djvu | f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2

General

Target

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Size

745KB
MD5

ea5f9e5a6230afdf746ca66d73a562fe
SHA1

e87f7c58123d206c0b2d6bbff53a776672337624
SHA256

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2
SHA512

f24dc06251bf035973737fee95bedb976ce0eaa0e671a02e364de5d5ea6584b00685aef1466dd1baebc4a74823ae69dc58f01a42a3b5015a02eab8066d61ccdc

Score

10^/10

djvu discovery persistence ransomware suricata

Malware Config

Extracted

Family

djvu

C2

http://cjto.top/nddddhsspen6/get.php

Attributes

extension
.ogdo
offline_id
XIyyRCNH8lJ6pGHLNnQPCMfabY9p3AQCEQc3Lnt1
payload_url
http://cjto.top/files/penelop/updatewin1.exe

http://cjto.top/files/penelop/updatewin2.exe

http://cjto.top/files/penelop/updatewin.exe

http://cjto.top/files/penelop/3.exe

http://cjto.top/files/penelop/4.exe

http://cjto.top/files/penelop/5.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-SY0GqQtRAT Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0250riuyfgh

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 4 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1528-57-0x0000000000A10000-0x0000000000B2A000-memory.dmp	family_djvu
behavioral1/memory/1528-58-0x0000000000400000-0x0000000000A0A000-memory.dmp	family_djvu
behavioral1/memory/844-71-0x0000000000400000-0x0000000000A0A000-memory.dmp	family_djvu
behavioral1/memory/940-77-0x0000000000400000-0x0000000000A0A000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
suricata: ET MALWARE APT-C-23 Activity (GET)
suricata: ET MALWARE APT-C-23 Activity (GET)
suricata
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata: ET MALWARE Win32/Filecoder.STOP Variant Request for Public Key
suricata
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata: ET MALWARE Win32/Vodkagats Loader Requesting Payload
suricata
Executes dropped EXE 1 IoCs

Processes:

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

pid process

940 f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

572 icacls.exe

pid	process
940	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

pid	process
572	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\bdd485ec-7f45-45b4-9abb-e13825cd571f\\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe\" --AutoStart"	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
12 api.2ip.ua
31 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
12	api.2ip.ua
31	api.2ip.ua

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exef7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exef7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exef7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

pid	process
1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
844	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
844	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
940	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
940	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exetaskeng.exe

description	pid	process	target process
PID 1528 wrote to memory of 572	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	icacls.exe
PID 1528 wrote to memory of 572	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	icacls.exe
PID 1528 wrote to memory of 572	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	icacls.exe
PID 1528 wrote to memory of 572	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	icacls.exe
PID 1528 wrote to memory of 844	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1528 wrote to memory of 844	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1528 wrote to memory of 844	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1528 wrote to memory of 844	1528	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1772 wrote to memory of 940	1772	taskeng.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1772 wrote to memory of 940	1772	taskeng.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1772 wrote to memory of 940	1772	taskeng.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
PID 1772 wrote to memory of 940	1772	taskeng.exe	f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

C:\Users\Admin\AppData\Local\Temp\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
"C:\Users\Admin\AppData\Local\Temp\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe"
1⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\bdd485ec-7f45-45b4-9abb-e13825cd571f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:572
- C:\Users\Admin\AppData\Local\Temp\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
  "C:\Users\Admin\AppData\Local\Temp\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  PID:844

C:\Windows\system32\taskeng.exe
taskeng.exe {FBABAFAC-3D62-4990-A988-6A5AE81FF7C1} S-1-5-21-2277218442-1199762539-2004043321-1000:AUVQQRRF\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\bdd485ec-7f45-45b4-9abb-e13825cd571f\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe
  C:\Users\Admin\AppData\Local\bdd485ec-7f45-45b4-9abb-e13825cd571f\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe --Task
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Install Root Certificate

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
727B

MD5
8ae6f45bb6c9f288a96a3402dc17e2d9

SHA1
9ddb0d782cb4728675a1f5b61cfc632997349cdf

SHA256
ae4681e5db7de9744bdd78a943d6be6a390aa925125935d6cb691a27c8b2ebd3

SHA512
ee94f18f21437c1fba42cca69d535997c89438801ea6e823e99d384e9bc0239b041dc5ed854063a571bac2bbd2f83d7113c7f456d130b15e7db847e7fe4e8ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
60KB

MD5
b9f21d8db36e88831e5352bb82c438b3

SHA1
4a3c330954f9f65a2f5fd7e55800e46ce228a3e2

SHA256
998e0209690a48ed33b79af30fc13851e3e3416bed97e3679b6030c10cab361e

SHA512
d4a2ac7c14227fbaf8b532398fb69053f0a0d913273f6917027c8cadbba80113fdbec20c2a7eb31b7bb57c99f9fdeccf8576be5f39346d8b564fc72fb1699476

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
471B

MD5
b1c4234d2346ca5a2267de9f0bab4b81

SHA1
d6d10976b258ee86430063fdfb1838bb73838aeb

SHA256
e75d5e79323e42e337cf188a296db211f5d7dd488d03adf4b1be7836f997e3ed

SHA512
8b1d4c34ad847b73d060cb35dba350032be0a8cd82637a5c52805c078ea986ea44446040f588fb4edda4a233e424bdb6dc3ba016b7647936ec4ef4f971ff1e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
402B

MD5
9e8439ebc4adcb91ed8621897735ec45

SHA1
47aa52c1e6000a79e423ace9c89da4dc219abd2c

SHA256
695d0c44edbb9dc3cecd0c7bd0278e0a0c00899fe95403fff6efcc0ac5d14ba7

SHA512
96b2b8a516a64fd81187a64584259d757b21df4912c852a83d6e6ae2bb839a974f641268e6d58ddd58d71981d78b55adffcfd1953d31934d493a28895a489465

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
e07a95359dd3f5499adafb00997675fe

SHA1
c48e28b0c209e9aaf7fd424beff1d9d3fcc03d7c

SHA256
462d46ff45610aef11a3e2f8726129294de0afcb2c6cdd42aa06d54fd22058ea

SHA512
db63b17ddecc7407ccf3aa766c85bffd9b0c4433b32d9ef59b55c178e5099e1a4d2dab8b16decc8333b7dd14c349df0644ebf8012f1e30c4514a243633649824

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
396B

MD5
cf55a1d105119580257dff9c5aa49ca5

SHA1
d55e781d0618d5a75e2eae8f259bb52d454a73d4

SHA256
5080e48336278b5f8a0d6943cfb2534824fb639e077f60e7ba8b5ff5403f626f

SHA512
42a3ced9fe36c5928bf23e6be7ae04c6ec3c09d56f28114f1769a0082ca0ebbbdfa5e30deafb6231147cdca5f0626e70ae13ce6a61b12cbfcc1d939b7bc75661

Download Submit
C:\Users\Admin\AppData\Local\bdd485ec-7f45-45b4-9abb-e13825cd571f\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

Filesize
745KB

MD5
ea5f9e5a6230afdf746ca66d73a562fe

SHA1
e87f7c58123d206c0b2d6bbff53a776672337624

SHA256
f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2

SHA512
f24dc06251bf035973737fee95bedb976ce0eaa0e671a02e364de5d5ea6584b00685aef1466dd1baebc4a74823ae69dc58f01a42a3b5015a02eab8066d61ccdc

Download Submit
C:\Users\Admin\AppData\Local\bdd485ec-7f45-45b4-9abb-e13825cd571f\f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2.exe

Filesize
745KB

MD5
ea5f9e5a6230afdf746ca66d73a562fe

SHA1
e87f7c58123d206c0b2d6bbff53a776672337624

SHA256
f7416e3f009957168dba525532072bcdb53ef2e20e8f6891ac5ad5a16b5f16c2

SHA512
f24dc06251bf035973737fee95bedb976ce0eaa0e671a02e364de5d5ea6584b00685aef1466dd1baebc4a74823ae69dc58f01a42a3b5015a02eab8066d61ccdc

Download Submit
memory/572-59-0x0000000000000000-mapping.dmp

Download
memory/844-70-0x0000000000A90000-0x0000000000B21000-memory.dmp

Filesize
580KB

Download
memory/844-61-0x0000000000000000-mapping.dmp

Download
memory/844-62-0x0000000000A90000-0x0000000000B21000-memory.dmp

Filesize
580KB

Download
memory/844-71-0x0000000000400000-0x0000000000A0A000-memory.dmp

Filesize
6.0MB

Download
memory/940-72-0x0000000000000000-mapping.dmp

Download
memory/940-74-0x0000000000A80000-0x0000000000B11000-memory.dmp

Filesize
580KB

Download
memory/940-76-0x0000000000A80000-0x0000000000B11000-memory.dmp

Filesize
580KB

Download
memory/940-77-0x0000000000400000-0x0000000000A0A000-memory.dmp

Filesize
6.0MB

Download
memory/1528-56-0x0000000000290000-0x0000000000321000-memory.dmp

Filesize
580KB

Download
memory/1528-57-0x0000000000A10000-0x0000000000B2A000-memory.dmp

Filesize
1.1MB

Download
memory/1528-58-0x0000000000400000-0x0000000000A0A000-memory.dmp

Filesize
6.0MB

Download
memory/1528-55-0x0000000075C51000-0x0000000075C53000-memory.dmp

Filesize
8KB

Download
memory/1528-54-0x0000000000290000-0x0000000000321000-memory.dmp

Filesize
580KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads