djvu | 75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c

Analysis

max time kernel
300s
max time network
162s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
01-02-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
Size

686KB
MD5

591894f561823c1fef63ee244705a392
SHA1

38fc6af7e15cd9a3cf2794e42e1f0de43a03eaab
SHA256

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c
SHA512

b696dcbe1d20bf7cc567136d15738daa76f1f059c016671fab4fa30bd13794a4bb12caf82f2b03fa618753d0a7d69b736c6acab21bcda0ae1b08b538782fcead
SSDEEP

12288:5+/jLVJgJL3/bR0Lp4z+ZUh5RuQjpSJhcRKWycAVWIs4LxQzLwyMQ5:5IVJgJPhz/3RuGSfYnycAkmxZQ5

Score

10^/10

djvu vidar 1b9d7ec5a25ab9d78c31777a0016a097 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Signatures

Detect Vidar Stealer 5 IoCs

stealer

Processes:

resource	yara_rule
behavioral1/memory/1288-76-0x00000000003D0000-0x0000000000400000-memory.dmp	family_vidar_v7
behavioral1/memory/1776-79-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/1776-80-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/1776-75-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral1/memory/1776-240-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 14 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1780-4-0x00000000043B0000-0x00000000044CB000-memory.dmp	family_djvu
behavioral1/memory/2168-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2168-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2168-9-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2168-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-57-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-56-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2620-91-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 14 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

pid	process
1288	build2.exe
1776	build2.exe
2884	build3.exe
1044	build3.exe
1584	mstsca.exe
2800	mstsca.exe
1288	mstsca.exe
2740	mstsca.exe
2400	mstsca.exe
2492	mstsca.exe
2276	mstsca.exe
2472	mstsca.exe
2504	mstsca.exe
2832	mstsca.exe

Loads dropped DLL 11 IoCs

Processes:

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exeWerFault.exe

pid	process
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
1804	WerFault.exe
1804	WerFault.exe
1804	WerFault.exe
1804	WerFault.exe
1804	WerFault.exe
1804	WerFault.exe
1804	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2824 icacls.exe

pid	process
2824	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c6f99860-b99f-4f2b-9deb-bfc60fcf0163\\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe\" --AutoStart"	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
4 api.2ip.ua
9 api.2ip.ua

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
9	api.2ip.ua

Suspicious use of SetThreadContext 9 IoCs

Processes:

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

description	pid	process	target process
PID 1780 set thread context of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 set thread context of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1288 set thread context of 1776	1288	build2.exe	build2.exe
PID 2884 set thread context of 1044	2884	build3.exe	build3.exe
PID 1584 set thread context of 2800	1584	mstsca.exe	mstsca.exe
PID 1288 set thread context of 2740	1288	mstsca.exe	mstsca.exe
PID 2400 set thread context of 2492	2400	mstsca.exe	mstsca.exe
PID 2276 set thread context of 2472	2276	mstsca.exe	mstsca.exe
PID 2504 set thread context of 2832	2504	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1804 1776 WerFault.exe build2.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

1524 schtasks.exe
2680 schtasks.exe

pid	pid_target	process	target process
1804	1776	WerFault.exe	build2.exe

pid	process
1524	schtasks.exe
2680	schtasks.exe

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

Processes:

build2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

Processes:

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe

pid	process
2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exebuild2.exebuild3.exebuild3.exebuild2.exe

description	pid	process	target process
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 1780 wrote to memory of 2168	1780	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2168 wrote to memory of 2824	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	icacls.exe
PID 2168 wrote to memory of 2824	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	icacls.exe
PID 2168 wrote to memory of 2824	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	icacls.exe
PID 2168 wrote to memory of 2824	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	icacls.exe
PID 2168 wrote to memory of 2544	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2168 wrote to memory of 2544	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2168 wrote to memory of 2544	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2168 wrote to memory of 2544	2168	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2544 wrote to memory of 2620	2544	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
PID 2620 wrote to memory of 1288	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build2.exe
PID 2620 wrote to memory of 1288	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build2.exe
PID 2620 wrote to memory of 1288	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build2.exe
PID 2620 wrote to memory of 1288	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 1288 wrote to memory of 1776	1288	build2.exe	build2.exe
PID 2620 wrote to memory of 2884	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build3.exe
PID 2620 wrote to memory of 2884	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build3.exe
PID 2620 wrote to memory of 2884	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build3.exe
PID 2620 wrote to memory of 2884	2620	75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 2884 wrote to memory of 1044	2884	build3.exe	build3.exe
PID 1044 wrote to memory of 1524	1044	build3.exe	schtasks.exe
PID 1044 wrote to memory of 1524	1044	build3.exe	schtasks.exe
PID 1044 wrote to memory of 1524	1044	build3.exe	schtasks.exe
PID 1044 wrote to memory of 1524	1044	build3.exe	schtasks.exe
PID 1776 wrote to memory of 1804	1776	build2.exe	WerFault.exe

C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
"C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1780

C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
"C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2168

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\c6f99860-b99f-4f2b-9deb-bfc60fcf0163" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:2824

C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
"C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2544

C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
"C:\Users\Admin\AppData\Local\Temp\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2620

C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build2.exe
"C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1288

C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build2.exe
"C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build2.exe"
6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1776

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1776 -s 1440
7⤵
- Loads dropped DLL
- Program crash
PID:1804

C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build3.exe
"C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2884

C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build3.exe
"C:\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\system32\taskeng.exe
taskeng.exe {5503A493-5113-4307-9AAE-C091938A4534} S-1-5-21-3308111660-3636268597-2291490419-1000:JUBFGPHD\Admin:Interactive:[1]
1⤵
PID:1564

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1584

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2800

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
4⤵
- Creates scheduled task(s)
PID:2680

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1288

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2740

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2400

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2492

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2276

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2472

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:2504

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
3⤵
- Executes dropped EXE
PID:2832

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
8112ab2a9d7578692e66734917d00015

SHA1
5dc1f7cb2c66c925d195fb98784917d108a001dd

SHA256
919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b

SHA512
538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
1c3733e289e88d06c33c8926a54e88ca

SHA1
24fccecfc34134a55d7a8cd7a41ad4cb5768713f

SHA256
ed809dbde3f96cd22ed67a325447f627f4403b0ce845b553291670a6890516df

SHA512
638eeaf3d0cc78bffea52965e83e8f3e426f2369eff9a0285d1476bd78cbaaad1adf0acbe95cc06e416a184b31523797933aea2e86c95f8ea88d95d3f0daa6cd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
cfe3def7b4e6495fa79d0ae12e35c271

SHA1
4de5a370d73dd313c2b2fc14b2c89bf4f55d641e

SHA256
8cac03e2eb941ba804ec1c39ff6037a202eb2bae8579df716ca14ce55d64c7e0

SHA512
4e13e8b2a81d6bb37470a5d1d7de4b721740b5091ab65cd0b5e5e4e24dc9dfccda1d80b18df1275a9b4ee4a1239d5a5f9e1a6b0cb4b3751d9f4fab769ed1292c

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
fcc3d842668c70db789b7f3b24e871bf

SHA1
d149bd5acff71637509cfe68cf6ee6cf47b85aa8

SHA256
68b32d5aa732a15a92af0c4201e502491b8e21d2d944ff3c7684fba55aad29d6

SHA512
7cbc2a6de9e3f9d688b751e5282d611fcc942d540140a05f6926877f59244c2ae3fed5be2c7058908cebc409d3b5e53f1637b14205e4bf26ac4909a091df87ab

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
3494161cfd422e56d86cd441ae491b96

SHA1
b77e3a8a3a4c29be4ddf0d1771edb879c7a8612d

SHA256
66b07bcc9b6de357f23a84c9a5ebaf663a9816b5f8c55383fc2c3aea4362dad7

SHA512
e952df65ab2837d11d556a91ed38baf05d757afd38cb47eb9a6c41b9b0020c3067eca72b0540b266a455a135ec4da6fa29e41f0ab728de3d5444a51525d8596e

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab78A9.tmp
Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\Temp\TarA1EB.tmp
Filesize
171KB

MD5
9c0c641c06238516f27941aa1166d427

SHA1
64cd549fb8cf014fcd9312aa7a5b023847b6c977

SHA256
4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f

SHA512
936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06

Download Submit
C:\Users\Admin\AppData\Local\c6f99860-b99f-4f2b-9deb-bfc60fcf0163\75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c.exe
Filesize
686KB

MD5
591894f561823c1fef63ee244705a392

SHA1
38fc6af7e15cd9a3cf2794e42e1f0de43a03eaab

SHA256
75134ad6babd2b55ea9823261ee5a7af0442065260c1085ae449e90095615b8c

SHA512
b696dcbe1d20bf7cc567136d15738daa76f1f059c016671fab4fa30bd13794a4bb12caf82f2b03fa618753d0a7d69b736c6acab21bcda0ae1b08b538782fcead

Download Submit
\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build2.exe
Filesize
385KB

MD5
63e4a9cd7a8b37335b5f18cefc5dd9d2

SHA1
c781a30935afc452b108cc78724b60f389b78874

SHA256
c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f

SHA512
3818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc

Download Submit
\Users\Admin\AppData\Local\f1e06fd8-7afe-4547-9bb5-8c63d2c3f778\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
memory/1044-192-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1044-187-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1044-190-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/1288-278-0x0000000000900000-0x0000000000A00000-memory.dmp

Filesize
1024KB

Download
memory/1288-74-0x0000000000260000-0x0000000000360000-memory.dmp

Filesize
1024KB

Download
memory/1288-76-0x00000000003D0000-0x0000000000400000-memory.dmp

Filesize
192KB

Download
memory/1584-256-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1584-243-0x0000000000920000-0x0000000000A20000-memory.dmp

Filesize
1024KB

Download
memory/1776-240-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1776-79-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1776-75-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1776-71-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1776-80-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/1780-1-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1780-4-0x00000000043B0000-0x00000000044CB000-memory.dmp

Filesize
1.1MB

Download
memory/1780-0-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/1780-7-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2168-9-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2168-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2168-27-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2168-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2168-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2276-334-0x0000000000910000-0x0000000000A10000-memory.dmp

Filesize
1024KB

Download
memory/2400-301-0x0000000000250000-0x0000000000350000-memory.dmp

Filesize
1024KB

Download
memory/2504-364-0x0000000000C72000-0x0000000000C82000-memory.dmp

Filesize
64KB

Download
memory/2544-29-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2544-30-0x0000000000220000-0x00000000002B1000-memory.dmp

Filesize
580KB

Download
memory/2620-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-91-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-72-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-56-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-57-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-54-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-50-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-49-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2620-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2884-185-0x0000000000220000-0x0000000000224000-memory.dmp

Filesize
16KB

Download
memory/2884-184-0x00000000008D0000-0x00000000009D0000-memory.dmp

Filesize
1024KB

Download