Analysis
-
max time kernel
53s -
max time network
106s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 09:21
Static task
static1
Behavioral task
behavioral1
Sample
24b6effdd763befb6ff4a657e15c77bc.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
24b6effdd763befb6ff4a657e15c77bc.exe
Resource
win10v2004-20220721-en
General
-
Target
24b6effdd763befb6ff4a657e15c77bc.exe
-
Size
857KB
-
MD5
24b6effdd763befb6ff4a657e15c77bc
-
SHA1
dd09691ceccd54d7e68a9c6553a6b94452dc7c85
-
SHA256
d0202dee37da4da0375e0034e802e0351cf3185cc8cd6ad041ffca4c89d97797
-
SHA512
0e72593a34574b463b9db613c2c14ce73c10063c382fac8e2a8f9dfc10b38784fd3f2b83d92ef72f1720988d158da5872d79ac50ece53ac08e98b89dfc8b7112
Malware Config
Extracted
djvu
http://acacaca.org/test2/get.php
-
extension
.vvyu
-
offline_id
rE5LpDv2ftYRXAo7bC18EpzfRMTHSGjgfyIMfZt1
-
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-QsoSRIeAK6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0531Jhyjd
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1296-55-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1296-56-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1940-60-0x0000000000500000-0x000000000061B000-memory.dmp family_djvu behavioral1/memory/1296-61-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1296-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1296-66-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1512-69-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1512-73-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1512-74-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
build2.exebuild2.exepid process 1480 build2.exe 1796 build2.exe -
Loads dropped DLL 2 IoCs
Processes:
24b6effdd763befb6ff4a657e15c77bc.exepid process 1512 24b6effdd763befb6ff4a657e15c77bc.exe 1512 24b6effdd763befb6ff4a657e15c77bc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
24b6effdd763befb6ff4a657e15c77bc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\39c91335-c492-4db8-8416-9abe37b1308a\\24b6effdd763befb6ff4a657e15c77bc.exe\" --AutoStart" 24b6effdd763befb6ff4a657e15c77bc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 4 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
Processes:
24b6effdd763befb6ff4a657e15c77bc.exe24b6effdd763befb6ff4a657e15c77bc.exebuild2.exedescription pid process target process PID 1940 set thread context of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 set thread context of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1480 set thread context of 1796 1480 build2.exe build2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Processes:
24b6effdd763befb6ff4a657e15c77bc.exebuild2.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 24b6effdd763befb6ff4a657e15c77bc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 24b6effdd763befb6ff4a657e15c77bc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 24b6effdd763befb6ff4a657e15c77bc.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
24b6effdd763befb6ff4a657e15c77bc.exe24b6effdd763befb6ff4a657e15c77bc.exebuild2.exepid process 1296 24b6effdd763befb6ff4a657e15c77bc.exe 1296 24b6effdd763befb6ff4a657e15c77bc.exe 1512 24b6effdd763befb6ff4a657e15c77bc.exe 1796 build2.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
24b6effdd763befb6ff4a657e15c77bc.exe24b6effdd763befb6ff4a657e15c77bc.exe24b6effdd763befb6ff4a657e15c77bc.exe24b6effdd763befb6ff4a657e15c77bc.exebuild2.exedescription pid process target process PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1940 wrote to memory of 1296 1940 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1296 wrote to memory of 844 1296 24b6effdd763befb6ff4a657e15c77bc.exe icacls.exe PID 1296 wrote to memory of 844 1296 24b6effdd763befb6ff4a657e15c77bc.exe icacls.exe PID 1296 wrote to memory of 844 1296 24b6effdd763befb6ff4a657e15c77bc.exe icacls.exe PID 1296 wrote to memory of 844 1296 24b6effdd763befb6ff4a657e15c77bc.exe icacls.exe PID 1296 wrote to memory of 580 1296 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1296 wrote to memory of 580 1296 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1296 wrote to memory of 580 1296 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1296 wrote to memory of 580 1296 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 580 wrote to memory of 1512 580 24b6effdd763befb6ff4a657e15c77bc.exe 24b6effdd763befb6ff4a657e15c77bc.exe PID 1512 wrote to memory of 1480 1512 24b6effdd763befb6ff4a657e15c77bc.exe build2.exe PID 1512 wrote to memory of 1480 1512 24b6effdd763befb6ff4a657e15c77bc.exe build2.exe PID 1512 wrote to memory of 1480 1512 24b6effdd763befb6ff4a657e15c77bc.exe build2.exe PID 1512 wrote to memory of 1480 1512 24b6effdd763befb6ff4a657e15c77bc.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe PID 1480 wrote to memory of 1796 1480 build2.exe build2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\39c91335-c492-4db8-8416-9abe37b1308a" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe"C:\Users\Admin\AppData\Local\Temp\24b6effdd763befb6ff4a657e15c77bc.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exe"C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exe"C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD5fdcfc2c71db559c41d78bc98e3af6ca8
SHA1cad9d0a6262301120efa536af4b3b4c7db78c931
SHA2560ae038f00a58193faa943a47f780c99fe871e1804e0a9ec6bc30b09aeb39fbc9
SHA5123113d4d88538acccdb72f0b59e4625106c01aaa8fb31aa445024d8d79be66c927bb64572a7d4076a0c545b2a636d69a93b97bbfc0eeeeb40bdefbfd8dcd9baa2
-
C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\39c91335-c492-4db8-8416-9abe37b1308a\24b6effdd763befb6ff4a657e15c77bc.exeFilesize
857KB
MD524b6effdd763befb6ff4a657e15c77bc
SHA1dd09691ceccd54d7e68a9c6553a6b94452dc7c85
SHA256d0202dee37da4da0375e0034e802e0351cf3185cc8cd6ad041ffca4c89d97797
SHA5120e72593a34574b463b9db613c2c14ce73c10063c382fac8e2a8f9dfc10b38784fd3f2b83d92ef72f1720988d158da5872d79ac50ece53ac08e98b89dfc8b7112
-
\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
\Users\Admin\AppData\Local\1c0a05f0-5561-42ff-9418-6010ae145e7e\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
memory/580-67-0x0000000000230000-0x00000000002C1000-memory.dmpFilesize
580KB
-
memory/580-65-0x0000000000000000-mapping.dmp
-
memory/580-71-0x0000000000230000-0x00000000002C1000-memory.dmpFilesize
580KB
-
memory/844-63-0x0000000000000000-mapping.dmp
-
memory/1296-62-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1296-66-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1296-61-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1296-59-0x00000000762A1000-0x00000000762A3000-memory.dmpFilesize
8KB
-
memory/1296-56-0x0000000000424141-mapping.dmp
-
memory/1296-55-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1480-84-0x000000000059B000-0x00000000005C4000-memory.dmpFilesize
164KB
-
memory/1480-77-0x0000000000000000-mapping.dmp
-
memory/1480-86-0x0000000000220000-0x0000000000266000-memory.dmpFilesize
280KB
-
memory/1512-73-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1512-69-0x0000000000424141-mapping.dmp
-
memory/1512-74-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1796-89-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1796-80-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1796-81-0x000000000041FE8C-mapping.dmp
-
memory/1796-85-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1796-109-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1796-90-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/1940-54-0x0000000000220000-0x00000000002B1000-memory.dmpFilesize
580KB
-
memory/1940-58-0x0000000000220000-0x00000000002B1000-memory.dmpFilesize
580KB
-
memory/1940-60-0x0000000000500000-0x000000000061B000-memory.dmpFilesize
1.1MB