47983cf8c2541552c2a2392a4091322f33677b262bef52a9d25bb5a55eb679f6

Analysis

max time kernel
135s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
23/10/2024, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
700adfee8656726644127c85331800b2_JaffaCakes118.exe
Size 484KB
Sample241023-v2bbwasajg
SHA256 47983cf8c2541552c2a2392a4091322f33677b262bef52a9d25bb5a55eb679f6
MD5 700adfee8656726644127c85331800b2
SHA1 e55873c9564e95dc6eea430da96fc558a5c0a572
SHA512 9d13ba097735ce55a5d4ebafc3b70ba5a733f659b243f04e2123288484b8e8c92f72ce06aa6532bb2c125368b243175565f25aaa3ea90459f891d9e081857b77
SSDEEP 6144:niMmXRH6pXfSb0ceR/VFAHh1kgcs0HW4ky+4ukKZ8o/oUNSBmd5XWz95UH24HHxj:dMMpXKb0hNGh1kG0HWo+cKZzNndsz98
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

aspackv2 discovery persistence

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	700adfee8656726644127c85331800b2_JaffaCakes118.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe

ASPack v2.12-2.42 4 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral2/files/0x0008000000023c5f-4.dat	aspack_v212_v242
behavioral2/files/0x000c000000023b2b-33.dat	aspack_v212_v242
behavioral2/files/0x000100000000002a-41.dat	aspack_v212_v242
behavioral2/files/0x000100000000002c-15.dat	aspack_v212_v242

Drops startup file 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 1 IoCs

pid	Process
1876	HelpMe.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\P:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\M:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\R:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\J:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\K:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\A:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\H:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\N:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\U:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\W:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\G:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\L:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\E:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\V:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\X:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\B:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\E:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\I:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\S:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\T:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\O:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\Y:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\Z:	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe

Drops autorun.inf file 1 TTPs 3 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened for modification	C:\AUTORUN.INF	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	700adfee8656726644127c85331800b2_JaffaCakes118.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	700adfee8656726644127c85331800b2_JaffaCakes118.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 1892 wrote to memory of 1876	1892	700adfee8656726644127c85331800b2_JaffaCakes118.exe	85
PID 1892 wrote to memory of 1876	1892	700adfee8656726644127c85331800b2_JaffaCakes118.exe	85
PID 1892 wrote to memory of 1876	1892	700adfee8656726644127c85331800b2_JaffaCakes118.exe	85

C:\Users\Admin\AppData\Local\Temp\700adfee8656726644127c85331800b2_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\700adfee8656726644127c85331800b2_JaffaCakes118.exe"
1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1892
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Drops startup file
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:1876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

desktop.ini.exe

Path C:\$Recycle.Bin\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.exe
Size 485KB
SHA256 c087e00ed40787ed43dcac05b34fc9205f7f63c46d442fd2e8e8ab0b8c331075
MD5 bc2350f9e524a8f22be8c19cb052c2fe
SHA1 1ea4f474319d592968572c0dc96f0af675bae802
SHA512 923773a777e1eeed58e22d529b81410b38e3c4529bed896c1fd2c67739f23f749197a7f4dbb729ad2f95055cf87c75ed16d4292e40b5c8702585750e30a09bca
SSDEEP 6144:niMmXRH6pXfSb0ceR/VFAHh1kgcs0HW4ky+4ukKZ8o/oUNSBmd5XWz95UH24HHxK:dMMpXKb0hNGh1kG0HWo+cKZzNndsz9j
MD5 SHA1 SHA512 SSDEEP

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ad3f337e093d9d0290b71ab4483f63daa014dea3bfb08803bccab69db413ef36
MD5 351e81f8e24719cdb9ad8e712930bb86
SHA1 370bf19ac11c48f5a5082c9b790a69f35c86217a
SHA512 b1ee89a9410fb924d7d346f47414fbee07ee9c0f3b5ba439a9b4b1e3ba6636bb790f23651c8084be98083464d05a50c9114861a08362560a943f457de9379a3b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8928c3ef7ba14f2d19f8ccb1408858014db5b836eb630984a56cb00b14856821
MD5 be502fbde56962a1273073f714e16562
SHA1 a641a1cd4e28bfe09ab91a193f5df17345e879ee
SHA512 ef77af5f41fc27ad7b07163fbe54d08aee6376d006d813b4ab955d9188d070cf68bd4dd7c85ade567ca14831ef12197464663b385f070074356dbd2a36da5d36
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 701031b14fb94092b85ff86ca7510618184d90b9084f86c5fd56d82d08cd5974
MD5 82fc86d9aae8a0fcc0cad917773b9e23
SHA1 49e23120c4d18eb5f9a1f56bf2033ff402299c42
SHA512 c788f109713d3d32130f539544eec11495864e2eb698f89eca003d584be0484ed5c92a77fe1831b3a957209707fd8e43eb8c12af2aff41c39248262360c5883e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5302f87fcd36ce48e01a7e8503901e924204e62a772aa0731883e4afced61b68
MD5 5d03781001523962b82b73628d6cbff5
SHA1 d98c8e5fd9dcef149dc9744604a011ec19c49a6a
SHA512 596b8121d7e3f587aa3f453ee103a5d53698db7871823d22e77514986859a1252f805307733f67a9c066d5ea15e576015495588133c45ef11307f3dbee36daf9
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 1c09d6190c65748b9cc50277d07cb9cbecaaff173e70a50092156857b5b67f82
MD5 a3bbb9156b90867f2a1519b7a4be664a
SHA1 77d2c6bf92217d4bb67a11f27f9004b9d70539ef
SHA512 c07176703224ca15a83721a6a29afe3e62cf660e7f86feccc109316cd9d8f19b615175532e213622d28777bf7b21be252e879a522f4d8a86063bb842af853be0
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 145de01e71031322129e2500bf5146d21d302333220700cb3bc1b3cd14314f4e
MD5 dc0d45a498dee906406491a8da681776
SHA1 e1b35c16205502451988e72d9ff1831de9976a50
SHA512 0434af267be4176ad35fa28e51b9499cd57b7d36963c26b8a7883dbb0bac95d99edc1a5c969ba6d18f1be396609a3c085335a446447c817f6719bab23915b096
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 127d150e2f9711d56ac0bc6cda229ae5bf0d6db5576de1108ee2eb8c038debbd
MD5 aaacd17c6737eb6ff0b918efea110471
SHA1 bc5651e23dd17d11500598ca430840f300c26103
SHA512 36cec2d697338717213dd971b21620264c68def2a7776e928e4f76040dc17230adef09b24264b16aa502fc316bd589ec0be29ff33f8d86596a3d3c5c53faa650
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 65c0b34bf9e964a64a685ad50defb9d9d36ed94eefc005039b31b0f54b8b03bb
MD5 4ce24ba3786fb992ffd999863fa2a1b0
SHA1 54dd5fb03c89a2110ac0065d3d4e0335a9c216da
SHA512 01e69df0cfa87880f9e42bbfb0cc2e157bac9abf29e6facbdead89564771c4fb7703f5548d3abc50cf2dbdbebdcaa6202370ea015fe36bb94a78d23b11cb5079
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 90d9725adec3193eb7063ff52d6df02879a4b8174209abba95856f622d2de8a5
MD5 79c25db42792d9ffbeb14117ff970260
SHA1 30f698a901cd67e26f4e0effa71518e8566ff898
SHA512 08a7b5a042d1cb68747451cc5bc560083217e73931b2bd36a68d1123374703788685d041f902b669a69f3ee5037de01b3918cc3bd1db76080a13a52c16f65125
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 6a4d465c6cd550e73e51af116deaa2bc214b9905eef09275bf7a123b8d98c7d9
MD5 f8df51b1b474e055a4a6a17ab6c9aaf9
SHA1 2be9e5972b348610cac1456b2e5df8f66e363ba0
SHA512 77d49f4bdea018f9aeab92e73fc5668ea8cbeaca0ed1c13b19e8cc202cfdf4778f735897f15fe52810d10f77cfe232d5bf372e1bb1e7435accbd8766db0cc598
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 8ba07dd38448b936aaefc9f779a7d744ea19b1c0a3228830ea9d703883ad9aec
MD5 4029ddd28b4cacd55eedfcc14d284b3a
SHA1 92dc66e7be18d8d8e37b35fe7d985eba8cc0ae41
SHA512 a5607674be4a7bae47c04d2a4e28bcac0f08f3437cb985f5cf50f52de1ce2a45fbc19641ce99e5f595f6c7d6f9693f98bbc5ccb7f5a9418d5baa267a1e8029f6
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 d4e035b6c930399ac95232a5e8f2208c22e4e309836a3b5198303cdcda3688fe
MD5 4994f32b2d5856381c1f0aa53f41310e
SHA1 fbf360a48b304f5f80b590130cdb2326eb2ec722
SHA512 f6cc1d6a13badd831f6ba8be2a06167d659c5914d109cb8c49eed17ecbb39784192f6ff7ed282f4b3ce907304ed96510edf590bfda1944883349c08ec56ecb82
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 acde6c43d15602e8eebe20e8b5552160f34ecf2de82e92216f5ccab852e41033
MD5 07217a7e5cd74e2fee68c6ffc931cb3e
SHA1 a2d5a48fc0d2525c0498ae15595602b4a628f12a
SHA512 23158cdcdd24eb8afb43a120c9008d1d2a53589a6af5ebe18176962cc11f93b8406214c3704531392d2308c1728903c65f3962f4bbbf2aa841d22053b72e027e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 4ad754b3bc13999e65c5169529a8b07ec41f346c822459151aa9116e826faac8
MD5 626b0731cfac7e8898380484087f1585
SHA1 03960dea4f6fec13b605e28507a3841b0d67bea8
SHA512 cca3f2126586d794fbbbfabfce5d1b4fd4f643f52bb13aba4fcf9d7e66ab27773c9649ec68c7ccf57682de40f4b0545054a749bc33f0b7112f6ca7496fd9e20d
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f6dd6bfca9f5989cf0cc9c00538f3a14ac6a55b86a99a8785efbd0900e36cb85
MD5 de0be90c55ceb3c8fdee63fce36c3720
SHA1 8fd3de21b476e6e4e04514c793ded1eddff0391c
SHA512 74f605416daaf85b42621bea22c40c9b4509b0a6b5306d6093d88587f4c0cf7018642cf8669c57c07c06f517d714fccba1467d1b440b44312fc5f9d544916df5
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 b1d36afead959640d33cd0441a97e2d742ddac9c14a09416b73458842731da4d
MD5 d4903e95a8e6bd2ba49c2cbf1c2d3885
SHA1 30d79c3d232087cb93c35c89b34d5f036cb389f7
SHA512 fce3ff041d0e4a22ce2bad45d22ba91b24cd6702361f301d625b754b4ba8cf1520da71d4e946a5f9cb0bdff9d22cf2be0a79fc19ebb812dd320da8e20bebcd6b
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 930082e31a037568df07831310e5345982011f2bfec42065029c0abf920d38d2
MD5 33489f69e8dda14593dd0c0b4e72d76b
SHA1 ce235e993a7270e027b702a44d00fa399b759c30
SHA512 5f8559215583d7943f7e608177aaf50f969711706960da19877c332f784284714abf7b5e75a2fda9e99d822a8aaa2753777f541e28541a3d561281984757e584
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 4b5735426b968d3fb9fd0e288b7b03c5a61dd334a27e7fea6bfaee1c89391843
MD5 29c89011ae67feaab3b947cdad6956e0
SHA1 ed404027ea655f02bef8419fbb517083034331b4
SHA512 013d6b720d0b5b1fdebacb0e71a9026ba92fa2fc6d83933f7feae6365a022a62d91c8185b5c8ced8b3ebc873cc973c6603845e7d70bc8fae035272a69aa38b83
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 f99ba85307b88df248da62d6962ef0650dc1c45de09c4d8410ce4fc408e1d1af
MD5 09a8e16b40af9c6195b16014f02119bd
SHA1 1000c017db6600483eab6ba568490ca5b4c8b46a
SHA512 bd2d185b8b1535983bf2c1b5bc0f29e414abf94f193c1a4d73b34a5931ddbb5788858c4118adc8342df00c54706351d9a1f8874dcc305c1508a6c0f2f1f701f3
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 74838906bd1494ad349b94d8e8f67275025d052870b468ed1f724c6978b1395f
MD5 aed0bfee0d057520b60eb6a4d157346b
SHA1 16c4bd5ccb7c9c3a8d5cc6e5ef31942508c97977
SHA512 babaf6ed264d4054bbe1291f0f9dfbb49406d788e09d5edb5767df04c7638a9cfd3c03f34bf711e12087649f60c244f87c830f7ddfe3636632f07d4a788a6d15
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 2fd70e01cf2bb8a6c9030a6bb15941a9c5743f14930889b668de5718ff709e25
MD5 d1dfb8360b09e1ddaabe6af7ef7f4bd8
SHA1 4f7172e3a56944a1d865c67582ee7a24093383fc
SHA512 98d64c03cbb4d6a4a6584c70e1de7710cb6ba616c138306c5daa87ae3c7782c5918e6b7ea9b322f3a5100b8598b99d2a2455efa54a7f48d49953eb94b3f5ff1c
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a2d40e3d693dc503c0dbe43eb8f6e16be6d31793d7a3537ba2cb8d303775e5cc
MD5 6478960f548bee6295cb1961dfb99c82
SHA1 e0df1299ea1acb1901e9dbe8258cadd1904a96f4
SHA512 3dda78d984ce45e596ccfcbf55867b8d0982a7d705f8eaa7cb78c92f65707cd1952a6c6994ab5c9cb7b1a9552448d4619230609290aa8cce6bcd1591bfd7fb38
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7f632fb1a11095e9f6b525f9b8b4ec41f0fec4691b77184b930e6c0178e2f58c
MD5 a4860b627e90c18a3f9978d0d4252804
SHA1 3730c8aea985e7ded265edac3cdca3d39cdf6a04
SHA512 83a7204e9ef809aaab1c5a785059fa96bb5acdf56f9cdce2fbbbb802917654d79f3c0c5c6127ddf243461a37ba6fb1a13cf818ae8ed3af9a9d43f91d859836d4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d71238bbc0fe320f899a32f468de60530b49b289f381eb71b8023a8de658c06b
MD5 77c2c9ec4018247ca0fa3903c0d8aad5
SHA1 75a1f2995ccdfe5cb7da50cd2fdba172312d6eb0
SHA512 f33055b5014f030699cfebb9ca3f7e43de844989359a08d8850f61de3de2758ab31b351f2215d0f249771c36870d9df4de76b4020814cc4c013e8cb153c854e9
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 de6f83293f5e84807084c70d6747f00b1a067149d7534eaed0a3d577c2f33c2b
MD5 c88a86f9e1e30aab7c3ce0fbe83790cc
SHA1 c93537e38e75ccec303bde702695b7180faabeef
SHA512 0dcea814dfbaa7263df7a0d7bf1fffcf721891759b799d861bafc385041a614e1d9299421dd7a0b5972ecdfb99156c82cf8afd15eeae31537c5baa528f135b74
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 274505dfae5d7a830050c2ed4b5f8319dfa523015e50a4e55bd7be090545e1d4
MD5 104a3e6809e57825b5966df02acfe770
SHA1 d0195e5348fc807d44e82733649a034ed7e5dad0
SHA512 f1424929c961b766eebcdbda0f628d6bd795681917bc6013b6dbf3e0aa304241a20f3089fc7d04e3d99b67aa31884cc496f4f3972407e0a4664448caa08c94f4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 7ebd52f1f70922818a83cbdae3a2bbbb7cf4ece39264ac79cab74c428beadbba
MD5 ff7abbcd97baa5a5c763790363adad83
SHA1 3d1a3faec2da7987f9748fca50baf07eac744cf1
SHA512 8adecc6ef202e22731db0d7a732170109a69cfd5a371d8ce38ee98be3b7ea6b5266d264fa578ae056942e9bde528c2634660e11627b1a95c38baa4bdc5915809
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 126d29442e1203ee307b63b30fe93ed0ba3d5315d50abfa9c81180a268a87370
MD5 269226b4076516582da1f0448d73a4a4
SHA1 2613f91ac371dd8e14c0afef47c49ac8de2b625b
SHA512 31134c60f22d098efe615df3a1e60e3857aa2c05ccbf69b4458da3ac30a52afde2071165ebf8e3b493be7ab52062fe10a9ff0266143aed6bc02bdc2dac084242
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5e3de5f966d49865cbb51864fe6eef95c8afb52b9834a892916463856338ab93
MD5 a351e4fb8923c408cc74b73051f7ea7b
SHA1 6884ae3725974eae0ab042f0f6903c2923b27a2e
SHA512 c06c3b15d9af6669d0e17e7a677a661bed734780afd9d970d4a0ee6e22886550b7fc43e48af2928f3d096970fb79601b161d2953333a3230cb47b62585c46ed4
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 afa0c1d13462fd1d18fff90d1977258b23bbaa7667eea491dc893954ba40884a
MD5 19f185afc4f671b00ed88ef814a8db2f
SHA1 9cc4e0ff42603a2739e4c4c7165e537de351ec2a
SHA512 a90cfa69d000ac8aa028441fd54370cc0e115053699105b35cb7fee3c635ca30033c2c46809fc1e29f899c469c105355e430f77985dac2c623aeb6d63584e38e
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 12eded0c67d05646ccd07522aa17b2f85f663c9a25f19e57a4d40a33656b8aec
MD5 5a1f7da23689d2872d6e5e7b20c6c2dd
SHA1 3ae8689c5f805164264803672b37538d5cf14c7e
SHA512 e738a94d95199e4661707317b6d768c30d51f6535aa385bf33be677074c4b18f8f6b272b6dab8c3ce33518c24aa00beb4608fb02250a3eed9674a3f6508b62e5
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 231d958d8813da20087200d513469eda013f8f74dfabd501f2a5d89dad79fda7
MD5 a3f54fa078737c32d87ad0c46c197a65
SHA1 4f9ecbc046eacea8d15f4f6132426fd88c5060dc
SHA512 7f45d3cd6f0cad7d54ce5d304af36c9657c4d309c09488feba46c55ea5598c7bec47071070393023997cdeb7575c065bc12aea85ff5ac5519fbc76f4e6690941
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 60d724b2362e0b8b206c611df45a533093e89df802a770b01af628b746e407e2
MD5 3d5d069640fe81e4aa8740521e8daec5
SHA1 a5d295b8902dcfc0b085b4d7b3a681aa09ac5f3c
SHA512 aff590a41e6c4e197287154f1fce8c7a405ba2d73e974c22453de6a2f858252db5db0bb357bd5e4a6dd12b3fe59e54243d78ab3fa474b3b8dace233fdbccb582
MD5 SHA1 SHA512

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 aa66badb38afeb2465bc9c095be7a2442cb983b643c1311db04f984d47af1649
MD5 4fb3e451b4255246a925973408d4e11d
SHA1 1068d20e51e362ec53c6b024de7844ccd088be7c
SHA512 58568ffa644a2a7a05bbb131a6788e596bf0ac84aefb98110592b3cef7573130b47096869ad6ddba1c3531b3efb8fb6e649b6a069540e414597fdef3cb08bfe3
MD5 SHA1 SHA512

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 484KB
SHA256 f7e8bfec72f218c7343e30e76d2a1fe61679390e1576617597a592b9ff23ec21
MD5 ec4b470a32e9ff2cca0a0ca928ef2491
SHA1 a75577f8813d47de6d7b6226ecbe6d555bb1cffd
SHA512 f299e1229cfc334637e44da855fb93c1e9f61e718a26463e429382b46da290441faea1bdd55362112fd7936003b85b789091b7121843d6be3f296a3be8f9be6f
SSDEEP 6144:niMmXRH6pXfSb0ceR/VFAHh1kgcs0HW4ky+4ukKZ8o/oUNSBmd5XWz95UH24HHxT:dMMpXKb0hNGh1kG0HWo+cKZzNndsz9k
MD5 SHA1 SHA512 SSDEEP

Submit Download

desktop.ini.exe

Path F:\$RECYCLE.BIN\S-1-5-21-3227495264-2217614367-4027411560-1000\desktop.ini.exe
Size 485KB
SHA256 08cff02ae507e95c9df7660f3e8b4249ff8b89c362f8c5ab60b3aade9e4a97f2
MD5 4a6d730520e519253a0100cc44203e7d
SHA1 8ce280a5b54e8225528c9fdf05fa16db812cc82d
SHA512 f9a383fd7afd1dff559968af654c6adc71aeab48ea69c6240957f842dd8724ef96b35f2829ece541490b96c121f07afd80f31f68bead7da4c4debf22388c2232
SSDEEP 6144:niMmXRH6pXfSb0ceR/VFAHh1kgcs0HW4ky+4ukKZ8o/oUNSBmd5XWz95UH24HHx+:dMMpXKb0hNGh1kG0HWo+cKZzNndsz9/
MD5 SHA1 SHA512 SSDEEP

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
MD5 SHA1 SHA512

Submit Download

AutoRun.exe

Path F:\AutoRun.exe
Size 484KB
SHA256 47983cf8c2541552c2a2392a4091322f33677b262bef52a9d25bb5a55eb679f6
MD5 700adfee8656726644127c85331800b2
SHA1 e55873c9564e95dc6eea430da96fc558a5c0a572
SHA512 9d13ba097735ce55a5d4ebafc3b70ba5a733f659b243f04e2123288484b8e8c92f72ce06aa6532bb2c125368b243175565f25aaa3ea90459f891d9e081857b77
SSDEEP 6144:niMmXRH6pXfSb0ceR/VFAHh1kgcs0HW4ky+4ukKZ8o/oUNSBmd5XWz95UH24HHxj:dMMpXKb0hNGh1kG0HWo+cKZzNndsz98
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1876-5-0x00000000020C0000-0x00000000020C1000-memory.dmp

Download

memory/1876-51-0x00000000020C0000-0x00000000020C1000-memory.dmp

Download

memory/1892-45-0x0000000002410000-0x0000000002411000-memory.dmp

Download

memory/1892-0-0x0000000002410000-0x0000000002411000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads