djvu | 8ed183df76d08024f15e051f4f5711535dde6372ff4beafecfff07f82e846800

Analysis

max time kernel
148s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-01-2024 15:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
Size

701KB
MD5

6741d5aef031c6b1e51f386fefc1225e
SHA1

95ea397aed18143bc18da02c21e693c44e373f90
SHA256

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9
SHA512

90034da6a496dfcf2b7227b2aa585983cbe80f9a69586743eb219035c1bdab59eaa912139de0e576db2194383f1c70e16042736c1a593fd7e7a4ea93d515df5d
SSDEEP

12288:ZohXTLkKkP0rRl6CRHCwWshS7JUc9ouDCwI/d9V5qyBmPjCkuYDaFB:ZYTLG2U/wWRVUYoUCwCVdmr7uma

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://zexeq.com/lancer/get.php

Attributes

extension
.qarj
offline_id
VrBq0iLIRHjQLgVRLsN1WK8yFkTCRDCCvPkwnHt1
payload_url
http://uaery.top/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-zUVSNg4KRZ Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0664Iopd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 14 IoCs

Processes:

resource	yara_rule
behavioral11/memory/852-3-0x00000000006A0000-0x00000000007BB000-memory.dmp	family_djvu
behavioral11/memory/1972-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1972-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1972-9-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1972-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-46-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-128-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-142-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-143-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-147-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-150-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-149-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-154-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral11/memory/1652-155-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Downloads MZ/PE file
Executes dropped EXE 4 IoCs

Processes:

build3.exebuild3.exemstsca.exemstsca.exe

pid process

2472 build3.exe
2552 build3.exe
3048 mstsca.exe
2624 mstsca.exe

pid	process
2472	build3.exe
2552	build3.exe
3048	mstsca.exe
2624	mstsca.exe

Loads dropped DLL 2 IoCs

Processes:

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

pid	process
1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

3012 icacls.exe

pid	process
3012	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a146bc7e-077f-4f3d-8e57-d7434f7e6be1\\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe\" --AutoStart"	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.2ip.ua
12 api.2ip.ua
3 api.2ip.ua

flow	ioc
5	api.2ip.ua
12	api.2ip.ua
3	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

Processes:

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exebuild3.exemstsca.exe

description	pid	process	target process
PID 852 set thread context of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 set thread context of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2472 set thread context of 2552	2472	build3.exe	build3.exe
PID 3048 set thread context of 2624	3048	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2644 schtasks.exe
608 schtasks.exe

pid	process
2644	schtasks.exe
608	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

pid	process
1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exebuild3.exebuild3.exetaskeng.exemstsca.exemstsca.exe

description	pid	process	target process
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 852 wrote to memory of 1972	852	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 1972 wrote to memory of 3012	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	icacls.exe
PID 1972 wrote to memory of 3012	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	icacls.exe
PID 1972 wrote to memory of 3012	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	icacls.exe
PID 1972 wrote to memory of 3012	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	icacls.exe
PID 1972 wrote to memory of 2416	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 1972 wrote to memory of 2416	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 1972 wrote to memory of 2416	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 1972 wrote to memory of 2416	1972	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 2416 wrote to memory of 1652	2416	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
PID 1652 wrote to memory of 2472	1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	build3.exe
PID 1652 wrote to memory of 2472	1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	build3.exe
PID 1652 wrote to memory of 2472	1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	build3.exe
PID 1652 wrote to memory of 2472	1652	2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2472 wrote to memory of 2552	2472	build3.exe	build3.exe
PID 2552 wrote to memory of 608	2552	build3.exe	schtasks.exe
PID 2552 wrote to memory of 608	2552	build3.exe	schtasks.exe
PID 2552 wrote to memory of 608	2552	build3.exe	schtasks.exe
PID 2552 wrote to memory of 608	2552	build3.exe	schtasks.exe
PID 2548 wrote to memory of 3048	2548	taskeng.exe	mstsca.exe
PID 2548 wrote to memory of 3048	2548	taskeng.exe	mstsca.exe
PID 2548 wrote to memory of 3048	2548	taskeng.exe	mstsca.exe
PID 2548 wrote to memory of 3048	2548	taskeng.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 3048 wrote to memory of 2624	3048	mstsca.exe	mstsca.exe
PID 2624 wrote to memory of 2644	2624	mstsca.exe	schtasks.exe
PID 2624 wrote to memory of 2644	2624	mstsca.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
"C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:852

C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
"C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1972

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\a146bc7e-077f-4f3d-8e57-d7434f7e6be1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:3012

C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
"C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2416

C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe
"C:\Users\Admin\AppData\Local\Temp\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1652

C:\Users\Admin\AppData\Local\6ab5ffbf-d723-4730-b2b5-4ec62b3275b4\build3.exe
"C:\Users\Admin\AppData\Local\6ab5ffbf-d723-4730-b2b5-4ec62b3275b4\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2472

C:\Users\Admin\AppData\Local\6ab5ffbf-d723-4730-b2b5-4ec62b3275b4\build3.exe
"C:\Users\Admin\AppData\Local\6ab5ffbf-d723-4730-b2b5-4ec62b3275b4\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2552

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:608

C:\Windows\system32\taskeng.exe
taskeng.exe {04DB0034-9B94-47CA-BF4C-A2840E1E8098} S-1-5-21-2444714103-3190537498-3629098939-1000:DJLAPDMX\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:2548

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3048

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2624

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:2644

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
034ec3b760b9b922d37ec2d86820ebfa

SHA1
70ace12a56aa61e58f53ca2a3de71ff18966278d

SHA256
015e7444eb0fdf2cae85aef5c1d3d1aee98ed7e692c848ea45bfec3a35ccd821

SHA512
1257126cb3ffbe026affeb47918d546df4fd018b1ef53971bfa8ab53c67106d7dbbed03695340c8b5a446fec87ecd100f264966d934a0982586bc45a7c38188a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\4748633DC5731827D4B432DBAC7A3ECE

Filesize
854B

MD5
8d1040b12a663ca4ec7277cfc1ce44f0

SHA1
b27fd6bbde79ebdaee158211a71493e21838756b

SHA256
3086094d4198a5bbd12938b0d2d5f696c4dfc77e1eae820added346a59aa8727

SHA512
610c72970856ef7a316152253f7025ac11635078f1aea7b84641715813792374d2447b1002f1967d62b24073ee291b3e4f3da777b71216a30488a5d7b6103ac1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
ff483fd6206648b0657e24218c6bffb2

SHA1
c8e29d29301a5926f116a9f975adb70c31a48ca3

SHA256
01ab307a07a83e17c09f3d7c399bce66e7c218c51107bb8eb03abf132116f9b4

SHA512
e9210bb71c37d5dc9772af952c2ba9f1d1cb3be4d2e5137392824cbcb1a7a3e3664f261d7384e69b8ae62205039630159af7ac9cfc79e5b293e74ca1718d75df

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\4748633DC5731827D4B432DBAC7A3ECE

Filesize
188B

MD5
83b44f1cb8f519a98820b17e738f2285

SHA1
5b199afedb0b21701ce4fc4750770718d8312274

SHA256
f4bf2f38ee1d68c71d57fd6734e22013b5440e3e500b64262d836625d8b500cd

SHA512
0a48b67e3fa1e1c1780fe296afe6ea52456b5f692aa0dd38ddb852c02565a7e53d22c5b49c559a0d18117e9c60a4954f81bf31f86fe66741d1683e9c9c2f23f5

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
77f6986f55ce43647d2d982fbcb80839

SHA1
e91bdcf6293a5c6d816921b77d80158dcaa2039b

SHA256
0471860ede8e1c0cd4d1626a3cb504dcb9ca2fc1fa38a2443f2342e0fa41883a

SHA512
4ecb0296dbd6c7061502fe45ad196087b3447213c54a6357a9c6e0c231013a8b182dc0cd9d4e813b71b9f3198f3a4bb0523724d63cc3490a0782bab9400c4422

Download Submit
C:\Users\Admin\AppData\Local\Temp\CabEB2A.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\a146bc7e-077f-4f3d-8e57-d7434f7e6be1\2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9.exe

Filesize
701KB

MD5
6741d5aef031c6b1e51f386fefc1225e

SHA1
95ea397aed18143bc18da02c21e693c44e373f90

SHA256
2b5109e9a249a795a412a3961aae3e5b576a233d9681f5ec0b4d88ce009b6ed9

SHA512
90034da6a496dfcf2b7227b2aa585983cbe80f9a69586743eb219035c1bdab59eaa912139de0e576db2194383f1c70e16042736c1a593fd7e7a4ea93d515df5d

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

Filesize
8KB

MD5
8b7c2877951d0098abecc9c1bf5ae31a

SHA1
e9a12360ae7e9630ebd6d9f0fa9d9f5958578351

SHA256
7670cd34b6e2142cf9a813ce536f24fa8fb9e91d3e46b38d9904a5ab83b31f3a

SHA512
8d32b65ee1c0ef6d1428ca580cffde87ceb500643307d077f0621f4d9285c0a0d12d46554b7f98190145bba0cb8aa158bd76fae2f21025d0062e687c04f12444

Download Submit
\Users\Admin\AppData\Local\6ab5ffbf-d723-4730-b2b5-4ec62b3275b4\build3.exe

Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
memory/852-7-0x00000000002F0000-0x0000000000382000-memory.dmp

Filesize
584KB

Download
memory/852-0-0x00000000002F0000-0x0000000000382000-memory.dmp

Filesize
584KB

Download
memory/852-3-0x00000000006A0000-0x00000000007BB000-memory.dmp

Filesize
1.1MB

Download
memory/852-1-0x00000000002F0000-0x0000000000382000-memory.dmp

Filesize
584KB

Download
memory/1652-155-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-147-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-46-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-154-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-149-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-150-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-128-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-142-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1652-143-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1972-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1972-32-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1972-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1972-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1972-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2416-33-0x0000000001CA0000-0x0000000001D32000-memory.dmp

Filesize
584KB

Download
memory/2416-44-0x0000000001CA0000-0x0000000001D32000-memory.dmp

Filesize
584KB

Download
memory/2472-170-0x00000000001B0000-0x00000000001B4000-memory.dmp

Filesize
16KB

Download
memory/2472-169-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2552-168-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2552-172-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2552-175-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/2552-177-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3048-193-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download