djvu | 5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de

Analysis

max time kernel
60s
max time network
140s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
23/12/2022, 22:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
Size

746KB
MD5

1c1aa12967b3ed3043ad16c1f8d6b54f
SHA1

dba7f6324ef35a521e136230a5f2b9686c7b2150
SHA256

5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de
SHA512

23e321cccdc1fd8fbb8f3e331e865bfc8f5270ffdadc8b7062e7a1aa8e05c0dba5f95682be3413e5325d70c0f6fab3bb61452695f920dc67fdacacbb2d5fc2e8
SSDEEP

12288:fbnxitpeOnShgCytH1SL1esWb/Ln+zpCL8037tXTLk8qKPqJWNVH/8:9iv341yp141eD/+zwL8aTXvqJWbH/

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://abibiall.com/test1/get.php

Attributes

extension
.isal
offline_id
m3KmScxfDyEQzJYP8qjOSfP4FvpsOXlekGuMPzt1
payload_url
http://uaery.top/dl/build2.exe

http://abibiall.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-Q5EougBEbU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0620IsgU

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral1/memory/1476-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1476-56-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1388-59-0x0000000001EF0000-0x000000000200B000-memory.dmp	family_djvu
behavioral1/memory/1476-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1476-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1476-66-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1084-69-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1084-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1084-80-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1084-94-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1284	build2.exe
1308	build2.exe

Loads dropped DLL 2 IoCs

pid	Process
1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
468	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2cac5ce4-2a19-4290-9ba6-bc555604d37d\\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe\" --AutoStart"	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
12	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1388 set thread context of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1184 set thread context of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1284 set thread context of 1308	1284	build2.exe	34

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1388 wrote to memory of 1476	1388	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	26
PID 1476 wrote to memory of 468	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	29
PID 1476 wrote to memory of 468	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	29
PID 1476 wrote to memory of 468	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	29
PID 1476 wrote to memory of 468	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	29
PID 1476 wrote to memory of 1184	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	30
PID 1476 wrote to memory of 1184	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	30
PID 1476 wrote to memory of 1184	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	30
PID 1476 wrote to memory of 1184	1476	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	30
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1184 wrote to memory of 1084	1184	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	31
PID 1084 wrote to memory of 1284	1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	32
PID 1084 wrote to memory of 1284	1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	32
PID 1084 wrote to memory of 1284	1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	32
PID 1084 wrote to memory of 1284	1084	5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe	32
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34
PID 1284 wrote to memory of 1308	1284	build2.exe	34

C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
"C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1388
- C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
  "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\2cac5ce4-2a19-4290-9ba6-bc555604d37d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:468
- - C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
    "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1184
  - - C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe
      "C:\Users\Admin\AppData\Local\Temp\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:1084
    - - C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe
        
        "C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1284
      - C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe
        
        "C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1308

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
d725336098482e86274e5930393506a1

SHA1
7cb24085418693dc0c0fc876b6f7d2d400a7c256

SHA256
a2550a47e8dee78c170ecdfc8918137469b6115cf32fedc091b80c7dea2701a1

SHA512
f67ff810c97f14f9704439a7a3d34588b013eedc97149298c833926bc92d12b1e76b68c684863f86f8dede7fc677139f6c8af8e83bd43cad965ed32bda15ed3f

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
bae107243c3c1cc23eb066f981b79948

SHA1
ed066a4326ae4eb5db4b00b0bb0290f006ad456c

SHA256
7d2ba9f4e363368512dc2388d792c3f971d18699234c4edab57ddd4053870026

SHA512
67a0ba993ab7abab0973683f134d71ed96cbff33368b222fc84e57def50c57d1c6d1c64362738baa9efa8cd84a3ccee30cc67284b2cd8ea53cbb8d1bfed94764

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
8255685e1c8154adb52a4a40966e1d60

SHA1
6cff9218a97bd0fe8adc9283dcdf2a79cdcd87aa

SHA256
b3a2c383775d86503b3783d00da0ea4419204c9752a277fabc9d08cafddf0061

SHA512
0e2afd08d9c2c1d303d800caac2bc5b0765b656654b9a7dcd5f69ce2c7625103f8f52ef25e0fb46e78a55332507c177fc66ba753618491fec065e389d8fc324d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
e3ffeb8c0262db1e29946b45b9dc0094

SHA1
d7299622fcaf4d465e4d47e51dacdea5e227b4c1

SHA256
80c40840c0f8e0052580a9beaa805e420d352e3e4b060a6c9fa2b96db96f8ada

SHA512
a117cf75f2090201ef180038e53c7304bfb46b0063547e2cfaa3a63ed15d7f2394243a00a715efcabb38d98cecf8df2181c7ef843fd7b3d3b4e2df44a1711962

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
e85e33e174da25b1496aba9b6df8f9c3

SHA1
d0915ceb401c57e451b3219119e4832091f306a6

SHA256
852449886eb7cdf09deb84c9401dbbd77ff978a366839833f2841cd456dc074f

SHA512
a2f51a6e929c62232bf238a5452251f961e1f4e1df028db89c5e4008a3db535092f5e1eb8c46c02e842f43ec455142602b8e1b79ba969e6e02c8668f414852a7

Download Submit
C:\Users\Admin\AppData\Local\2cac5ce4-2a19-4290-9ba6-bc555604d37d\5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de.exe

Filesize
746KB

MD5
1c1aa12967b3ed3043ad16c1f8d6b54f

SHA1
dba7f6324ef35a521e136230a5f2b9686c7b2150

SHA256
5de6cdcc448e4a6af82c795750603275f51e764a357e8439c9837268f0dad2de

SHA512
23e321cccdc1fd8fbb8f3e331e865bfc8f5270ffdadc8b7062e7a1aa8e05c0dba5f95682be3413e5325d70c0f6fab3bb61452695f920dc67fdacacbb2d5fc2e8

Download Submit
C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe

Filesize
409KB

MD5
a131064868de7468d2e768211431401b

SHA1
381ad582f72b30b4764afe0a817569b384be65a2

SHA256
027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

SHA512
40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

Download Submit
C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe

Filesize
409KB

MD5
a131064868de7468d2e768211431401b

SHA1
381ad582f72b30b4764afe0a817569b384be65a2

SHA256
027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

SHA512
40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

Download Submit
C:\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe

Filesize
409KB

MD5
a131064868de7468d2e768211431401b

SHA1
381ad582f72b30b4764afe0a817569b384be65a2

SHA256
027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

SHA512
40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

Download Submit
\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe

Filesize
409KB

MD5
a131064868de7468d2e768211431401b

SHA1
381ad582f72b30b4764afe0a817569b384be65a2

SHA256
027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

SHA512
40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

Download Submit
\Users\Admin\AppData\Local\e07cb935-e8ef-44eb-b933-005b64b5dccb\build2.exe

Filesize
409KB

MD5
a131064868de7468d2e768211431401b

SHA1
381ad582f72b30b4764afe0a817569b384be65a2

SHA256
027bcfc4c5b4a06371e94f4a6b5f69cbee5bcad651d91115132844a2c10885a1

SHA512
40fc84899d7bed5c49980f984e3c1446dece3861e5e107fa71e1876f4b778aa8369f03422a971d144f8e65f62a109f53ba94e86bc6ddec478d1bc71f3bb29309

Download Submit
memory/1084-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1084-94-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1084-80-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1184-71-0x0000000000360000-0x00000000003F1000-memory.dmp

Filesize
580KB

Download
memory/1184-67-0x0000000000360000-0x00000000003F1000-memory.dmp

Filesize
580KB

Download
memory/1284-91-0x00000000002A0000-0x00000000002F3000-memory.dmp

Filesize
332KB

Download
memory/1284-89-0x00000000004FC000-0x000000000052A000-memory.dmp

Filesize
184KB

Download
memory/1308-86-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1308-92-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1308-93-0x0000000000400000-0x0000000000467000-memory.dmp

Filesize
412KB

Download
memory/1388-57-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1388-59-0x0000000001EF0000-0x000000000200B000-memory.dmp

Filesize
1.1MB

Download
memory/1388-54-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1476-55-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1476-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1476-60-0x00000000768A1000-0x00000000768A3000-memory.dmp

Filesize
8KB

Download
memory/1476-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1476-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download