Analysis
-
max time kernel
122s -
max time network
131s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
01-12-2021 07:56
Static task
static1
Behavioral task
behavioral1
Sample
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe
Resource
win10-en-20211014
General
-
Target
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe
-
Size
847KB
-
MD5
2d4445eb93e7f578faea18f9778394e6
-
SHA1
e1a5cb23e196a248fe928aadd002dbf8e786ffaa
-
SHA256
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a
-
SHA512
c4b6c88ca9c75acd3ffcc0ea8f8b4f57d2b60eadb0f8f8b9838dcf8fb8881f557a71cb58366d35ce808de1e0b9dadd16242accb0e3978d7dcc088c8c6448657b
Malware Config
Extracted
djvu
http://tbpws.top/fhsgtsspen6/get.php
-
extension
.wiot
-
offline_id
sZ9rF572Y03XTlUZsBUVlV9YksFOEsyIfGx58yt1
-
payload_url
http://securebiz.org/dl/build2.exe
http://tbpws.top/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CtDpAM1g5f Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: manager@mailtemp.ch Reserve e-mail address to contact us: managerhelper@airmail.cc Your personal ID: 0333gSd743d
Signatures
-
Detected Djvu ransomware 6 IoCs
Processes:
resource yara_rule behavioral1/memory/756-57-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/756-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1168-59-0x0000000001810000-0x000000000192B000-memory.dmp family_djvu behavioral1/memory/756-60-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1952-66-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1952-73-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-103686315-404690609-2047157615-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\56596757-24d2-4aea-805a-160f145e6ff6\\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe\" --AutoStart" f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 4 api.2ip.ua 5 api.2ip.ua 13 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exef3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exedescription pid process target process PID 1168 set thread context of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 set thread context of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exef3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exef3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exepid process 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe 1952 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe 1952 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exef3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exef3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exedescription pid process target process PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1168 wrote to memory of 756 1168 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 756 wrote to memory of 1056 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe icacls.exe PID 756 wrote to memory of 1056 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe icacls.exe PID 756 wrote to memory of 1056 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe icacls.exe PID 756 wrote to memory of 1056 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe icacls.exe PID 756 wrote to memory of 1492 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 756 wrote to memory of 1492 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 756 wrote to memory of 1492 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 756 wrote to memory of 1492 756 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe PID 1492 wrote to memory of 1952 1492 f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\56596757-24d2-4aea-805a-160f145e6ff6" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe"C:\Users\Admin\AppData\Local\Temp\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
237cc7db072d97a949e15c2d8dbea891
SHA143ef7b53667e94ae04496fa6cf6efc7f9a8ba83f
SHA2567f9669eedb0bdb3b6647128101ec024ac5fc2447bd4372fbc8b4389f5d255acb
SHA51207c69dbcb95369ffcfdcbe402d582e7dcad1b5f2976f9156460197c891eefae41b43d2640df96d08c4ae2338a5c8d03aeaa662487d0635678d34622aede96b2b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
5db4d4fdb4428e5d3c794ed0a7c25958
SHA1374866bf683c5c6a3620d7dcfe29ef04221c4723
SHA25619ee4604acc3747d7a43fe1703dcacf39ca80e58a5f20e8607172b8f7037e45e
SHA5128ad3ce80577dfc0e4edfb40c548d6b5ba88ca22bca51d0c9fe757d9e155372fe4c212ae12e8f7ed13fd40369a0722399b41c5f0edf9eb03de57fbd9890b2989d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
c4accec818b6016eba452c10c9c2f488
SHA1e793457afbbc53ec9f0b2b4113b16352379fc78b
SHA256821992804d1cebe23d78c14e1aba61fbf6c88b711eaa7e12b1fff4d9fd6bebde
SHA512fab75d47d2802e382dfb3e1ac4896dbf547bada2bafff897dd7152f3e8bb4d597b626ae5b90a5b5d5ed543f4cfe33a3d24c8fd62e4c3985ac7b5f9d1ee1fabde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015MD5
a4b4e2754ca1b67d75c024d40e0d4f05
SHA1a208e97c0390b42cdf91a9d5adb4e4c9569bc1b7
SHA256a10b5ca97ad022ef8e28b81abaed56ba709918db07a74840e2220df0f7c6f4a1
SHA51242638829f05fea66f197e2ba0d1f90f77c44ae3d38b967af4fc32f86e672d62a7f0136b18954a228672ab573a3113341911a06166e5da4a478c7648ea0a75345
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
ba6a5d43c8d145069fd85e896d133b83
SHA1ea65173c993c71b3c0309cc8470c0660671a1741
SHA25672af383d76f829f3a708ad766d090f1f9b7180eb4d51d0e04eb2a224f6ddd7e3
SHA51261b331e2e83274222d08d89df3a118eede286357f4f7e2758d54e1ac22d2343c3423a941e5fd4769ad499f16a39d4b1dd2c5a61d8468644a4a6fc8a61c1eda1e
-
C:\Users\Admin\AppData\Local\56596757-24d2-4aea-805a-160f145e6ff6\f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a.bin.exeMD5
2d4445eb93e7f578faea18f9778394e6
SHA1e1a5cb23e196a248fe928aadd002dbf8e786ffaa
SHA256f3a4459b98919ba055a2c9437d092d18c889d5a1bbaea31a2cbe5ac250bc600a
SHA512c4b6c88ca9c75acd3ffcc0ea8f8b4f57d2b60eadb0f8f8b9838dcf8fb8881f557a71cb58366d35ce808de1e0b9dadd16242accb0e3978d7dcc088c8c6448657b
-
memory/756-57-0x0000000000424141-mapping.dmp
-
memory/756-56-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/756-58-0x00000000760C1000-0x00000000760C3000-memory.dmpFilesize
8KB
-
memory/756-60-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1056-61-0x0000000000000000-mapping.dmp
-
memory/1168-59-0x0000000001810000-0x000000000192B000-memory.dmpFilesize
1.1MB
-
memory/1168-55-0x0000000000230000-0x00000000002C2000-memory.dmpFilesize
584KB
-
memory/1492-64-0x0000000000240000-0x00000000002D2000-memory.dmpFilesize
584KB
-
memory/1492-63-0x0000000000000000-mapping.dmp
-
memory/1952-66-0x0000000000424141-mapping.dmp
-
memory/1952-73-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB