Analysis
-
max time kernel
299s -
max time network
189s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
01-02-2024 05:02
Static task
static1
Behavioral task
behavioral1
Sample
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
Resource
win10-20231215-en
General
-
Target
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe
-
Size
824KB
-
MD5
f2676ea250de972076b79913ffa7fbb8
-
SHA1
5b6b1b7e54736260173f6e8b44f33bcc8260b6e2
-
SHA256
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22
-
SHA512
f2f2a6eec3139c233378fb8888edbe5c8bdd76869a3e3e10d1275a7fcc2e43667ea5031a6db629556d4d92d9d188dc3acd772fe3709ff664efc66deb196881d9
-
SSDEEP
12288:csaCCG1t2SJ0uT2gszaWjkCI+e9KVmkcU/09xM19+uE+3jf3wptt0ws:Z1vqRaWgC69jkt0LzuvjotSw
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdcc
-
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw
Extracted
vidar
7.6
1b9d7ec5a25ab9d78c31777a0016a097
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
-
profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097
Signatures
-
Detect Vidar Stealer 7 IoCs
Processes:
resource yara_rule behavioral2/memory/4196-49-0x00000000005F0000-0x0000000000620000-memory.dmp family_vidar_v7 behavioral2/memory/3536-52-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3536-53-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3536-48-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/3536-86-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/2800-98-0x00000000008A0000-0x00000000009A0000-memory.dmp family_vidar_v7 behavioral2/memory/756-130-0x0000000000A70000-0x0000000000B70000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 17 IoCs
Processes:
resource yara_rule behavioral2/memory/864-2-0x0000000002330000-0x000000000244B000-memory.dmp family_djvu behavioral2/memory/1696-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1696-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1696-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1696-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1696-17-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-23-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-24-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-29-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-36-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-37-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4356-45-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4196-47-0x00000000007E0000-0x00000000008E0000-memory.dmp family_djvu behavioral2/memory/4356-70-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 4196 build2.exe 3536 build2.exe 4968 build3.exe 4136 build3.exe 2800 mstsca.exe 3064 mstsca.exe 756 mstsca.exe 2592 mstsca.exe 1580 mstsca.exe 4188 mstsca.exe 4152 mstsca.exe 4176 mstsca.exe 2824 mstsca.exe 4148 mstsca.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-33539905-3698238643-2080195461-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7423993d-4b42-4983-8146-cd933babd6c2\\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe\" --AutoStart" fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 api.2ip.ua 2 api.2ip.ua 10 api.2ip.ua -
Suspicious use of SetThreadContext 9 IoCs
Processes:
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exefd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 864 set thread context of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 set thread context of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4196 set thread context of 3536 4196 build2.exe build2.exe PID 4968 set thread context of 4136 4968 build3.exe build3.exe PID 2800 set thread context of 3064 2800 mstsca.exe mstsca.exe PID 756 set thread context of 2592 756 mstsca.exe mstsca.exe PID 1580 set thread context of 4188 1580 mstsca.exe mstsca.exe PID 4152 set thread context of 4176 4152 mstsca.exe mstsca.exe PID 2824 set thread context of 4148 2824 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4144 3536 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1124 schtasks.exe 696 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exefd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exepid process 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exefd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exefd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exefd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exedescription pid process target process PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 864 wrote to memory of 1696 864 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 1696 wrote to memory of 3556 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe icacls.exe PID 1696 wrote to memory of 3556 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe icacls.exe PID 1696 wrote to memory of 3556 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe icacls.exe PID 1696 wrote to memory of 4028 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 1696 wrote to memory of 4028 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 1696 wrote to memory of 4028 1696 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4028 wrote to memory of 4356 4028 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe PID 4356 wrote to memory of 4196 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build2.exe PID 4356 wrote to memory of 4196 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build2.exe PID 4356 wrote to memory of 4196 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4196 wrote to memory of 3536 4196 build2.exe build2.exe PID 4356 wrote to memory of 4968 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build3.exe PID 4356 wrote to memory of 4968 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build3.exe PID 4356 wrote to memory of 4968 4356 fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4968 wrote to memory of 4136 4968 build3.exe build3.exe PID 4136 wrote to memory of 1124 4136 build3.exe schtasks.exe PID 4136 wrote to memory of 1124 4136 build3.exe schtasks.exe PID 4136 wrote to memory of 1124 4136 build3.exe schtasks.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 2800 wrote to memory of 3064 2800 mstsca.exe mstsca.exe PID 3064 wrote to memory of 696 3064 mstsca.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\7423993d-4b42-4983-8146-cd933babd6c2" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe"C:\Users\Admin\AppData\Local\Temp\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exe"1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 21082⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD58112ab2a9d7578692e66734917d00015
SHA15dc1f7cb2c66c925d195fb98784917d108a001dd
SHA256919561b1927726f5218e79f21184c4bf7117db4466686fc93d3d5dbc1380033b
SHA512538f1f36b44d628d2ade163cc40deb58b50cb7fbd56019d9526c8233c30771db8542ed5786d311322dfd2e9d44e979da9513c4a0bbc7416b47bb7beca90013d1
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD545d59644251cc6534ea8a5f9fe4098fe
SHA17dc4ba5b282869052655d3eeb3c6b4ce7de9c25b
SHA2566bd6dd2ce9fe871db728ec6a906d113c641bb213acd13a49ccd3fef71bc6e463
SHA512cd4aa57ff59c463239c2f5b9a511eb709ad8b9afe3082d74ae512c09768f4bab57c0bb943cb1e4ec861d950f4c1d3cf2e1b89455ebf332f977cf30de62675b7e
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD55111c39ff862d5a31675e0d4f8c9de31
SHA1385d1697e5391dae7a3cf78b5fe4c304102cde69
SHA256d2f0e168a364b595b4cd4c9c3ff6d15e28895f2f2996329541b4c9f8ef5b8441
SHA5124117b957786148160c77b347fe784f9002df5b72b1a8e48abc90150555b5278abc132e3dfc37a9be0ffed92ffb24900fea2126d148f78c7005b6fcb2425e78d4
-
C:\Users\Admin\AppData\Local\7423993d-4b42-4983-8146-cd933babd6c2\fd08b9700202aa287b81b86e098983283a1bac60d3246397e48a35d07ea7fe22.exeFilesize
99KB
MD5cd85105d143997c993bb8f4e363b1a90
SHA1c140f42246719638ed7a76f11c1b4dd70603528c
SHA2569505946110cd8b06a8f57f03fee5a4cac8f4060c63dae0a9035fb67add2e3a8d
SHA5123eee4c2f3b318fcae11de50183ffc1f3f146bef5a55bf90c47517967ab34a3795269b75cbafb74d4d1c02eeab1292ddcf6e74752befa690ba134df9091ddf138
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exeFilesize
100KB
MD5d08ef828c7b6ae0fea84b4d852ec1b16
SHA1d1a7b25bdce03156afe5bdfb9124fe2c5058ec84
SHA25608698f08a85a2ef5071c6ed7be6140ade7a1813639baebddb7909dbba5a36b39
SHA5121cd2f38c569cdbdfa2e2cd78fe37a54125106a54430c08315ddc812460ee371d390c7aaa61d3966da2662ca54ddbf4030af1cb29ebd7e9fb8962d81df1c94dcf
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exeFilesize
92KB
MD51f32a439bc028b0047e09221ba7def73
SHA1a574b924dfe7565555edc2b8b6d85c235b683907
SHA256e60a315082a2218597831b04992958d8bbf7bcfb2ed5f259a05087f6b857f57b
SHA512378e5904d83cbdc95d5ef4099221435fe4aa5f531588b5daccb6c417f543b2134865763a3a2acd7d2b5a3ab7ae8c4e9fb326a4df15d3b6d3c6d5e317235b9f52
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build2.exeFilesize
112KB
MD5c6865862dae23d20114b7829b3f32bad
SHA152f35a35a9c952cb08e8963216b536f19587b7ae
SHA256af1c72ac9d010bac9d9e25b1f63c5a441d3e85128c66d8e39c8446753b6c30aa
SHA512d7f84fcd1273ca6f5dcbf1d7028cc64b8bfd835008a856fbcd8fd713da943989803019d288e68f97654391283831cec5c4749c09aae780d2da53f8349717a28d
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exeFilesize
27KB
MD5c7b438b4b2aaa93242a3fcb32a4f2902
SHA11005b3d719cacaf36bcf7d10877dd257d5fe11f1
SHA256c4ef51333f1cae7f0d7c2900a8e7b1d7a3df889a8b1f71435a71218392117c46
SHA512527c3e0189a361eda758eb26bce7e93450914debb1784f261daf49953925d96a4bfc80f0ec5d2ed3ee5265a7663036dfc67ae9df15ab5e08d9feb583351c9d97
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exeFilesize
1KB
MD5d35c806c95b926208b06f305860de044
SHA1fd111b2072749c0e2b3f1bb7102e4fbcdd8b931b
SHA256722325dfc7e0a3d8b9c5bcf978e54f9a90a83ffa5d14372a51dc7c3609fee061
SHA512cb5f66f83bd6a8ddad6d740479d17352d3a8249ab6fec7ea0ee071dcc7f9855ed378dee61bb65e92d272e3fb8187282ce08d0694550cfa610bf6e6508ec5b6a6
-
C:\Users\Admin\AppData\Local\a26ec1e8-c389-427b-851e-96849676f85e\build3.exeFilesize
96KB
MD5a10047b22a7ff0ddc36a2ba752ed6a59
SHA18f1136a7ce46220e1205d36c692f6d482a40e716
SHA256d86fb0e11d51ac8a5f6b40c075136569725e7b98decae9f7a88597c0f474db9b
SHA512951dc2f074e54797cfbf5cadbd637456bf464828816bf42966d67aada836e3325a009e5808256260528b6ce6529c99e5ee22af5d820730dae5b894d047d67dcd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
245KB
MD56ac935d668fd466875bf1c0737e6d2a9
SHA1a6081ccb7b796df29f6151a9dd5026137df2c105
SHA2568bd7937429196d4134337f09dc3973e4fceccc901dc6711246b4450182141af6
SHA51210d6e21e59d7a1781ea038629b6fc9f6b52ad5a542f1fa7fcca767e13796498ba96d8456a959ce9832b2cfc00bbf86b0be0840abcf959e20cdd6cd67901cf90d
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
memory/756-139-0x0000000000A70000-0x0000000000B70000-memory.dmpFilesize
1024KB
-
memory/756-130-0x0000000000A70000-0x0000000000B70000-memory.dmpFilesize
1024KB
-
memory/864-1-0x0000000002130000-0x00000000021D0000-memory.dmpFilesize
640KB
-
memory/864-2-0x0000000002330000-0x000000000244B000-memory.dmpFilesize
1.1MB
-
memory/1580-155-0x0000000000A70000-0x0000000000B70000-memory.dmpFilesize
1024KB
-
memory/1696-6-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1696-4-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1696-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1696-3-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1696-17-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2592-129-0x0000000000410000-0x00000000004D5000-memory.dmpFilesize
788KB
-
memory/2800-98-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/2824-207-0x00000000008E0000-0x00000000009E0000-memory.dmpFilesize
1024KB
-
memory/3536-52-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3536-53-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3536-48-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3536-86-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/4028-21-0x00000000020F0000-0x0000000002183000-memory.dmpFilesize
588KB
-
memory/4136-75-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4136-83-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4136-81-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/4152-182-0x00000000008C0000-0x00000000009C0000-memory.dmpFilesize
1024KB
-
memory/4196-47-0x00000000007E0000-0x00000000008E0000-memory.dmpFilesize
1024KB
-
memory/4196-49-0x00000000005F0000-0x0000000000620000-memory.dmpFilesize
192KB
-
memory/4356-30-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-36-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-37-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-34-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-29-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-22-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-24-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-23-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-45-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4356-70-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4968-80-0x0000000000920000-0x0000000000924000-memory.dmpFilesize
16KB
-
memory/4968-79-0x0000000000B20000-0x0000000000C20000-memory.dmpFilesize
1024KB