djvu | bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc

Analysis

max time kernel
65s
max time network
144s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
19/01/2023, 11:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
Size

828KB
MD5

1c7c18d59d23a9901b0e2b8e48dcde2c
SHA1

4579072148edd252a0a6eaa87eea1a0f73599258
SHA256

bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc
SHA512

304acab2ba7208aa70253b7dde1e90e0782b480481174c61432843f3c7870e07501b7f502ad6c2f6fecba863cdca5792cc30bc3e5173127c002537951e19656d
SSDEEP

12288:gHR+kTeoUZ16muU4/0R2d4UloIh3BQ4Qpd0nuLpY4hR9f645zkOkTKS:gH3ZqXT4/Y2d1Q4udlXNfJ51kTv

Score

10^/10

djvu vidar 19 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://spaceris.com/lancer/get.php

Attributes

extension
.mzop
offline_id
ex4uvTKsM2vEkIcr3MjXi2C6v27h1mS682iUXGt1
payload_url
http://uaery.top/dl/build2.exe

http://spaceris.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-cud8EGMtyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0637hhsjf

rsa_pubkey.plain

Extracted

Family

vidar

Version

2.1

Botnet

https://t.me/jetbim

https://steamcommunity.com/profiles/76561199471266194

Attributes

profile_id
19

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral1/memory/952-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/952-56-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/1720-60-0x0000000001E70000-0x0000000001F8B000-memory.dmp	family_djvu
behavioral1/memory/952-61-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/952-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/952-66-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/848-69-0x0000000000424141-mapping.dmp	family_djvu
behavioral1/memory/848-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/848-80-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/848-94-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
1804	build2.exe
1768	build2.exe

Loads dropped DLL 2 IoCs

pid	Process
848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1140	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7b923b51-d76b-4b75-ace3-73bc48b373b9\\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe\" --AutoStart"	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.2ip.ua
3	api.2ip.ua
4	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1720 set thread context of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1076 set thread context of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1804 set thread context of 1768	1804	build2.exe	36

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 5 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 1720 wrote to memory of 952	1720	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	28
PID 952 wrote to memory of 1140	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	31
PID 952 wrote to memory of 1140	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	31
PID 952 wrote to memory of 1140	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	31
PID 952 wrote to memory of 1140	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	31
PID 952 wrote to memory of 1076	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	32
PID 952 wrote to memory of 1076	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	32
PID 952 wrote to memory of 1076	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	32
PID 952 wrote to memory of 1076	952	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	32
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 1076 wrote to memory of 848	1076	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	33
PID 848 wrote to memory of 1804	848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	34
PID 848 wrote to memory of 1804	848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	34
PID 848 wrote to memory of 1804	848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	34
PID 848 wrote to memory of 1804	848	bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe	34
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36
PID 1804 wrote to memory of 1768	1804	build2.exe	36

C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
"C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1720
- C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
  "C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe"
  2⤵
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:952
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\7b923b51-d76b-4b75-ace3-73bc48b373b9" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1140
- - C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
    "C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1076
  - - C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe
      "C:\Users\Admin\AppData\Local\Temp\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Modifies system certificate store
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:848
    - - C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe
        
        "C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:1804
      - C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe
        
        "C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe"
        6⤵
        Executes dropped EXE
        
        PID:1768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
2KB

MD5
f668969af5f91ebc063c10916957b5f0

SHA1
154f8af4e956880f374b7d9ca0a59be37d979eba

SHA256
971130ecefcbbbf90c16c913c8d56cb3bb9765edaf09490c6289dcd7faed47f0

SHA512
696d0361b41ba4db1b7ef8790e3449e9ab89f0ba146aefefbefc5afff3ed758dcf5cbc64311b2228bc97ef09771614c32d9a8d5c56a9322dfbcf1a5b2702da95

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015

Filesize
61KB

MD5
fc4666cbca561e864e7fdf883a9e6661

SHA1
2f8d6094c7a34bf12ea0bbf0d51ee9c5bb7939a5

SHA256
10f3deb6c452d749a7451b5d065f4c0449737e5ee8a44f4d15844b503141e65b

SHA512
c71f54b571e01f247f072be4bbebdf5d8410b67eb79a61e7e0d9853fe857ab9bd12f53e6af3394b935560178107291fc4be351b27deb388eba90ba949633d57d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
1KB

MD5
c2c1a9b0cafc44a493ecf30b565db71f

SHA1
59f89c9d3a7d0064b7c0776455a19da9f8284f58

SHA256
1e6b79c51887ec42c5358fc37f1157a77163657c25b2b27c68a5ef1baff4fce1

SHA512
eec0b3dc7ed29e03dc3b3cc560d56ed777bb2ffab37397dae9a0a0a68990d3277e9973c803bf44e32ccab25a05a928c66be5d291808071779b1b47f288309fea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
488B

MD5
8b2719292ca9ea3eb039a23c4813bc4e

SHA1
6bba1edbeeeea94ebf837bd117d4baa2b2cbac46

SHA256
7671bd0b2b08dd674207f7aa1f5cfdb44ac741e8fe2d623c12943c336d7b1332

SHA512
803f2b83400b1f686b9a97195859c661712039776254422278536efffa1e17111279c5506083be8a9b9b5d6620a558325380039bb6b7ef9c123165e3ac199b77

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
342B

MD5
4a26b65a27b7749487c59c74d9483093

SHA1
199415ed328367f842472d0183fd077ab61a9745

SHA256
6887699f18f7d340c6fc034a89aa865aab4ce191fab16e8b7676f95e0bab6322

SHA512
1a8c413b5d7166ab73382495c194fa972f2e733e4a38018d8d6bd36efaf086701acd284293604e80cb77f33ca235e807ff684e97210070990eae5f926d29617c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
482B

MD5
ef8fe00fb2f4ea8f2d6a6d9c740b2c72

SHA1
2f1a30e6081b2962d623a1a2d68f7535f6c3c671

SHA256
c7996abd25d5a528184281b43fa60079f9cf11da37c3c340029a6c59c4e50d6c

SHA512
555bc60acea27a3d90af9d11655b34a5750a2306ec130926993fb94204738fb5013de70515e37241720f51443e7406edefbf2b1dce5faba128ce0f145116f4a8

Download Submit
C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe

Filesize
343KB

MD5
7321ac833e240c7d1a799184c32d4bb6

SHA1
cd5233a64aaf61f63c97241b2d4d3f4c4af2f52c

SHA256
43a80ac218836ddd131f7377d0bef4fca5c3a1eb3fe05a63c69ce283dc32931e

SHA512
ad89c702c0dd23318c3c7805613707a6530b813c0b4e68afa22c11ef6237ec19455b1609e0fd276a8c577fb5aea51338a472561bdcda747bc1b636156ba722a4

Download Submit
C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe

Filesize
343KB

MD5
7321ac833e240c7d1a799184c32d4bb6

SHA1
cd5233a64aaf61f63c97241b2d4d3f4c4af2f52c

SHA256
43a80ac218836ddd131f7377d0bef4fca5c3a1eb3fe05a63c69ce283dc32931e

SHA512
ad89c702c0dd23318c3c7805613707a6530b813c0b4e68afa22c11ef6237ec19455b1609e0fd276a8c577fb5aea51338a472561bdcda747bc1b636156ba722a4

Download Submit
C:\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe

Filesize
343KB

MD5
7321ac833e240c7d1a799184c32d4bb6

SHA1
cd5233a64aaf61f63c97241b2d4d3f4c4af2f52c

SHA256
43a80ac218836ddd131f7377d0bef4fca5c3a1eb3fe05a63c69ce283dc32931e

SHA512
ad89c702c0dd23318c3c7805613707a6530b813c0b4e68afa22c11ef6237ec19455b1609e0fd276a8c577fb5aea51338a472561bdcda747bc1b636156ba722a4

Download Submit
C:\Users\Admin\AppData\Local\7b923b51-d76b-4b75-ace3-73bc48b373b9\bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc.exe

Filesize
828KB

MD5
1c7c18d59d23a9901b0e2b8e48dcde2c

SHA1
4579072148edd252a0a6eaa87eea1a0f73599258

SHA256
bc3c8c924623fde252926c1ad1cda9dd151c516d9173b0297681494f15d111cc

SHA512
304acab2ba7208aa70253b7dde1e90e0782b480481174c61432843f3c7870e07501b7f502ad6c2f6fecba863cdca5792cc30bc3e5173127c002537951e19656d

Download Submit
\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe

Filesize
343KB

MD5
7321ac833e240c7d1a799184c32d4bb6

SHA1
cd5233a64aaf61f63c97241b2d4d3f4c4af2f52c

SHA256
43a80ac218836ddd131f7377d0bef4fca5c3a1eb3fe05a63c69ce283dc32931e

SHA512
ad89c702c0dd23318c3c7805613707a6530b813c0b4e68afa22c11ef6237ec19455b1609e0fd276a8c577fb5aea51338a472561bdcda747bc1b636156ba722a4

Download Submit
\Users\Admin\AppData\Local\3616c6fd-9a8e-4997-af9c-9e672f1a14ef\build2.exe

Filesize
343KB

MD5
7321ac833e240c7d1a799184c32d4bb6

SHA1
cd5233a64aaf61f63c97241b2d4d3f4c4af2f52c

SHA256
43a80ac218836ddd131f7377d0bef4fca5c3a1eb3fe05a63c69ce283dc32931e

SHA512
ad89c702c0dd23318c3c7805613707a6530b813c0b4e68afa22c11ef6237ec19455b1609e0fd276a8c577fb5aea51338a472561bdcda747bc1b636156ba722a4

Download Submit
memory/848-80-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/848-94-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/848-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/952-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/952-61-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/952-59-0x0000000075D51000-0x0000000075D53000-memory.dmp

Filesize
8KB

Download
memory/952-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/952-55-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1076-67-0x00000000004E0000-0x0000000000571000-memory.dmp

Filesize
580KB

Download
memory/1076-70-0x00000000004E0000-0x0000000000571000-memory.dmp

Filesize
580KB

Download
memory/1720-58-0x00000000004E0000-0x0000000000571000-memory.dmp

Filesize
580KB

Download
memory/1720-54-0x00000000004E0000-0x0000000000571000-memory.dmp

Filesize
580KB

Download
memory/1720-60-0x0000000001E70000-0x0000000001F8B000-memory.dmp

Filesize
1.1MB

Download
memory/1768-86-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1768-91-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1768-93-0x0000000000400000-0x000000000046A000-memory.dmp

Filesize
424KB

Download
memory/1804-90-0x000000000058E000-0x00000000005BF000-memory.dmp

Filesize
196KB

Download
memory/1804-92-0x0000000000260000-0x00000000002B6000-memory.dmp

Filesize
344KB

Download