00c87beb

SHA1
77cefceb9bb53cebec4fad753abb75094fc21128

SHA256
e5b3526f8444a7762b83bd55e2b7a1788295cd285d3d269563a2b5979e37ca7b

SHA512
4fff93387afcca093bc604ca05197496c56aed122102098526f35002d1553de4f24921ee6e037430967c10d613ab8012f55da66b451441103f5603927a87974d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
2670738c1f8853b25f185253fadbc760

SHA1
847bc1694ab63bc8e82da14fbc006a6a46d3e4e4

SHA256
4ee91f93c76484f9d179ff5244331a53a28051dbbb3ae21a5eedf0458ab58dd0

SHA512
00eba45eedcfe1956ad53ce4b9f9741c07dd0d410a8195ea1719a41e406ecbbdfdf8b8f343768d86a46c48eac1b9486b67c407568f2a7739305068dcb89fb528

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
28c3d8992198ccf64946f5fddfce0c49

SHA1
0385af27709f85d20e32c6155259171faa870698

SHA256
3d8cbe69142c96c5e4f2851e81af64a01c10864bec9ef23b333c3b1eaf66ff14

SHA512
ea4c2ce2e9e96d00a3f4e0035d81568598d8f99ad3006bdacc03d718425d358a7e368c186429ba029b09ae709527a8e53c070757165f5f04e608eb7babcd3719

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
93cef2edd15f7aec7ecc360f1a35980a

SHA1
051a9a89dddfea75ab739d8ff9e7e25c13d06441

SHA256
e9da96dac53755fd2b37c76271f3d748e98a7292374893a81aea198c99449333

SHA512
39330b3c7ca83bb67291e19b90269ac430976ec479be7a6f1c9f554b6b793cbd41515fb979a75691fd7ff53676f7254093329e767f0be8c28a8624bb943bcc8b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
92b6bb1db665d91f22291c834dce4bd2

SHA1
ad9e510ddd29546afb158e13a833d8d34660f1f4

SHA256
7d3bd4de565148e0206f129f222fe889e7d6141ba8d77d57ffa57881a6e6ed43

SHA512
1d1197d5e2465935bf7be2ed6b5a68b87c2c706a26bb37ceafc98e03db6ab4ee8fffc218e34b0018f5deb229619ded2e936823c941e823052b5b50b23a815c4e

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
197f65a3d6024e12832f75f2e63acd79

SHA1
119f9adf8b5c8effbf05240291c4c620b94ed66a

SHA256
51ea45a36219e979061ca7e226571963175542335c2fd3114980ca11abf0ae1e

SHA512
7f3aba6559579904182cb5bae7c318a5c55ff76204b71791d5acf4e47110796a601c86fb7b2483d47e6a50e6c792492e53515ca71a2bbc29561737bbff5f6077

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
9f71c5e684f865ce30d0a35ebdf92e3a

SHA1
686d438e867da87d4faeddbe4770e7beb37fc05b

SHA256
1305bad7a0e9ec66c05923680e5f5b587230fa5a1545fee05dfa01caf735ee2e

SHA512
3007ea85d54375510cb963017275daa483e4e070137c91b34f044cf88e501319abfe438262f51a439c83da6b17b1b2f133fa0636f66c29639e75f465922767bd

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
fcf8cf1ce19dbfbfa5db863ccd7359a1

SHA1
0f78ec07463168a1c3da519944d029256b1be1ee

SHA256
04e5db801806ce442e3045f1c6b270654cad4a3b8e422223c70002cd2aaf2fe9

SHA512
78e08265d996584bbb2995fe3f8b496277e94806904f9b614dcbb723d312a6613064cd7e2745492ea27ed0a567105f812cbbd366aa3937d23d6be2e9d5b4c2f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
948e9271a0aa85784cdf94ab7f928b54

SHA1
a09fc0100a60ad4691620b1075b0ebfb41e58165

SHA256
66509f94afe59e223cd5c00a1f9c4a6e0ded5e2272b1c540d3219ad71deb680b

SHA512
5bb474f115aa9490d5f7e5571ae30e1929a084ee0528dc1460b040baa056325a4c32608cf6b6ed082f74720e9d7590c5abfaa5b68962082b45c5ca13d5ada520

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
c3032fe76804c50f515bd1a2eaf6a362

SHA1
b1ad1eb3c4bd640af80a730487db3bcf4670cd8d

SHA256
6f1b9fc02f8fb5b3f7ff8fee652b9db766e237e498f1635c1c79ba3f673bccb0

SHA512
b0b2a725f4a45a475622ec610e6a08251dcf0393f0ce7f0d0748491321d0f9bdf439d07d7628ec9b93ffb0fb281c67550d2afa16854c4f73da0196e32e1469eb

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
7dbc8c1bf405d071d7dc88c168ef6022

SHA1
0ef08843c79b22865c3afc6d03ceab76acb50d17

SHA256
effc865ce893448a3233ca98ef369ec151012df2c0e93abaf568542cc5d3c505

SHA512
f02536cac07426900c034b282c24a6b6b811942a2baa6175bbfa246c452c36ba53daf7189188c9038df978da3e1cdc271182ccb8aa49864a2f851aa10143c085

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
293c273480e8c69fa5b904aefaef38bb

SHA1
9945db80f5b560a59dbdc72d13be888d030ecb2e

SHA256
5750fce6068f04fa548e9b2c4b2bda5fccffd955bf23bd854c6d5d1a53ca2c88

SHA512
c32fc120c8369094ccf8760ded117ac0c87a2a740df017fe2a0fcacfc9dda9fa752fe270906ff187adbbdb93213594841feb4c3c1f0a829fb7b026efc6659e29

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
8bc493dfce0771a36e4f0c169fec7bc0

SHA1
01706674afc06ac2089852c2610a93fdea3cb188

SHA256
9f5f7679e5d491f05525cca2a275795a00d548299cccdb62fc0d892a4d96d255

SHA512
b6646f6a4b378b6d27f58c38e3e040cfe1989e8d8ac5ff20a4188dbf06a740a2c009e3f62181f58da32a96b1c6c7460d3cad9ea76421f2b3dad47cc53963e586

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
146e2a4c9490d640c2661222ef15f9e3

SHA1
435bd74e2a32e54df7cb1637adc0e5695352241f

SHA256
c6b7cc8fc2424cf0f3fb8183781477daf531d5a4766fdedadfbb1c301cfde3b5

SHA512
a03dcef2ca61d4eaf150798d729653acfa528c25b91c4c250e9b76aa840f424fbe57f156d52327fbe0cb584e3a9cd63652b53784e81303b79290bf5727776ed7

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
5fac3d1d3ec2a5a2216cd6f2cc001a16

SHA1
9db7dd23e7b99c26238712450d60375f018ce83b

SHA256
191e849b8be3bad4e3b23882c47d7697741b2c356bd6b5e9c78c45dd045e5f8a

SHA512
1a63ceed71bbfa85d11e782783280d0785143c5b87cc0d44ab362b35912b806e2d02a0de0eb9d5ce1e30054aec7246ae3c652d31a066318de6b5a20fb2115f01

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
113bf1f0ab3fa6f5fef1419da9ba50ef

SHA1
6e09c397bbe00ab4737b25570e21a9bc657e9420

SHA256
f0c10b4cea8a3483da4169eff0727e5b0574b712e65c9903a007b9095575e74f

SHA512
4488773a539a929f1047d9a76e8b953b60bf510d14b6e556be1c4462e65b03771119507ef47b1b9e2bf00107ae72f9547264c5e880aa65f167641b49e6c4215c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
528f6abf22a83a382f37ebfd5060f254

SHA1
9266f5753c9bb106dbbb5ee8187b99d4470fe056

SHA256
adc416e896eb09dc568cb4a40f0a35cc6abd2dfd21f631f05eb15dd32b7c8996

SHA512
1563094fbe375236aba4d8215ef75f98d2970ae51eb55f3849cf791d502bda2f4fe774b3a4ef2f1e568a06fcd77dba017897e1dff655e48b29ad0c8bc4c1cd3a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
fd9edc402d03abc93bdd7d7f17f47780

SHA1
d5ae3083fa6965180345a6b5c55061a2c777e6cc

SHA256
fdb52113563a1ba528c1aa18f286cc3c556dbcad1e0f69453d31f957829f4223

SHA512
fb56ec6378ec9c3629fecc555e0294f83f84881db9e3fd92fa2600facec4d3e914e2392d8c7234ecdaa84f23eb25707677a73e2caa5fbf090334acfcb616e63c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1KB

MD5
8760f18c18b755c578829d0f79a3745a

SHA1
abd9b58f2c7985a4c52bbbdceb5990e5fe38aa01

SHA256
a060a609c1199dece78227948e74d95cb1cfa2c0d3e464b80c5b9e0d29dbfa06

SHA512
25c9586d03ec93e1a411f72b2a4c3135154de0dcd185e611b9f81fb923c1f93c9f241ec325a7e582962e106d5b71c1d22afed921ed09c7420bd37a7e54e08761

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

Filesize
1019B

MD5
2fabdbee274826e7599db78da5b6cfb6

SHA1
3735d8a3ffc2a2b3e3aad33ecff618ba71b74e96

SHA256
ee38d31a9f96cd493d652416647732a0c2332e040c524a43a482921130c07476

SHA512
358efeb6c06368b8bfa81f812ef9db2ce80f9fda6b2192aeb74c51fb656f22e7004aa7ca2fb25de22950bbdede9c5393191e86debea5669bf73309f5ebc833fc

Download Submit
C:\Windows\SysWOW64\HelpMe.exe

Filesize
9.1MB

MD5
60f16d896ad91156912e4728018296eb

SHA1
8687666190cbd4d514c8b9c1b7a09512f4e15256

SHA256
6fb66817731c4e03f3a56db0197c1c841931fe90b26ec9691ec4ddd5092a30a2

SHA512
5ece96921df6529d84db4fb44b4e10ac160003a176ca0429176a8af8b8f63b39a268e13e2ceb00b35f754892030be873b3a63be30c1158b05ba0de8c610c88f6

Download Submit
F:\$RECYCLE.BIN\S-1-5-21-2045521122-590294423-3465680274-1000\desktop.ini.exe

Filesize
9.1MB

MD5
27fa2538b9d3c7b14f371d8cc38f242a

SHA1
562f9838f0f917e4318db991e4fbc556376beab5

SHA256
4bd3c59794160d3bc84bc0146c50b38629a8dd772c114e48da7fb8a94e92b482

SHA512
a9d1798fb943fdb5e9574f42eca0120c17e97fee1805cdc2933f651c3ecc5ebaacc2f86494f9d39530c86841be4de3cd334f882f6d05a8dbc7d6c7b7af5bd4ab

Download Submit
F:\AUTORUN.INF

Filesize
145B

MD5
ca13857b2fd3895a39f09d9dde3cca97

SHA1
8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

SHA256
cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

SHA512
55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

Download Submit
F:\AutoRun.exe

Filesize
9.1MB

MD5
25d7c9ba82bd909ce4224177a87424c4

SHA1
cdbe6272122b68ec2d666c3068733b3f17c1941f

SHA256
a9b94093b5b8d953f43259f470b79a56b0582fd856e56905f831d5d94719ac93

SHA512
0b2f205f048f7c4e691ded300176fbdf40b1413f998bc85eb1fa1d5d239d8c55a92dd65965350f0ca1ab9ae5cbfea81a0ffb24a3df715ba5f5a86b2d2012cfa5

Download Submit
memory/1760-48-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/1760-5-0x00000000005E0000-0x00000000005E1000-memory.dmp

Filesize
4KB

Download
memory/2028-0-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2028-45-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads