Analysis
-
max time kernel
64s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
05-08-2022 12:31
Static task
static1
Behavioral task
behavioral1
Sample
b7ea7d444d1ed5677537a96796a496dc.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
b7ea7d444d1ed5677537a96796a496dc.exe
Resource
win10v2004-20220721-en
General
-
Target
b7ea7d444d1ed5677537a96796a496dc.exe
-
Size
738KB
-
MD5
b7ea7d444d1ed5677537a96796a496dc
-
SHA1
738054720787a8f80e3a4f1bd92f08b3084190aa
-
SHA256
0336cc8aff0e4974ede9e8901abeb10f836d50619cef1cb59aa41b447cea1ca5
-
SHA512
6bfacd6fd078715661afc9e3657c625d8b941bfeeaf323ff798c7c7fb78c64f813c96c4a1cffeda08c2f820e8e315f0cc14944087a11d1502c4aeafaf068b2f0
Malware Config
Extracted
djvu
http://acacaca.org/test2/get.php
-
extension
.vvyu
-
offline_id
rE5LpDv2ftYRXAo7bC18EpzfRMTHSGjgfyIMfZt1
-
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-QsoSRIeAK6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0531Jhyjd
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral1/memory/1612-55-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1612-56-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1412-59-0x0000000003F20000-0x000000000403B000-memory.dmp family_djvu behavioral1/memory/1612-61-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1612-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1612-66-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1588-69-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/1588-73-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1588-74-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
build2.exebuild2.exepid process 1088 build2.exe 816 build2.exe -
Loads dropped DLL 2 IoCs
Processes:
b7ea7d444d1ed5677537a96796a496dc.exepid process 1588 b7ea7d444d1ed5677537a96796a496dc.exe 1588 b7ea7d444d1ed5677537a96796a496dc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
b7ea7d444d1ed5677537a96796a496dc.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\701caa9c-76e4-43c5-a903-f0dbb5adccd6\\b7ea7d444d1ed5677537a96796a496dc.exe\" --AutoStart" b7ea7d444d1ed5677537a96796a496dc.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 4 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
Processes:
b7ea7d444d1ed5677537a96796a496dc.exeb7ea7d444d1ed5677537a96796a496dc.exebuild2.exedescription pid process target process PID 1412 set thread context of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 set thread context of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1088 set thread context of 816 1088 build2.exe build2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
build2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 build2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString build2.exe -
Processes:
build2.exeb7ea7d444d1ed5677537a96796a496dc.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 1900000001000000100000006cf252fec3e8f20996de5d4dd9aef424030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131d00000001000000100000004558d512eecb27464920897de7b66053140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc41560858910090000000100000016000000301406082b0601050507030406082b060105050703010b000000010000001e000000440053005400200052006f006f00740020004300410020005800330000000f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d20000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e b7ea7d444d1ed5677537a96796a496dc.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\CABD2A79A1076A31F21D253635CB039D4329A5E8\Blob = 0400000001000000100000000cd2f9e0da1773e9ed864da5e370e74e14000000010000001400000079b459e67bb6e5e40173800888c81a58f6e99b6e030000000100000014000000cabd2a79a1076a31f21d253635cb039d4329a5e80f00000001000000200000003f0411ede9c4477057d57e57883b1f205b20cdc0f3263129b1ee0269a2678f631900000001000000100000002fe1f70bb05d7c92335bc5e05b984da620000000010000006f0500003082056b30820353a0030201020211008210cfb0d240e3594463e0bb63828b00300d06092a864886f70d01010b0500304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f74205831301e170d3135303630343131303433385a170d3335303630343131303433385a304f310b300906035504061302555331293027060355040a1320496e7465726e65742053656375726974792052657365617263682047726f7570311530130603550403130c4953524720526f6f7420583130820222300d06092a864886f70d01010105000382020f003082020a0282020100ade82473f41437f39b9e2b57281c87bedcb7df38908c6e3ce657a078f775c2a2fef56a6ef6004f28dbde68866c4493b6b163fd14126bbf1fd2ea319b217ed1333cba48f5dd79dfb3b8ff12f1219a4bc18a8671694a66666c8f7e3c70bfad292206f3e4c0e680aee24b8fb7997e94039fd347977c99482353e838ae4f0a6f832ed149578c8074b6da2fd0388d7b0370211b75f2303cfa8faeddda63abeb164fc28e114b7ecf0be8ffb5772ef4b27b4ae04c12250c708d0329a0e15324ec13d9ee19bf10b34a8c3f89a36151deac870794f46371ec2ee26f5b9881e1895c34796c76ef3b906279e6dba49a2f26c5d010e10eded9108e16fbb7f7a8f7c7e50207988f360895e7e237960d36759efb0e72b11d9bbc03f94905d881dd05b42ad641e9ac0176950a0fd8dfd5bd121f352f28176cd298c1a80964776e4737baceac595e689d7f72d689c50641293e593edd26f524c911a75aa34c401f46a199b5a73a516e863b9e7d72a712057859ed3e5178150b038f8dd02f05b23e7b4a1c4b730512fcc6eae050137c439374b3ca74e78e1f0108d030d45b7136b407bac130305c48b7823b98a67d608aa2a32982ccbabd83041ba2830341a1d605f11bc2b6f0a87c863b46a8482a88dc769a76bf1f6aa53d198feb38f364dec82b0d0a28fff7dbe21542d422d0275de179fe18e77088ad4ee6d98b3ac6dd27516effbc64f533434f0203010001a3423040300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff301d0603551d0e0416041479b459e67bb6e5e40173800888c81a58f6e99b6e300d06092a864886f70d01010b05000382020100551f58a9bcb2a850d00cb1d81a6920272908ac61755c8a6ef882e5692fd5f6564bb9b8731059d321977ee74c71fbb2d260ad39a80bea17215685f1500e59ebcee059e9bac915ef869d8f8480f6e4e99190dc179b621b45f06695d27c6fc2ea3bef1fcfcbd6ae27f1a9b0c8aefd7d7e9afa2204ebffd97fea912b22b1170e8ff28a345b58d8fc01c954b9b826cc8a8833894c2d843c82dfee965705ba2cbbf7c4b7c74e3b82be31c822737392d1c280a43939103323824c3c9f86b255981dbe29868c229b9ee26b3b573a82704ddc09c789cb0a074d6ce85d8ec9efceabc7bbb52b4e45d64ad026cce572ca086aa595e315a1f7a4edc92c5fa5fbffac28022ebed77bbbe3717b9016d3075e46537c3707428cd3c4969cd599b52ae0951a8048ae4c3907cecc47a452952bbab8fbadd233537de51d4d6dd5a1b1c7426fe64027355ca328b7078de78d3390e7239ffb509c796c46d5b415b3966e7e9b0c963ab8522d3fd65be1fb08c284fe24a8a389daac6ae1182ab1a843615bd31fdc3b8d76f22de88d75df17336c3d53fb7bcb415fffdca2d06138e196b8ac5d8b37d775d533c09911ae9d41c1727584be0241425f67244894d19b27be073fb9b84f817451e17ab7ed9d23e2bee0d52804133c31039edd7a6c8fc60718c67fde478e3f289e0406cfa5543477bdec899be91743df5bdb5ffe8e1e57a2cd409d7e6222dade1827 build2.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 b7ea7d444d1ed5677537a96796a496dc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e b7ea7d444d1ed5677537a96796a496dc.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 0f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c1320000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 build2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
b7ea7d444d1ed5677537a96796a496dc.exeb7ea7d444d1ed5677537a96796a496dc.exebuild2.exepid process 1612 b7ea7d444d1ed5677537a96796a496dc.exe 1612 b7ea7d444d1ed5677537a96796a496dc.exe 1588 b7ea7d444d1ed5677537a96796a496dc.exe 816 build2.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
b7ea7d444d1ed5677537a96796a496dc.exeb7ea7d444d1ed5677537a96796a496dc.exeb7ea7d444d1ed5677537a96796a496dc.exeb7ea7d444d1ed5677537a96796a496dc.exebuild2.exedescription pid process target process PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1412 wrote to memory of 1612 1412 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1612 wrote to memory of 1776 1612 b7ea7d444d1ed5677537a96796a496dc.exe icacls.exe PID 1612 wrote to memory of 1776 1612 b7ea7d444d1ed5677537a96796a496dc.exe icacls.exe PID 1612 wrote to memory of 1776 1612 b7ea7d444d1ed5677537a96796a496dc.exe icacls.exe PID 1612 wrote to memory of 1776 1612 b7ea7d444d1ed5677537a96796a496dc.exe icacls.exe PID 1612 wrote to memory of 560 1612 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1612 wrote to memory of 560 1612 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1612 wrote to memory of 560 1612 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1612 wrote to memory of 560 1612 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 560 wrote to memory of 1588 560 b7ea7d444d1ed5677537a96796a496dc.exe b7ea7d444d1ed5677537a96796a496dc.exe PID 1588 wrote to memory of 1088 1588 b7ea7d444d1ed5677537a96796a496dc.exe build2.exe PID 1588 wrote to memory of 1088 1588 b7ea7d444d1ed5677537a96796a496dc.exe build2.exe PID 1588 wrote to memory of 1088 1588 b7ea7d444d1ed5677537a96796a496dc.exe build2.exe PID 1588 wrote to memory of 1088 1588 b7ea7d444d1ed5677537a96796a496dc.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe PID 1088 wrote to memory of 816 1088 build2.exe build2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\701caa9c-76e4-43c5-a903-f0dbb5adccd6" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe"C:\Users\Admin\AppData\Local\Temp\b7ea7d444d1ed5677537a96796a496dc.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exe"C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exe"C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exe"6⤵
- Executes dropped EXE
- Checks processor information in registry
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
340B
MD57cbc8d4d8ade607862b2102dfe7a5973
SHA16178fd07651d1a78db85a24594b0935a2479c73d
SHA25676c10e1c2eb7cfedb803dba464f93f435d52c1bfe4f210e01c299c1709ceebaf
SHA512a5ac20dcc16a41e18475ed497a7971126781c4ef5fd6464456cc9701abb20ffebc24a5d6f311cc8bc92de88bef9c230c8648f24dd1d307d519a05aa1c8e2e82a
-
C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
C:\Users\Admin\AppData\Local\701caa9c-76e4-43c5-a903-f0dbb5adccd6\b7ea7d444d1ed5677537a96796a496dc.exeFilesize
738KB
MD5b7ea7d444d1ed5677537a96796a496dc
SHA1738054720787a8f80e3a4f1bd92f08b3084190aa
SHA2560336cc8aff0e4974ede9e8901abeb10f836d50619cef1cb59aa41b447cea1ca5
SHA5126bfacd6fd078715661afc9e3657c625d8b941bfeeaf323ff798c7c7fb78c64f813c96c4a1cffeda08c2f820e8e315f0cc14944087a11d1502c4aeafaf068b2f0
-
\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
\Users\Admin\AppData\Local\6ab63295-935f-4453-af5c-80fe4fa41420\build2.exeFilesize
438KB
MD52f3d0323ba962334ef87ed098ad02289
SHA15b4c70e331af83eaf384f45a01e322b094353375
SHA25612a51367c5c85ff3c1dc73743cface2e01accecf2879a36adbddf566d52987b3
SHA5121e33ace1068f614bfac35aa67733c2806328b586be273a611409df87be03c5edc9e312ab213004c8fab71453ef5e34e474d9273c4a97d95d135c18f440674ad3
-
memory/560-65-0x0000000000000000-mapping.dmp
-
memory/560-67-0x0000000000320000-0x00000000003B2000-memory.dmpFilesize
584KB
-
memory/560-71-0x0000000000320000-0x00000000003B2000-memory.dmpFilesize
584KB
-
memory/816-90-0x0000000060900000-0x0000000060992000-memory.dmpFilesize
584KB
-
memory/816-86-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/816-80-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/816-109-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/816-81-0x000000000041FE8C-mapping.dmp
-
memory/816-89-0x0000000000400000-0x0000000000459000-memory.dmpFilesize
356KB
-
memory/1088-84-0x00000000005BB000-0x00000000005E4000-memory.dmpFilesize
164KB
-
memory/1088-77-0x0000000000000000-mapping.dmp
-
memory/1088-85-0x0000000000220000-0x0000000000266000-memory.dmpFilesize
280KB
-
memory/1412-59-0x0000000003F20000-0x000000000403B000-memory.dmpFilesize
1.1MB
-
memory/1412-54-0x0000000002540000-0x00000000025D2000-memory.dmpFilesize
584KB
-
memory/1412-58-0x0000000002540000-0x00000000025D2000-memory.dmpFilesize
584KB
-
memory/1588-74-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1588-73-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1588-69-0x0000000000424141-mapping.dmp
-
memory/1612-66-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1612-62-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1612-61-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1612-60-0x0000000076291000-0x0000000076293000-memory.dmpFilesize
8KB
-
memory/1612-56-0x0000000000424141-mapping.dmp
-
memory/1612-55-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1776-63-0x0000000000000000-mapping.dmp