djvu | 9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c

Analysis

max time kernel
147s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
11-01-2024 12:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
Size

688KB
MD5

cd2a2421b83821c6c98e6d0bd346d7bd
SHA1

0723c84c1e70a010e60b623526d146a469a69420
SHA256

9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c
SHA512

f054710a96054db19b87511431b0868ceb824f94b8fd5e74a24298013c08d056b5bdeb56b4bc2baad3f4f343bea2bde82fe9a3de2a5698778edfcccf7f97c58f
SSDEEP

12288:DFaV1oBGxcJ7Mj8G25d970Ecg3zgb5pzisLx+uGwE9EzX7:8VWBxC8rJ3zgbesLxrPyE

Score

10^/10

djvu vidar discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://zexeq.com/test1/get.php

Attributes

extension
.cdqw
offline_id
mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1
payload_url
http://brusuax.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-99MNqXMrdS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0840ASdw

rsa_pubkey.plain

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral1/memory/1572-71-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/1572-72-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/740-68-0x0000000000230000-0x000000000027B000-memory.dmp	family_vidar_v6
behavioral1/memory/1572-67-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6
behavioral1/memory/1572-194-0x0000000000400000-0x000000000065E000-memory.dmp	family_vidar_v6

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral1/memory/2392-3-0x00000000021A0000-0x00000000022BB000-memory.dmp	family_djvu
behavioral1/memory/3036-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-7-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3036-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-48-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-195-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-198-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-197-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2608-199-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 2 IoCs

pid	Process
740	build2.exe
1572	build2.exe

Loads dropped DLL 6 IoCs

pid	Process
2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe
2064	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2944	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-928733405-3780110381-2966456290-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\70d2e792-9e4b-4d55-9ead-fad2c663e6b3\\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe\" --AutoStart"	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.2ip.ua
9	api.2ip.ua
3	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 2392 set thread context of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2844 set thread context of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 740 set thread context of 1572	740	build2.exe	35

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2064	1572	WerFault.exe	35

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 2392 wrote to memory of 3036	2392	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	28
PID 3036 wrote to memory of 2944	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	30
PID 3036 wrote to memory of 2944	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	30
PID 3036 wrote to memory of 2944	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	30
PID 3036 wrote to memory of 2944	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	30
PID 3036 wrote to memory of 2844	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	31
PID 3036 wrote to memory of 2844	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	31
PID 3036 wrote to memory of 2844	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	31
PID 3036 wrote to memory of 2844	3036	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	31
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2844 wrote to memory of 2608	2844	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	32
PID 2608 wrote to memory of 740	2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	34
PID 2608 wrote to memory of 740	2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	34
PID 2608 wrote to memory of 740	2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	34
PID 2608 wrote to memory of 740	2608	9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe	34
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 740 wrote to memory of 1572	740	build2.exe	35
PID 1572 wrote to memory of 2064	1572	build2.exe	38
PID 1572 wrote to memory of 2064	1572	build2.exe	38
PID 1572 wrote to memory of 2064	1572	build2.exe	38
PID 1572 wrote to memory of 2064	1572	build2.exe	38

C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
"C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2392
- C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
  "C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\70d2e792-9e4b-4d55-9ead-fad2c663e6b3" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2944
- - C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
    "C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2844
  - - C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe
      "C:\Users\Admin\AppData\Local\Temp\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2608
    - - C:\Users\Admin\AppData\Local\59fdfd3e-779e-4c7f-b063-f7adf418b075\build2.exe
        
        "C:\Users\Admin\AppData\Local\59fdfd3e-779e-4c7f-b063-f7adf418b075\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:740
      - C:\Users\Admin\AppData\Local\59fdfd3e-779e-4c7f-b063-f7adf418b075\build2.exe
        
        "C:\Users\Admin\AppData\Local\59fdfd3e-779e-4c7f-b063-f7adf418b075\build2.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:1572
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 1572 -s 1468
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:2064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
e849b4d99232368187001b8b785aa683

SHA1
617acd3d1269e0af2b6f5f40be9e0b543b28ce24

SHA256
30866a09601a03c344cf761ef16cd4e678e93191461b81233b1d404e39cf7ef6

SHA512
d56e277a59e72f15b09579d676ffef747186c008a669e1a20167aad7f6cbe4eda3038f28a598db3b2079359382e904383d2ba0fba14bbec29d8208d605ddb6ba

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
c46815285af5fd8a8aba45a2270053f3

SHA1
d5a98f46127e73736ccee48a8836da7479f84525

SHA256
e646c23f66eaff6ab02d0b0e997484530fd769a530912bd80c3d91b00a6a2c7c

SHA512
6e051dbabe1624c67c2e8d1fda458d11768f625da09578fddfecd09ad9a4a9a4183fc5f03ef8fe78d88ca21a215dbbf24dd74fb41721d412bdb509c958d7458f

Download Submit
C:\Users\Admin\AppData\Local\70d2e792-9e4b-4d55-9ead-fad2c663e6b3\9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c.exe

Filesize
688KB

MD5
cd2a2421b83821c6c98e6d0bd346d7bd

SHA1
0723c84c1e70a010e60b623526d146a469a69420

SHA256
9dfb6b41c90732c9206ef6f65a941b1061126ead69e3715d79519196dad5899c

SHA512
f054710a96054db19b87511431b0868ceb824f94b8fd5e74a24298013c08d056b5bdeb56b4bc2baad3f4f343bea2bde82fe9a3de2a5698778edfcccf7f97c58f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar89E9.tmp

Filesize
92KB

MD5
71e4ce8b3a1b89f335a6936bbdafce4c

SHA1
6e0d450eb5f316a9924b3e58445b26bfb727001e

SHA256
a5edfae1527d0c8d9fe5e7a2c5c21b671e61f9981f3bcf9e8cc9f9bb9f3b44c5

SHA512
b80af88699330e1ff01e409daabdedeef350fe7d192724dfa8622afa71e132076144175f6e097f8136f1bba44c7cb30cfdd0414dbe4e0a4712b3bad7b70aeff7

Download Submit
\Users\Admin\AppData\Local\59fdfd3e-779e-4c7f-b063-f7adf418b075\build2.exe

Filesize
358KB

MD5
c4070da9f9b0581171af16e681ccdff8

SHA1
3fb4182921fdc3acd7873ebe113ac5522585312a

SHA256
26063c78e5418610471a9f3a00a155d7d1e5b29856e1979ba3bdc42681a871d0

SHA512
c7569cea7f1a841e7cac9cd41287dba3bcacf2cf9dee7bece88800848a7ad5dc4cd2bdc896c7389f0f1144079bbe168048b3f722bcd76fa5d6e14f3081bb6427

Download Submit
memory/740-68-0x0000000000230000-0x000000000027B000-memory.dmp

Filesize
300KB

Download
memory/740-66-0x0000000000590000-0x0000000000690000-memory.dmp

Filesize
1024KB

Download
memory/1572-67-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/1572-72-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/1572-71-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/1572-64-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1572-194-0x0000000000400000-0x000000000065E000-memory.dmp

Filesize
2.4MB

Download
memory/2392-0-0x0000000000360000-0x00000000003F2000-memory.dmp

Filesize
584KB

Download
memory/2392-3-0x00000000021A0000-0x00000000022BB000-memory.dmp

Filesize
1.1MB

Download
memory/2392-1-0x0000000000360000-0x00000000003F2000-memory.dmp

Filesize
584KB

Download
memory/2608-48-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-195-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-49-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-199-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-73-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-197-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2608-198-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2844-29-0x00000000008D0000-0x0000000000962000-memory.dmp

Filesize
584KB

Download
memory/2844-27-0x00000000008D0000-0x0000000000962000-memory.dmp

Filesize
584KB

Download
memory/3036-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/3036-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3036-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download