djvu | ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8

Analysis

max time kernel
47s
max time network
144s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
12/12/2022, 19:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
Size

800KB
MD5

803fd0050ba2d539017e9fa6efd1ea27
SHA1

eaf496fa3255aceecdb170c43190a9b628f03b75
SHA256

ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8
SHA512

b8747c794eb0b0a7a9bda2af480c1d43da7ed054e30a83e33376e104d7774a1e57e42856c4925421b75e215a76e67515ffe8496b9dd855f285b634b8f1d48ab3
SSDEEP

12288:iMcNIJl3u5ssGW2e+eMaloP7HfTP4wHBTymsH+iSnwzuk6KB4ct2YdgtCtg:ijwx3PeTlgTP4whq+iSn6z8

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://abibiall.com/test2/get.php

Attributes

extension
.maos
offline_id
M6quF9d1g2LNWnBiQpTSgbW26JwEOrFwFfT1xGt1
payload_url
http://uaery.top/dl/build2.exe

http://abibiall.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-67n37yZLXk Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0615JOsie

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral1/memory/1704-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1704-56-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1276-59-0x0000000001D40000-0x0000000001E5B000-memory.dmp	family_djvu
behavioral1/memory/1704-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1704-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1704-67-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/392-69-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/392-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/392-80-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/392-102-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
1524	build2.exe
1812	build2.exe
1508	build3.exe
1884	mstsca.exe

Loads dropped DLL 4 IoCs

pid	Process
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
576	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\5f4d359b-1261-4016-8f0d-a3f09e8d6ac7\\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe\" --AutoStart"	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.2ip.ua
3	api.2ip.ua
4	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1056 set thread context of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1524 set thread context of 1812	1524	build2.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
904	schtasks.exe
1820	schtasks.exe

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1276 wrote to memory of 1704	1276	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	28
PID 1704 wrote to memory of 576	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	31
PID 1704 wrote to memory of 576	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	31
PID 1704 wrote to memory of 576	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	31
PID 1704 wrote to memory of 576	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	31
PID 1704 wrote to memory of 1056	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	32
PID 1704 wrote to memory of 1056	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	32
PID 1704 wrote to memory of 1056	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	32
PID 1704 wrote to memory of 1056	1704	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	32
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 1056 wrote to memory of 392	1056	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	33
PID 392 wrote to memory of 1524	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	34
PID 392 wrote to memory of 1524	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	34
PID 392 wrote to memory of 1524	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	34
PID 392 wrote to memory of 1524	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	34
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 1524 wrote to memory of 1812	1524	build2.exe	36
PID 392 wrote to memory of 1508	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	37
PID 392 wrote to memory of 1508	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	37
PID 392 wrote to memory of 1508	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	37
PID 392 wrote to memory of 1508	392	ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe	37
PID 1508 wrote to memory of 904	1508	build3.exe	38
PID 1508 wrote to memory of 904	1508	build3.exe	38
PID 1508 wrote to memory of 904	1508	build3.exe	38
PID 1508 wrote to memory of 904	1508	build3.exe	38
PID 2028 wrote to memory of 1884	2028	taskeng.exe	41
PID 2028 wrote to memory of 1884	2028	taskeng.exe	41
PID 2028 wrote to memory of 1884	2028	taskeng.exe	41
PID 2028 wrote to memory of 1884	2028	taskeng.exe	41
PID 1884 wrote to memory of 1820	1884	mstsca.exe	42
PID 1884 wrote to memory of 1820	1884	mstsca.exe	42
PID 1884 wrote to memory of 1820	1884	mstsca.exe	42
PID 1884 wrote to memory of 1820	1884	mstsca.exe	42

C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
"C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
  "C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1704
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\5f4d359b-1261-4016-8f0d-a3f09e8d6ac7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:576
- - C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
    "C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1056
  - - C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe
      "C:\Users\Admin\AppData\Local\Temp\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:392
    - - C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe
        
        "C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1524
      - C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe
        
        "C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1812
    - - C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe
        
        "C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        
        PID:1508
      - C:\Windows\SysWOW64\schtasks.exe
        
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        6⤵
        Creates scheduled task(s)
        
        PID:904

C:\Windows\system32\taskeng.exe
taskeng.exe {99EF7DB8-5BDF-4C2D-8A22-930FE9F08D15} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    3⤵
    - Creates scheduled task(s)
    PID:1820

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
a3ba06b0a900ef1f790d2d1faa188e08

SHA1
51f7daf4a2bd9c1a9d52bbb62989c7208b71cd98

SHA256
30d532e2ce3f53e0865186393000a9a8af1318ab251ebabb168b0bc84bebe4b9

SHA512
9ad7d398badf9c48caa8473f4e120a82eba1c37f4885fe19ec34d173821456653a14185bb628338555155035fd77c782525b32385036317140eadaf4918b8e5b

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
59e98119dbb289e1c12576b7f5f58831

SHA1
d8e74af395a1976a9232d626215333931a3f23ce

SHA256
fa68e1f0d87d4ed9a1891e1760cc6c9c6c015547a982e8fb07e58f4d14e38c8f

SHA512
672d7926f26f36a8d2c3c3871d8c37249b2d376b2cad82ad01280d9680d0d18bdf65626db48120b7bca1a59ccc49c36b84a7e454235634376e14de03ce11b39c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
f96dec3a7050ec434136c35e42ba1035

SHA1
69b88406d1d26dcb950f444af88a31d6de52831f

SHA256
5420917ce44bb775420ef400a1d08279fd0aef62d28c495eac1fa4b676eb57a4

SHA512
029e87aee7487f2c5f1dcb2ab6473f3d9e49e229445e9c1b8da4cbaf5d490521cb837edde4f214c5d50156e8003fd0e5c9993a9095a42d60b8fba1d273030b42

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
5d949b91b0e7cb5a5c27a4dd9b558f63

SHA1
6c6b97962776b9d748d8fc5a2d9820644867d778

SHA256
439f2010cc47bcadd9a1d13770b02c31b2fdd7b0e013252548ec4e42c8d86818

SHA512
664d9e1c7f1f4ceb15c6edc3342c5bf5733908115e0119e1805bda558359aaf0444f260904d08640719c64a9380125a9799dca52904f4334f510d75c95eb53e2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
02e37cf9aaa3f7a9fbf8d9fe067a88cc

SHA1
d6fd25769525a6c3e2708b43bda75b33c3f836cc

SHA256
1a14bced1afee2853c8e7d7dea849aa39fad549a42298ece19f709076858403e

SHA512
efa22bd9586cf0a744e166be543193023cc85497afc759757433a7b4d609162ae5e2d1da9567eac023dfec01fe8a4a0ebf7bf68f5d68115751f4df541f869aa5

Download Submit
C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe

Filesize
370KB

MD5
6a7892ece7e8bf85628e0e769560b7cb

SHA1
e13140e719218b14dd168467a63d481c7259df8c

SHA256
363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844

SHA512
0091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f

Download Submit
C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe

Filesize
370KB

MD5
6a7892ece7e8bf85628e0e769560b7cb

SHA1
e13140e719218b14dd168467a63d481c7259df8c

SHA256
363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844

SHA512
0091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f

Download Submit
C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe

Filesize
370KB

MD5
6a7892ece7e8bf85628e0e769560b7cb

SHA1
e13140e719218b14dd168467a63d481c7259df8c

SHA256
363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844

SHA512
0091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f

Download Submit
C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Local\5f4d359b-1261-4016-8f0d-a3f09e8d6ac7\ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8.exe

Filesize
800KB

MD5
803fd0050ba2d539017e9fa6efd1ea27

SHA1
eaf496fa3255aceecdb170c43190a9b628f03b75

SHA256
ae693c41c3a9ca506fa3d737329e307edf548221d9f9c1d21158d760534b7de8

SHA512
b8747c794eb0b0a7a9bda2af480c1d43da7ed054e30a83e33376e104d7774a1e57e42856c4925421b75e215a76e67515ffe8496b9dd855f285b634b8f1d48ab3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe

Filesize
370KB

MD5
6a7892ece7e8bf85628e0e769560b7cb

SHA1
e13140e719218b14dd168467a63d481c7259df8c

SHA256
363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844

SHA512
0091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f

Download Submit
\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build2.exe

Filesize
370KB

MD5
6a7892ece7e8bf85628e0e769560b7cb

SHA1
e13140e719218b14dd168467a63d481c7259df8c

SHA256
363dd986f98ab17b465354c93bd6f2b391b81593887dc88a0818d3d07264f844

SHA512
0091f76a7acf12ce121cc89702bbc7116cd91c4d69be1aaded7deabff92f7a913572d50b37b4ea0ac5cec28ceb4d2a505ed5dd7e98fa13ded39d1114a0ca7e7f

Download Submit
\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
\Users\Admin\AppData\Local\527f9594-bac3-4df5-a15b-b4dedd16ff20\build3.exe

Filesize
9KB

MD5
9ead10c08e72ae41921191f8db39bc16

SHA1
abe3bce01cd34afc88e2c838173f8c2bd0090ae1

SHA256
8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

SHA512
aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

Download Submit
memory/392-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/392-102-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/392-80-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1056-66-0x0000000000310000-0x00000000003A1000-memory.dmp

Filesize
580KB

Download
memory/1056-71-0x0000000000310000-0x00000000003A1000-memory.dmp

Filesize
580KB

Download
memory/1276-59-0x0000000001D40000-0x0000000001E5B000-memory.dmp

Filesize
1.1MB

Download
memory/1276-54-0x0000000000580000-0x0000000000611000-memory.dmp

Filesize
580KB

Download
memory/1276-58-0x0000000000580000-0x0000000000611000-memory.dmp

Filesize
580KB

Download
memory/1524-91-0x0000000000528000-0x000000000055A000-memory.dmp

Filesize
200KB

Download
memory/1524-85-0x0000000000528000-0x000000000055A000-memory.dmp

Filesize
200KB

Download
memory/1524-93-0x00000000002C0000-0x0000000000317000-memory.dmp

Filesize
348KB

Download
memory/1704-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1704-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1704-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1704-60-0x0000000075E01000-0x0000000075E03000-memory.dmp

Filesize
8KB

Download
memory/1704-55-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1812-92-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1812-101-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download
memory/1812-87-0x0000000000400000-0x000000000046B000-memory.dmp

Filesize
428KB

Download