djvu | 9afa91c839d958185548eccf40690eb7db7859a852ac06f3870a6165c287d6ba

Analysis

max time kernel
125s
max time network
137s
platform
windows7_x64
resource
win7v20210408
submitted
10/10/2021, 11:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
ac60b43d159dcac0a93ac6dd12ce0bc6.exe
Size 857KB
Sample211010-nyfc4afghk
SHA256 9afa91c839d958185548eccf40690eb7db7859a852ac06f3870a6165c287d6ba
MD5 ac60b43d159dcac0a93ac6dd12ce0bc6
SHA1 eb83e395c2f3c39eb297d3a192d4174a96e10455
SHA512 9bf9877eae988b4d1ee761ff53eeabd74fb39a858f9993db77d20311e3932f49c7dc5b93c383f03df3c5ee26892ecb1c20780901b623343ce9f493d5f4f0da57
MD5 SHA1 SHA512

Score

10^/10

djvu vidar 517 discovery persistence ransomware stealer suricata

Malware Config

Extracted

Family

vidar

Version

41.2

Botnet

https://mas.to/@serg4325

Attributes

profile_id
517

Extracted

Family

djvu

http://securebiz.org/fhsgtsspen6

Signatures

Detected Djvu ransomware 6 IoCs

resource	yara_rule
behavioral1/memory/1912-62-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1912-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/684-64-0x0000000001750000-0x000000000186B000-memory.dmp	family_djvu
behavioral1/memory/1912-65-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1504-71-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1504-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata

Vidar Stealer 4 IoCs

stealer

resource	yara_rule
behavioral1/memory/1560-86-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar
behavioral1/memory/1740-90-0x0000000000280000-0x0000000000356000-memory.dmp	family_vidar
behavioral1/memory/1560-87-0x00000000004A195D-mapping.dmp	family_vidar
behavioral1/memory/1560-91-0x0000000000400000-0x00000000004D9000-memory.dmp	family_vidar

Downloads MZ/PE file

Executes dropped EXE 8 IoCs

pid	Process
1740	build2.exe
1560	build2.exe
1536	build3.exe
1680	build3.exe
1020	mstsca.exe
664	mstsca.exe
2028	mstsca.exe
1580	mstsca.exe

Loads dropped DLL 8 IoCs

pid	Process
1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1796	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6f810c04-4c47-4504-b311-00f05e86f3b6\\ac60b43d159dcac0a93ac6dd12ce0bc6.exe\" --AutoStart"	ac60b43d159dcac0a93ac6dd12ce0bc6.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 684 set thread context of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 1764 set thread context of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1740 set thread context of 1560	1740	build2.exe	33
PID 1536 set thread context of 1680	1536	build3.exe	36
PID 1020 set thread context of 664	1020	mstsca.exe	43
PID 2028 set thread context of 1580	2028	mstsca.exe	47

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1636	1560	WerFault.exe	33

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1700	schtasks.exe
1608	schtasks.exe

Modifies system certificate store 2 TTPs 7 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510	build2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ac60b43d159dcac0a93ac6dd12ce0bc6.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe
1636	WerFault.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1636	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1636	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 684 wrote to memory of 1912	684	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	25
PID 1912 wrote to memory of 1796	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	28
PID 1912 wrote to memory of 1796	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	28
PID 1912 wrote to memory of 1796	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	28
PID 1912 wrote to memory of 1796	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	28
PID 1912 wrote to memory of 1764	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	29
PID 1912 wrote to memory of 1764	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	29
PID 1912 wrote to memory of 1764	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	29
PID 1912 wrote to memory of 1764	1912	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	29
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1764 wrote to memory of 1504	1764	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	30
PID 1504 wrote to memory of 1740	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	32
PID 1504 wrote to memory of 1740	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	32
PID 1504 wrote to memory of 1740	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	32
PID 1504 wrote to memory of 1740	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	32
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1740 wrote to memory of 1560	1740	build2.exe	33
PID 1504 wrote to memory of 1536	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	34
PID 1504 wrote to memory of 1536	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	34
PID 1504 wrote to memory of 1536	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	34
PID 1504 wrote to memory of 1536	1504	ac60b43d159dcac0a93ac6dd12ce0bc6.exe	34
PID 1560 wrote to memory of 1636	1560	build2.exe	35
PID 1560 wrote to memory of 1636	1560	build2.exe	35
PID 1560 wrote to memory of 1636	1560	build2.exe	35
PID 1560 wrote to memory of 1636	1560	build2.exe	35
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1536 wrote to memory of 1680	1536	build3.exe	36
PID 1680 wrote to memory of 1700	1680	build3.exe	37
PID 1680 wrote to memory of 1700	1680	build3.exe	37
PID 1680 wrote to memory of 1700	1680	build3.exe	37

C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe
"C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:684
- C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe
  "C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1912
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\6f810c04-4c47-4504-b311-00f05e86f3b6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1796
- - C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe
    "C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1764
  - - C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe
      "C:\Users\Admin\AppData\Local\Temp\ac60b43d159dcac0a93ac6dd12ce0bc6.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1504
    - - C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build2.exe
        
        "C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1740
      - C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build2.exe
        
        "C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build2.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1560
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1560 -s 880
        7⤵
        Loads dropped DLL
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: GetForegroundWindowSpam
        Suspicious use of AdjustPrivilegeToken
        
        PID:1636
    - - C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build3.exe
        
        "C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1536
      - C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build3.exe
        
        "C:\Users\Admin\AppData\Local\98115ce9-286c-4c70-8546-83ac43de81d6\build3.exe"
        6⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1680
        
        C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        7⤵
        Creates scheduled task(s)
        
        PID:1700

C:\Windows\system32\taskeng.exe
taskeng.exe {5E0EC69F-A596-4320-9EC9-7A1D05E1406F} S-1-5-21-2455352368-1077083310-2879168483-1000:QWOCTUPM\Admin:Interactive:[1]
1⤵
PID:1492
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:1020
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:664
  - - C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      4⤵
      Creates scheduled task(s)
      PID:1608
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  PID:2028
- - C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    3⤵
    - Executes dropped EXE
    PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-64-0x0000000001750000-0x000000000186B000-memory.dmp

Download

memory/684-60-0x0000000000260000-0x00000000002F1000-memory.dmp

Download

memory/1020-114-0x00000000033DD000-0x00000000033EE000-memory.dmp

Download

memory/1504-73-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1536-100-0x00000000032EE000-0x00000000032FE000-memory.dmp

Download

memory/1536-108-0x0000000000220000-0x0000000000224000-memory.dmp

Download

memory/1560-91-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1560-86-0x0000000000400000-0x00000000004D9000-memory.dmp

Download

memory/1636-110-0x00000000004C0000-0x00000000004C1000-memory.dmp

Download

memory/1680-102-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1680-109-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1740-84-0x0000000000AB9000-0x0000000000B35000-memory.dmp

Download

memory/1740-90-0x0000000000280000-0x0000000000356000-memory.dmp

Download

memory/1764-69-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/1912-65-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1912-63-0x0000000075C71000-0x0000000075C73000-memory.dmp

Download

memory/1912-61-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2028-122-0x000000000331D000-0x000000000332E000-memory.dmp

Download