Analysis
-
max time kernel
298s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
04-02-2024 07:40
Static task
static1
Behavioral task
behavioral1
Sample
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
Resource
win10-20231215-en
General
-
Target
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
-
Size
819KB
-
MD5
aed73fb9a0ebf033d0478fa814e7b8d3
-
SHA1
0058f0b7203c592edf70131b84f6cb1fe784f8a3
-
SHA256
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba
-
SHA512
3a264e0286234e97f5c01816adcd40a408ac66153ce81e4066c22a54f4533a3a34fcb9a3e40db41dee7227ee24a084a89f2b61da9a5cf14ee8b50669ea9ebffb
-
SSDEEP
12288:q2kxn4QFNbM2vZ+UO2Hf55nnVP3xxJSpH136GcAnCPQ8FcNAE2Jr90tPT1td9eY:c/DM28uHZPnG1GAnCPQ2mad9G5tzR
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdcc
-
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw
Extracted
vidar
7.6
1b9d7ec5a25ab9d78c31777a0016a097
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
-
profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097
Signatures
-
Detect Vidar Stealer 5 IoCs
Processes:
resource yara_rule behavioral1/memory/1484-72-0x0000000000250000-0x0000000000280000-memory.dmp family_vidar_v7 behavioral1/memory/3036-74-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/3036-77-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/3036-79-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral1/memory/3036-215-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 14 IoCs
Processes:
resource yara_rule behavioral1/memory/2196-2-0x0000000001DB0000-0x0000000001ECB000-memory.dmp family_djvu behavioral1/memory/2496-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2496-7-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2496-8-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2496-26-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-35-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-48-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-49-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-53-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-55-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-78-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2568-213-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 1484 build2.exe 3036 build2.exe 2372 build3.exe 2032 build3.exe 2216 mstsca.exe 696 mstsca.exe 3020 mstsca.exe 1296 mstsca.exe 956 mstsca.exe 2076 mstsca.exe 3064 mstsca.exe 2976 mstsca.exe -
Loads dropped DLL 11 IoCs
Processes:
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exeWerFault.exepid process 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 1056 WerFault.exe 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-452311807-3713411997-1028535425-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\fb9c753d-4e15-415c-8dc1-2ea005876b63\\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe\" --AutoStart" 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 3 api.2ip.ua 4 api.2ip.ua 8 api.2ip.ua -
Suspicious use of SetThreadContext 8 IoCs
Processes:
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 2196 set thread context of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 set thread context of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 1484 set thread context of 3036 1484 build2.exe build2.exe PID 2372 set thread context of 2032 2372 build3.exe build3.exe PID 2216 set thread context of 696 2216 mstsca.exe mstsca.exe PID 3020 set thread context of 1296 3020 mstsca.exe mstsca.exe PID 956 set thread context of 2076 956 mstsca.exe mstsca.exe PID 3064 set thread context of 2976 3064 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1056 3036 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1492 schtasks.exe 2992 schtasks.exe -
Processes:
build2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exepid process 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exebuild2.exebuild2.exebuild3.exebuild3.exedescription pid process target process PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2196 wrote to memory of 2496 2196 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2496 wrote to memory of 2816 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe icacls.exe PID 2496 wrote to memory of 2816 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe icacls.exe PID 2496 wrote to memory of 2816 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe icacls.exe PID 2496 wrote to memory of 2816 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe icacls.exe PID 2496 wrote to memory of 2928 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2496 wrote to memory of 2928 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2496 wrote to memory of 2928 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2496 wrote to memory of 2928 2496 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2928 wrote to memory of 2568 2928 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe PID 2568 wrote to memory of 1484 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build2.exe PID 2568 wrote to memory of 1484 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build2.exe PID 2568 wrote to memory of 1484 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build2.exe PID 2568 wrote to memory of 1484 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 1484 wrote to memory of 3036 1484 build2.exe build2.exe PID 3036 wrote to memory of 1056 3036 build2.exe WerFault.exe PID 3036 wrote to memory of 1056 3036 build2.exe WerFault.exe PID 3036 wrote to memory of 1056 3036 build2.exe WerFault.exe PID 3036 wrote to memory of 1056 3036 build2.exe WerFault.exe PID 2568 wrote to memory of 2372 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build3.exe PID 2568 wrote to memory of 2372 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build3.exe PID 2568 wrote to memory of 2372 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build3.exe PID 2568 wrote to memory of 2372 2568 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2372 wrote to memory of 2032 2372 build3.exe build3.exe PID 2032 wrote to memory of 1492 2032 build3.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\fb9c753d-4e15-415c-8dc1-2ea005876b63" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exe"C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exe"C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3036 -s 14447⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build3.exe"C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build3.exe"C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {892AB82F-4D29-4C4A-8A56-95033950723A} S-1-5-21-452311807-3713411997-1028535425-1000:OZEMQECW\Admin:Interactive:[1]1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD53769f53ac22cdf6658c874805d9983a5
SHA153ba470f9cd12bbfde1d1149bcad0029e0f8a84f
SHA25687ec66df2ed0afbd05a6094ba5ad5bc5b3ef6807828d00323b1addb6addd1c17
SHA51256ce76ea6aeaaafac14128912b31e12a16a2ca85b97ece7f3034bea5ca3b249c0cfe974b2823f35d38c46d6b3faa7278732b183a86c85f469c422384f08f2925
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5a23da5af729c65ce02cfbc79602d1e58
SHA158a95254649f500fda6710f32d0f3006010d8c3f
SHA256521bcaf484abed735d43463a644e68bc855d979899ec0a08a4a028b971115eff
SHA512e81cb750ffae0267ce8feacc5eb7f33ba25a08a39e20a997d5e04e258983ed437d1c4f8b5974339791fbe99e603f0cee540d296025815ac9f410c2dd323866dc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD5c494cca602251b4bc0493dca75320873
SHA1d4959aca9bfa54704b8de2ebea624884bff526f3
SHA2560c7d665a7e697ebcd4bcdc0a826874fe8f307de2c235c7a89de0934c1db299c5
SHA5127b71e3a0220fee903803df9a154432c4697171991b09b75083fbd8f2ada94880f5aa80c491f36e4d25383a56f3234fd50909c5b573f04e8c301d36809637d07b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD502c9d54df6b0d2c45bb5d9cb4317c3fc
SHA1b5d18df5b6f527389d25a356312b2e9a4e029bae
SHA25697e39e2def48c22e8eb6440fe09eefd56e12e6fc93399d746b97e7051937303e
SHA512f4122cfc109d5333ffe62c3e2be21c8cfcce7fe2a0d646b6135e5ffa5c60217daa51ab0e21cb4494bc1350e7c1e9324b0db836d4f5ffbf79b3346d7c316936ff
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD56172abfc984f61b87a0404c22f3408a5
SHA15fc0d483c1fab6628e5b96924db4a6a34df3235c
SHA25658128bede7173737f21525a72fbbfa4256c78ad86077ae4522fe5c891432099c
SHA5121740fd349464df0f7bbf4b14406869b4eaec4dcae7968c238781552002eeb4ff9fd0683a88c529ad568fbdf78db2bd78c55e6ec6912dee28f5533e9dc3df5647
-
C:\Users\Admin\AppData\Local\Temp\Cab7ABB.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\Tar9464.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exeFilesize
256KB
MD5bff92d1c712150bf83198cc1d76ca46f
SHA19ae793a3aee8fb739f7bfa5ec2e633fe7a5aa1e9
SHA2565d826e88471f91b24ddf45bc07deb116d063a8b8fb5419f553c0cd5ad1877e64
SHA512adaf6d206f514e3d67693e020c1fa919edd94066fbb4648935d19808a2afdd1cb847249907d1ad20dc07d6b9c8c1d7dc7825d26dcb7738f06feba118fcb8b201
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exeFilesize
385KB
MD563e4a9cd7a8b37335b5f18cefc5dd9d2
SHA1c781a30935afc452b108cc78724b60f389b78874
SHA256c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f
SHA5123818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc
-
C:\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build3.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
C:\Users\Admin\AppData\Local\fb9c753d-4e15-415c-8dc1-2ea005876b63\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exeFilesize
819KB
MD5aed73fb9a0ebf033d0478fa814e7b8d3
SHA10058f0b7203c592edf70131b84f6cb1fe784f8a3
SHA25666281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba
SHA5123a264e0286234e97f5c01816adcd40a408ac66153ce81e4066c22a54f4533a3a34fcb9a3e40db41dee7227ee24a084a89f2b61da9a5cf14ee8b50669ea9ebffb
-
\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exeFilesize
372KB
MD55e2b487571ae86f0b7bced8333f87d5c
SHA1a2a2805efb47a1b1f5961305d62bf32c2fc0bf2a
SHA2568b6b9d0e0203723697cae249425c14798f14a9cb20a1b1b585f940ff82632705
SHA51200ce5e2db099f1513c2f81137e69a2750c9da6cb354a5547857fd143ccb963aaf756f1f70bade6b82145bdbd559e94a9f900c7dc4558de168d8cf0fe7193d7b8
-
\Users\Admin\AppData\Local\f1b2a519-91b6-4f1e-876d-5adf0218a291\build2.exeFilesize
320KB
MD5888fa27b4eb8dadd54f4e86e542637a9
SHA144d8a67fa6459730f4e710c600817d5c338ecc35
SHA2569b911290d1a3a99054f49104032e0b229e0162d9bb6d69c2159c44fb6bb61514
SHA51248f2b46bcf37c9aa994ac00bf672139bf645dc53b3274b408e67c7dbd539082f293e6734c9f84e2fb4e654ab002deb3b82fd8c7f08beac8cb9995fb623d25961
-
memory/956-305-0x00000000008D0000-0x00000000009D0000-memory.dmpFilesize
1024KB
-
memory/1484-71-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/1484-72-0x0000000000250000-0x0000000000280000-memory.dmpFilesize
192KB
-
memory/2032-227-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2032-225-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2032-222-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2032-218-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2196-0-0x0000000001C70000-0x0000000001D02000-memory.dmpFilesize
584KB
-
memory/2196-1-0x0000000001C70000-0x0000000001D02000-memory.dmpFilesize
584KB
-
memory/2196-2-0x0000000001DB0000-0x0000000001ECB000-memory.dmpFilesize
1.1MB
-
memory/2216-248-0x0000000000270000-0x0000000000370000-memory.dmpFilesize
1024KB
-
memory/2372-220-0x0000000000220000-0x0000000000224000-memory.dmpFilesize
16KB
-
memory/2372-219-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/2496-26-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2496-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2496-7-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2496-8-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2496-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2568-56-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-55-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-34-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-78-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-48-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-49-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-213-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-53-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2568-35-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2928-27-0x00000000004E0000-0x0000000000572000-memory.dmpFilesize
584KB
-
memory/2928-28-0x00000000004E0000-0x0000000000572000-memory.dmpFilesize
584KB
-
memory/3020-273-0x0000000000860000-0x0000000000960000-memory.dmpFilesize
1024KB
-
memory/3036-215-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3036-70-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/3036-74-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3036-77-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3036-79-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/3064-331-0x00000000008F0000-0x00000000009F0000-memory.dmpFilesize
1024KB