stihat | 70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 12:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
Size 2.3MB
Sample260831-pyebgavvew
SHA256 70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43
MD5 392962db0af47633903710af71a7b7eb
SHA1 da6c6bee7ad36f6ce4ed3e16a71dd858d4a9c86e
SHA512 091796336d28f91fd372db5e37272f496a40ac78d9769c12418d5ec02ff412c857dff3b27844c7706e5b39dff54c6f7ed34931ffb3b896ee3b85bb082b693761
SSDEEP 24576:TEtl9mRda1cSS5GJ/zgzoPj1wQ2q8/VmnDIY4YC+a60ILphwPPmDoI3sK:oEs1hS5W/bvt8tC0YL3cInw3mETK
TLSH
T1C0B5C056B3F494B5D1BB8278CE47865BEBB17C012760968B13E43A4D2F33BA1792D312
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery stihat persistence privilege_escalation spyware worm

Malware Config

Signatures

Family: Stihat
Stihat is a worm written in Delphi.
worm stihat

Detects Stihat payload 52 IoCs

resource	yara_rule
behavioral2/memory/3324-0-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-2-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000b000000019caa-6.dat	family_stihat
behavioral2/memory/4976-8-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/files/0x000100000000002f-17.dat	family_stihat
behavioral2/memory/3324-42-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-43-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-44-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-45-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-48-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-53-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-56-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-61-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-66-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-65-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-77-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-82-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-81-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-93-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-97-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-98-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-109-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-115-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-116-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-125-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-133-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-132-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-146-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-152-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-153-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-162-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-168-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-169-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-178-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-180-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-187-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-194-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-196-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-203-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-210-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-213-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-214-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-220-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-223-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-224-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-230-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-233-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-234-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-240-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/3324-243-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/4976-244-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat
behavioral2/memory/5172-250-0x0000000000400000-0x0000000000477000-memory.dmp	family_stihat

Modifies WinLogon for persistence 2 TTPs 3 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	HelpMe.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe HelpMe.exe"	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe

Creates a file in the Startup directory 1 TTPs 4 IoCs

A file was written to a Windows startup folder. Files in these directories are executed automatically when a user logs on or an application initializes.

persistence privilege_escalation

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk	HelpMe.exe

Executes dropped EXE 2 IoCs

pid	Process
4976	HelpMe.exe
5172	HelpMe.exe

Drops desktop.ini file(s) 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\desktop.ini	explorer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	explorer.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\I:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\H:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\S:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\A:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\G:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\S:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\H:	HelpMe.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\J:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\O:	HelpMe.exe
File opened (read-only)	\??\A:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\M:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\P:	HelpMe.exe
File opened (read-only)	\??\W:	HelpMe.exe
File opened (read-only)	\??\O:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\X:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\B:	HelpMe.exe
File opened (read-only)	\??\P:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\X:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\V:	HelpMe.exe
File opened (read-only)	\??\D:	HelpMe.exe
File opened (read-only)	\??\Q:	HelpMe.exe
File opened (read-only)	\??\G:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\U:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\V:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\I:	HelpMe.exe
File opened (read-only)	\??\J:	HelpMe.exe
File opened (read-only)	\??\Y:	HelpMe.exe
File opened (read-only)	\??\U:	HelpMe.exe
File opened (read-only)	\??\Z:	HelpMe.exe
File opened (read-only)	\??\L:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\N:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\Q:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\W:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\K:	HelpMe.exe
File opened (read-only)	\??\T:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\Y:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\L:	HelpMe.exe
File opened (read-only)	\??\N:	HelpMe.exe
File opened (read-only)	\??\T:	HelpMe.exe
File opened (read-only)	\??\B:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\R:	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened (read-only)	\??\M:	HelpMe.exe
File opened (read-only)	\??\R:	HelpMe.exe

Drops autorun.inf file 1 TTPs 4 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File opened for modification	F:\AUTORUN.INF	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened for modification	C:\AUTORUN.INF	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe
File opened for modification	F:\AUTORUN.INF	HelpMe.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\HelpMe.exe	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe
File created	C:\Windows\SysWOW64\HelpMe.exe	HelpMe.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	HelpMe.exe

Modifies Internet Explorer settings 1 TTPs 2 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Toolbar	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000\Software\Microsoft\Internet Explorer\Toolbar\Locked = "1"	explorer.exe

Modifies registry class 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\NotificationData	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{374DE290-123F-4565-9164-39C4925E467B}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1 = 3a001f481cffcda87848be43b5fdf8091c1c60d0260001002600efbe11000000ebbaf6aead0fdd018e038d64b60fdd012665546ab60fdd0114000000	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	explorer.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\NodeSlot = "2"	explorer.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1\MRUListEx = ffffffff	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\2\Shell\SniffedFolderType = "Documents"	explorer.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3600	explorer.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
3600	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
3600	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3600	explorer.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3324 wrote to memory of 4976	3324	70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe	89

C:\Users\Admin\AppData\Local\Temp\70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe
"C:\Users\Admin\AppData\Local\Temp\70f138cd0b5a20d342b9a6e2ddef681f7d1e631521baeb56ce399516f6a98e43.exe"
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3324
- C:\Windows\SysWOW64\HelpMe.exe
  C:\Windows\system32\HelpMe.exe
  2⤵
  - Modifies WinLogon for persistence
  - Creates a file in the Startup directory
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops autorun.inf file
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  PID:4976

C:\Windows\SysWOW64\HelpMe.exe
C:\Windows\SysWOW64\HelpMe.exe
1⤵
- Modifies WinLogon for persistence
- Creates a file in the Startup directory
- Executes dropped EXE
- Enumerates connected drives
- Drops autorun.inf file
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
PID:5172

C:\Windows\explorer.exe
Explorer.exe HelpMe.exe
1⤵
- Modifies registry class
PID:4288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Drops desktop.ini file(s)
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1c879f30c305d4df062772a1d5ff853945bb253c95727172b724c28353ae8184
MD5 aa6f1750f2b26a7d36d1c2fc4cf4789e
SHA1 21068b14cf3f5e87c6a9e50a4222fe01f57a337d
SHA512 cbca2e4f9cca543c1b879c3ac50dc2a04d4cf8f9a356c5ed4d0d3dac8baeb5857662b2e9aa2f67df85b665f9411206c93c779b670a163e4e67b881d8e720f90a
TLSH
T12611822915D11F37D3B15B7A45E71361A777BC02F5B64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 513df2927434363e4ada6b19753f9e4184b29fc52c89466dbf192b2beded3413
MD5 d14009883ffecf8eedefb24c5ac44525
SHA1 44d96a6baff660bb0e2a899f2418c0f6357b87f1
SHA512 c163d7522c56ae7067a60807f585a3325425c2de7b725079bbdab300bce9a11fe48302870c177c896f1af1a86fc3ec20d6cea76636faa90f514696b7cbf5d2a4
TLSH
T15611CE2925E11B37E3B25B3A45E72361A777BC02F9FA4FDF41C656825C40202A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 74ff03b8295bace29e87854d6bc773b81153c30e8412125fec6008e03918167c
MD5 3153e306b7ae7653fed2cb8181606b01
SHA1 620cc7ed88c6e80e57b6339a000e902b3e166a9d
SHA512 795882d89bcbecddcc00ef45652650c1518423b68d2f9f8c61a9400bc485f84c51dce1aea974f8a74a761b640d4ec11e37db243bf22dc5e7395e28a5fce0196f
TLSH
T1BD21E03AADC51722C37AC67B91F611A9F736B821BAA35E4E01C287080C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 05ee19f277e8e79b21829854353825f1f7b665ef2046efb2fc1776ef07c20447
MD5 9411d7b6239ffe9d650a232a6343200b
SHA1 58ec7ae14aa5357e210add92751ed12885502f30
SHA512 1f87b6bcab11c233bbde9234054b41c21b002b9bf940e3459211eec9eaaf78a6dd89104c173ee6a0cab9c700dd414e89dd4f629ec19929c020eb594a15c66635
TLSH
T14D11822915D11B37D3B15B7A45E71361A777BC02F5B64FEE41C657825C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 462574115d26df5e7fd2b227240355ad8f2f0a72eacec34fd7a10babe676c280
MD5 2cfe050c5c8da8b44cafdd61005612e1
SHA1 e95b36e06a4861786feaee1d1087dab6943247be
SHA512 46ab4f5993f0832ced0494365476815b069490fce6cc378a8a1d56bab8d4818a590a034aad75b438a4569c2730d41c3d76ec0766142ac1110b8327065690ebdb
TLSH
T15421E03AADC51722C37AC67B91F611A9F736B821BAA35E4E01D287080D10F927901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ffa832a6098486283592ddc689cc8af956b18f31f7a877d56e2eb9ba6f64bd6b
MD5 a9e0337c65f2a667dfa9b9ae811c3caf
SHA1 74ac8dde2d9f397246b29f505b27ddd72218c579
SHA512 81eb26db05351b8aeaf029a0102f5d49eac6f27b5c20cef7f55579a0caff657b138baa584100a1b3ea9ee7aae8082a379d43dd11aebec1cac4a5118716cbd6c8
TLSH
T10621E03AADC51722C37AC67B95F611A9F736B821BAA35E4E01C287080C10B926901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 194fc499ec2d703e067e721afe66a159f3ccccd45587bb64e795d1dbd7e6d60f
MD5 0ef3a2ca75cdeece1b7a71f4dbedd6db
SHA1 f17719e233f842d138ad55e51fbac6d965d2fbb1
SHA512 0f61fe924d6414752b8f74a06fd7cc6a515b88091f7a930551e885091ec134f9a42b9ad106d8137222852178b56adc480841494b7c5c128d95c498897f3f168d
TLSH
T15611CE2825E11B37E3B25B3A45E72361A777BC12F9BA4FDE40C656824C40202A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3784e232bc73cce15b14fa1fd9da8048903ef559673baed131ab9a27458cba39
MD5 2f3f3e8a05f734f57baa6b301864fc6b
SHA1 ac7e70fe8c7f2d4d95e9fe64fd2b0e52b906ef63
SHA512 b0d49fe914204fab0aaca2e9519d34c10e914f30aca81947e1e8d7a58e1a1686b5037b4f2532c1f1958d03bcb060668f14842fe657b38dab7eabaa67e3f28eaa
TLSH
T11C11822915E11B37D3B25B7A85E71361A777BC02F5F64FDE41C657825C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 46303b8e288398dccaeba71776c85f105139e0fefa4d461abe058445306b5946
MD5 10b9726bbb40b1d73ca6c2067311e33a
SHA1 78e9c6a3457f5c77ab502d5156d8409a6ec4b1d7
SHA512 a6d814a8ecb44f71c007721a746b5835567a4a5ae48c9a5c98cb67b4cea71fbfc6949ccd357049d46ba60f47370aa798a085a8a00ace0d1c34c9640b3a7760ec
TLSH
T13E21E03AADC51722C37AC67B91F611A9F736B821BAA35E4E01D287080C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 ffabc37e8ed9fe35f1096b36f2e5b457632392a8a169b236399db1468b812a3b
MD5 39b7136dc5a3493c8442fdb422a0ae7f
SHA1 7e97adb48fe47e058c037e37f4842d33cf5e5d2d
SHA512 8fcd2fa855710e08b134f230602673f3fc28c715ff747f129b1c4e0c7030e4f391d1346e8fb870b8e4612909fcfa14d119b35cc13cf679bc6d8999e4f3d3dced
TLSH
T13C11C22815D11B37D3B15B3A45E71361A777BC02F5B64FDE40C656424C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 1d6e07fc429db84044017116e095ab6815a641ac22e2bae9eeff4878672c1b3f
MD5 3f9e1d72206fd28ffad035a7b860565c
SHA1 dcc69c3220e1e71ca98725f56f884c9add12b15c
SHA512 36c718a4db8cf6a75c237b5a6849836e701c5a3b9949a0389de21a8bab096855d056eb77caedb38e589c4a26c398a50e3b99dbd3f8d8dba4000ce46e810f4ac8
TLSH
T1B3118E2925E11B37E3B25B7E45E72361A777BC02F9BA4FDE41C657825C40212A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ec8c9a86b72cfcdbae80acc76e6fc78db1a0fffcb6f3d322ff764f22a180fa94
MD5 25545acb06dd7f319a7fdf0f8b06274c
SHA1 b44fd46f3c6d74546c62f73c40ff9ee9de8ebcef
SHA512 bd8999d48830f7e017bbc74da0ae46608d8806bb3cd98e62528218bb481f3c72e6ab13d182d5926fed139d33abb31553569497769e32d4cb061664e88e9a3581
TLSH
T14C21E03AADC51722C37AC67B91F612A9F736B821BAA35E4E01C287081C10F526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f0e5b30b13ec8ef4b912fd2034e00c02248719848bdbb8706403f8fdb77e8dc8
MD5 cf958e38692b147bc04b2ea591d2c11e
SHA1 64072f1b559225c01d54871428ab0fc2d0865033
SHA512 a011454aae4afad468066635ecf915db763dd565a460bfe52b614b8a95d716098527bbf91ccd00b6970a9268d075ad4fb353a8227df62c1df6fdfc6ca4845dbb
TLSH
T1D2116F2925D11B27E3B15B7E45E72361A777BC02F5B64FDE41C656425840112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 debf5888ff0033f67278558235c69e0c27c9aaf3a524b8871855931207c4b5c0
MD5 5403dbca76b15b8441b7ab8ccd3d968e
SHA1 6ab2267549cc48a2a8a4d783d842e936b438958f
SHA512 c365a2b503ae4e684e58f8206e489d42210c63841dcde248fd6536feab0c31840977261356da1d886af71e540c88be1b5e1e9ffe2f2edc6569a562b818597144
TLSH
T17121E03EADC51722C37AC67B95F611A9F736B821BAA35E4E01C287080C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 92ea423daac591684f6b399a6deee7feb1c2c8b39210021383e95b4816a7466b
MD5 d8709fc057eb1508b7dee98e8eec7f1b
SHA1 79b0e6ad216ce6ac65bb145f793659b70c37275c
SHA512 fbd8dd03a647a251042832340ad59971b7f05ccf3a6840d0465007ab8a015914966565d3a60bb574bebbf04e5fba090273268f2f2b6b880d33ca22c5ebb384a8
TLSH
T15B11822915D11B37D3B15B7A45E71361A777BC02F5F64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 9214910e3e8bbb690342f26e7326caeb1ebab986cf2c512de971a102dcb44a24
MD5 1c71e05bf0cc33dddf9e3cfa13b30b64
SHA1 d7fed0c951fdcbbb6f50b3e9008885580c7a6786
SHA512 da0c344ef11da63e69e7ab080e1dcb1573ccda8f9eee49036a9ae34b7ffdca75d939b85c6b6deda0a7198f3272d544c4f62f603d95eb896d7f7487f8f5fa9784
TLSH
T13921E03EADC51722C37AC67B91F625A9F736B821BAA75E4E01C287080C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 041056f8cd0e571227a0e3ef38c5101259a2fa60c5adacbb82025d44053e7f9c
MD5 4d3a329871987ee68f220bc0cb58890e
SHA1 4ed0b2f497f4cd35250bdbfdce128544ecdadc15
SHA512 ea276c84f18a9ef79fb72cd8830d0cee5f793382150cf9052aa665d3738c63b67657399d82c5215b2c9d962f5ceb68872917f2534c30c7df300614d631c3d3a3
TLSH
T11411C22815D11B37D3B15B3A45E71361A777BC02F9B64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 db665ff2b2742e4d5025359eb54fa2220ea7e8e3ac6f9db38d81d5bc09c45c20
MD5 7a6f2620b099b4312d0e572e0c4aee44
SHA1 34b43803a13538124ece04b0383b4ce1fd3af789
SHA512 618acf143491f466a20e36e11f59fef99a40e790bd94fcc9d7ff4edc783e1aa3dd804e5643abcad8b8ede7ad7923d063e1d97ae20dcb61e965c09d7e11f99722
TLSH
T1C111AF2925E11B27D3B15A3A45E72361A777BC02F5B64FDE40C656424840102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 c3e3b942e89d5b59dca70381cbd7d30a5e95c95f8153e5af9708b83b04b8f7b3
MD5 be3720642f68c2bf6c169008492b8a2e
SHA1 6aac28c64b22a910707888dac9ffa56d32d66ec7
SHA512 0f556ef77d3835ab8d10944b36a90c7f05cd6541a9304061fb9416fe4c12ed15df52447ed4a93fe080502861211d8f405a94eb21e9d2402a95cfb5b7d1c5a0e8
TLSH
T19B21E03EADC51732C37AC67B91F711A9F736B821BAA35E4E01D287081C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3a7a0fb39289caddff596d093acead8df8c19459b788584546208f44ad87cbef
MD5 a1ab7a820fd0c07722d6f743ab45083b
SHA1 872cc024792698c36bcfd1ab543cd85f90d0f5aa
SHA512 165182c233d71712161b3d6c4ab543819c400a568b46a0d31a3ef67280398a45c6057969ca0fc886965f27d818eb54ca144fc533039e0b5c1cb5baa8d4b118b4
TLSH
T10111822915D11B37E3B15B7E45E71361A777BC02F5B64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 fbb8f08f9bd3df163594bcbe4d4759e568b836ee0cc564f67f66654e14dbb144
MD5 9c6af2ce3dfb81f25fbae711cba4550f
SHA1 32aefafa4d31a363dab84f76c1474892dace5493
SHA512 d42119b77887d2bf97842c965cd0145d36b92670fabf28cd7139ac5e8834b04a4c28ed2de4005795c92aa939c2552845fade1282df56637d4fafbfc241a319f5
TLSH
T1FA11822915D11B37D3B15B7A45E71361A777BC02F5BA4FDE41C656425C40112A80CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 a67fbb66555787e6b5fe41a06e4a81e7d43dd61d098c49f8cd2293362df75389
MD5 2b57555f015334e00836b8757f396cf3
SHA1 82a8cd212a85c66f46964829502d210dd57c7c35
SHA512 126aac0574dfbad54e74e8b6b32fd2bfe48579fff69555f876248fa95d4a3f6932fe292377435af5fcac095794f82e27c715c421eca2ea2996cf4cc49ed5dc1f
TLSH
T19C11822915D11B37D3B15B7E45E71361A777BC02F5B64FDE41C656425C40112A80CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 066cfa28f6de144d5d38682ff8dec1ba452aea526aef9d8c8121ce6ee705cf53
MD5 647bc427a37ab4828df5d8b5ff9dce73
SHA1 5f6c7c6825349ed94120cc07679949060b42cf5d
SHA512 67cf5976187bdc6c560058a9f84965d0d99c9045db177816f71850a0505088faafcbab7d6457fd14eae1cbf961a6b090d73e2d3b46ae37ba09b8de0d89b19a55
TLSH
T16621E03AADC51722C37AC67B91F611A9F736B821BAA35E4E01C287080C10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c0b706c6b39b29fe6edeab3901754f652be0d1efaa53ac2d0979b402443b0a06
MD5 f6ae4f279e16fface9095320d048c0af
SHA1 06a84addaace68cb25748e8ec7d11222eee77dd0
SHA512 9e7b3babb9a6289796fd02b1499ae189d8a4e5725007c06e8a3f7a581a02203051c75ac6d5cdb5739138b2c4cb4f93c03e71d36d539ce8b797f51589d92b82e4
TLSH
T11111822915D11B37D3B15B7A45E71361A777BC02F9F64FDE41C656425C40112A80CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 65eb318b5fcbac026730473cd1f64d658363b148c26fe1a5389696dd7fefeef7
MD5 a7b908b8762d3df17831ef4a8f067b48
SHA1 9251208ecdbd7b1c0c2c327070cec0c023f1bf61
SHA512 b1cc30972e6175d20627fa6859ed53f17c63ff68e61ad076708181872b19bd4c2eeefac080296bc4e81845cbbe3c6279ac7c73af825c64b661fc38520d343e83
TLSH
T1FF11C22815D11B37E3B25B3A45E71361A777BC02F5B64FDE41C657424C44102A80CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 53b718cd0f2156923dd529f2f3568feae48b80bd0e1d02bc7ffb5779f281a101
MD5 0be35d2e3542c45e76400cd947dcdbd8
SHA1 acd27a142d63b9bf3c44a9145820079d00b2255d
SHA512 6622d2985446f8496e895e6996d457dcb8851b4d78b871692543f2bbf08f734395442162fb6dbacab908ed4bc91054734272ffd32010fb813b1ebbdf0cf60033
TLSH
T1A721E03AADC51722C37AC77B91F611A9F736B821BAA75E4E01C287080D10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 8b02e54d41118a717bdd8317d33ebdb0b27d272b07ac103f16c28101add1067f
MD5 20620e42318e3c2b6fa95074cd020083
SHA1 7e2ae5b50af258178f255d48f365a75b1afc3778
SHA512 04f39c3982c92f59118738d3ba0fa9406e67f824723e02fcfb15300232f6794eb9945ab96b19f0d0c98b24db5fda6405f86becbf5cbeb137f1a573c9e738b1d9
TLSH
T12711823915E11B37D3B25B7A45E71361A777BC02F5B64FDE41C656425C40112A80CF6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 c2b354c509436ed66ca664dc74f0cdbf066b782b9dea6153f3e5d0c65ace7b51
MD5 4e8294c79ec44afc09cd7a924dd6b40a
SHA1 137241fa1d8ceb921d05be95b91f212381c667bc
SHA512 ebf3704b0f9b32ec78f937efa434233269587f67f9e2738998e19442ebee1747d2544da1e9d38b8b36828066db5735be9ee167c8374e650f15d03078f292949e
TLSH
T18811C22815D11B37D3B15B3A85E71361A777BC02F5B64FEF41C657414C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0738f105aad6520f90ee12e807ad82e7e881b67077cf819e8fe15edc75cae2e7
MD5 82d7d3ab49477dc4d6a646b941ead20d
SHA1 5b5fc9fa5e8fc8b0599448a7ffa3299a99bed053
SHA512 497294f7c05b77f12cf02ffb9769ab9c680516644c8cdcf5246bf243a609b45c6faccdc8c9015cd8d14b3cb3c64ef9da91d008243d9311a07d80bf295c881610
TLSH
T10B11CE2925E11B37E3B25B3A45E72361A777BC02F9BA4FDE40C656824C40202A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 89e3f144ccf5a9ca052ab32be263eed5c90889ffb86fcc1d59b4e5ef76a3bc48
MD5 9f259888e2c54f3f48b57bfe83e20cf9
SHA1 84f9313448fe3dde09e23e4dfe1332961e5eb635
SHA512 47742531bcb827f25114fd6835d1ba22dc50f20831ac121c757e79178ab8def360564c20f414ac0a649096dbf3556f41b81e30900fe03249ff7db3900c6fea58
TLSH
T1B611CE2925E11B37E3B25B7A45E72361A777BC02F9BA4FDE40C656825C40202A80CE7F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 f5d6d16008065d82d44ea326b01e3d7dc16909818b37903a31b2f702c85716fb
MD5 82f5086867e6d49f9cf2ccbb7ef96f7c
SHA1 038a3c9b92f9b544f3b8a1d0e0c9c2c381f4ad6f
SHA512 00fa9ba034884fce98e991a1f4dcc1ce49195fe063915a25994142279149a02090d7720e975090a5c93e71fc61076fb4616669de065815a78726dd3008b9b74a
TLSH
T12C11C22815D11B37D3B15B3A45E71361A777BC02F9B64FDF40C656424C40202A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 88723287fa1efddd7689fee76849d48228b3fd5d9fc5c4c3b59fda2939147d53
MD5 c97e16d20fdce43b8aeb246bc5794ca1
SHA1 0f15c6717323f2d0665cce80c3e13b1d6753e102
SHA512 d35e301538f400ff3d57dc9279526cc2b49ee9180405181bbcf42294d17e9330b900e02adeea934a997a427c637a96bab34a633336413dd79571ab7d098e64b5
TLSH
T15211822915D11B37D3B15B7A45E71361A777BC02F9B64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 888cbb5679f111c653b55a35e7f589897585198a73375e7f0548d5a4d368b574
MD5 90b1fc4360068f4a8dda7b13536ba91d
SHA1 3d3fe0a5f57bf7bed4d0449d8d4a21d68bd7288c
SHA512 784e480e8938a16580d764bcebe49efd3199b82054194063956e0eca6260f86af64f731ecab822ac44cf465e1b1c08891a7ff4aca90b200624cd958c846c018f
TLSH
T18121E03AADC51722C37AC67B91F611A9F736B821BAA35E4E01D287080C10B926901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 d17c5e77a05a065487eaf3350a2c3bf71b55fddf1dcb871c22b6cc6929b334f7
MD5 74c9276dbcf3cbb47642d538b1ff7263
SHA1 9faecf85bce46c5698a6ccdfa752514a7de1bb1d
SHA512 0358e004d0ae809c4e563b37d09ddb65bf5f05e2af966744cdc5571b5a0f66d1ced632f17f824614e1f8857ab7ef7770bdeb832ba9792018457d57dc18df8d1f
TLSH
T1AF11C22815D11B37D3B15B3A45E71361A777BC02F5B64FDF40C657424C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 ab3c879377aa45d8faedea6f3c8a954ac8bbdad56420392f195c7572a860a22c
MD5 36f4b084b1090874223a13060c9d3277
SHA1 1a16907ff4c7b3c8feeab33ceda761a12be2308f
SHA512 52923902720d52cc478dcbd5a05f19129ff9d6e3530299fdf7016e3207a2064bcbf70fc68b416b9a9b36496363d7abd87e389bede67aa7f827bdd337aa22972e
TLSH
T10421E03AADC51722C37AC67B91F612A9F736B821BAA35F4E01C287081D10B526901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3a136da4cc20437f646f558a6979e36232d6b41beadda8822efa8f8b3bf9a63a
MD5 a336f08616889aeb4517284b7a279c15
SHA1 59e608a7461f9bfe98e200de36bf468a44158b24
SHA512 3b16ff15124d44a11c48c52a9332f114b6966ae5c2d04ba21ac3981c4a3c6aa6c6fd79df5ef497b8e8e75adc7566a9bc1bc4317f34ab63a4b759b76b74808b0a
TLSH
T12C11822925D11B37D3F15B7A45E71361A777BC02F9B64FDE41C656425C40112A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 5e49fbd0695cc0c27a69752dad6c352a2bb907cf365a99ae49112e928b5108d4
MD5 44133e9d2aac35b84558b99f407bf70b
SHA1 fcb12a849188614437325cfa483d7bb24ab0cc15
SHA512 43b2228f049dda193ba382b5de984a97b145d7766c388b1d41d95bd2f0333a93782778349490dda6338a67b643646319ececb290cf96a9b385e6577d12bfd78f
TLSH
T10021E03AADC51722C37AD67B91F611A9F736F821BAA35E4E01C287080C10B536901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 4c179ec14f3e68e8480a57656ebfc126756d6c3da912be9ea693d2c1a4d9c662
MD5 80b09455f4ccc572862fe8858679bff9
SHA1 ff39326a5fa32d18790449d2c3fb5397e23a6dce
SHA512 05583c3dab04e0f975696eaa900f42cd577dc099f7afc3fed111999c899a8b3870ed9d89aa8e8e1c5b0d0dbbb62d09738a28e2a7a74c5067b44a8d07978d5f4a
TLSH
T14311C22815D11B37D3B15B3A45E71361A777BC02F5F64FDE40C656424C40102A84CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 3ee4ee63f9bbb225811a55b4bb46bb17e59aa5d10c7253781f6b46eb0bbc79bf
MD5 278eba32b76d5bc30b7a88384307aa19
SHA1 2d63705e1e2cd12d951abd5bc6f6313978303950
SHA512 72e1bf3caa79356f2faa76748cd920fb79b6fa1578aa0ac32d4b2347c6d1acfb4dda823dcd02665ab4d2e142ddae5a00937672e9a90609b604ee1069577cee3f
TLSH
T1C011C22915D11B37D3B15B3A45F71361A777BC02F5B64FDE40C656824C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 16259d665024ae3d47a01b9fa322dbd7b93b5b0db31ac599a7c387f6ba49d3b9
MD5 e51725156bce3650a0508b687c9b58ff
SHA1 5f2d8ae2029def04dc42168f76de9e31f070bc9b
SHA512 85d1c3158b28bde589fd7e8c9c810b1671cf8f45cb68e09a3e8c255596b8d0ad57016951814671210ba6616560fa46b3d052ac6607674eadc9353d2f104b3c7c
TLSH
T10121E03AADC51722C37AC67B91F711A9F736B821BAA75F4E01C287081C10B536901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 9533669d19c3c6c92506a86254b9e05edb1262bcffb02063c9bb54998f66bbc1
MD5 be6c30c8e1dd5403f887912bfcc58b91
SHA1 8844c3a6e8d4c9bc7edaf50e6a8aa776f438a5cb
SHA512 24bd5a36999ae3f51bb138c89112481dd6edc0dfc59b94ee00809986b5fa5cef61b4a22f006bb1c50bfe9d93712ffee95f22398b8c57d9b8201938ef582aa144
TLSH
T1FA11C22815D11B37D3B15B3A45E71361A777BC02F5B64FDE40C656425C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1KB
SHA256 72ae7717b1e2368a7236e31b525780881e3425d7de1a9587468ca2ca2476e191
MD5 65eea2f4636991c8d3ed2df495a66200
SHA1 a440b41496214b2967943ec4a666e22ad8a46b2e
SHA512 fcf248697ae66a6c9d72be15a437c79a2001667b3beb1819ed791e40374568bcdf49d67bb64ca2671cef24ace78cf4320a71bd36480671f8529b4aa80cd52470
TLSH
T1A521E03AADC51722C37AC67B91F721A9F736B821BAA75E4E01D287080C10B536901F1E
MD5 SHA1 SHA512 TLSH

Submit Download

Soft.lnk

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk
Size 1023B
SHA256 0376642ea62da430d5b2632b6044a413bddaa774079e16c1fe30c71c4501cf5d
MD5 6aee191f8ab1be440189301171f6f72e
SHA1 e7eab7c41ab6d943eebe929da0d1eceb859d07ec
SHA512 ed79f9d756f75f47bb9514582c4999623b66410159062febe2c22cd4bd716a2f8f45c2200c13a9e8c52df5803fcf0993304a18c1c8bad3d9607f832398be0656
TLSH
T18611C22815D11B37E3B15B3A45E71361A777BC02F9B64FDE40C656424C40102A80CE6F
MD5 SHA1 SHA512 TLSH

Submit Download

HelpMe.exe

Path C:\Windows\SysWOW64\HelpMe.exe
Size 2.3MB
SHA256 771fdb45329801a87761591cbc96c556965203ad52ff226d09a1c58c716c1fab
MD5 1d98148d896fda1af7fd514d58f017ed
SHA1 5ff47eda5d0f23a8ccf0583df8f82c214dbfabc8
SHA512 c67d52b429ab4cfffeba819a49c5e569e5ca39763ef11bff93002d1b35d8ad9c54101d5d2daa39c84e31fb7342b6c85adb79a5c5a72741a1980d90d8effe5a09
SSDEEP 24576:TEtl9mRda1cSS5GJ/zgzoPj1wQ2q8/VmnDIY4YC+a60ILphwPPmDoI3s8:oEs1hS5W/bvt8tC0YL3cInw3mET8
TLSH
T1C2B5C056B3F494B5D1BB8278CE47865BEBB17C012760968B13E43A4D2F33BA1792D312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

desktop.ini

Path F:\$RECYCLE.BIN\S-1-5-21-4046655672-1449839301-2197395821-1000\desktop.ini
Size 2.3MB
SHA256 e82d338abec59399ddf4ab49ef865d1365a68de5cf5774163521416515d8e6e6
MD5 bea2052bb4fffe8dda885775df9dab0b
SHA1 def76a8ee4146ddf109583c2747afad599976db0
SHA512 7aed5da2493580673f4c47e1edf247bb6d4cb8299bc782cc69b46ecd6691378929609846e71347e92f744bff99b41ec67773b68c6742f5e879a05dcde172775b
SSDEEP 24576:TEtl9mRda1cSS5GJ/zgzoPj1wQ2q8/VmnDIY4YC+a60ILphwPPmDoI3sW:oEs1hS5W/bvt8tC0YL3cInw3mETW
TLSH
T148B5C056B3F494B5D1BB8278CE47865BEBB17C012760968B13E43A4D2F33BA1792D312
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AUTORUN.INF

Path F:\AUTORUN.INF
Size 145B
SHA256 cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae
MD5 ca13857b2fd3895a39f09d9dde3cca97
SHA1 8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0
SHA512 55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47
TLSH
T188C04868F16A939D1E0C399093A400237083A208019E420E93DDE4A53DD41084F05188
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3324-180-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-97-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-243-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-115-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-233-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-223-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-132-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-213-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-1-0x0000000000460000-0x0000000000461000-memory.dmp

Download

memory/3324-0-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-2-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-152-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-42-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-81-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-196-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-44-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-48-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-65-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3324-168-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/3600-62-0x000000000D410000-0x000000000D75C000-memory.dmp

Download

memory/4976-153-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-8-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-244-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-234-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-224-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-169-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-53-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-133-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-187-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-45-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-214-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-98-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-82-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-203-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-116-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/4976-66-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-178-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-230-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-146-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-210-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-194-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-77-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-93-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-220-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-43-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-162-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-109-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-56-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-240-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-125-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-61-0x0000000000400000-0x0000000000477000-memory.dmp

Download

memory/5172-250-0x0000000000400000-0x0000000000477000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads