djvu | 66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba

Analysis

max time kernel
295s
max time network
302s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
04-02-2024 07:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
Size

819KB
MD5

aed73fb9a0ebf033d0478fa814e7b8d3
SHA1

0058f0b7203c592edf70131b84f6cb1fe784f8a3
SHA256

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba
SHA512

3a264e0286234e97f5c01816adcd40a408ac66153ce81e4066c22a54f4533a3a34fcb9a3e40db41dee7227ee24a084a89f2b61da9a5cf14ee8b50669ea9ebffb
SSDEEP

12288:q2kxn4QFNbM2vZ+UO2Hf55nnVP3xxJSpH136GcAnCPQ8FcNAE2Jr90tPT1td9eY:c/DM28uHZPnG1GAnCPQ2mad9G5tzR

Score

10^/10

djvu vidar 1b9d7ec5a25ab9d78c31777a0016a097 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Signatures

Detect Vidar Stealer 8 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/4744-52-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-51-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/4548-50-0x0000000000470000-0x00000000004A0000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-46-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/4744-66-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/3552-71-0x00000000008C0000-0x00000000009C0000-memory.dmp	family_vidar_v7
behavioral2/memory/1864-104-0x0000000000900000-0x0000000000A00000-memory.dmp	family_vidar_v7
behavioral2/memory/4928-129-0x00000000009A0000-0x0000000000AA0000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/3428-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3428-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4332-2-0x00000000022D0000-0x00000000023EB000-memory.dmp	family_djvu
behavioral2/memory/3428-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3428-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3428-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/5116-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 12 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

pid	process
4548	build2.exe
4744	build2.exe
3552	build3.exe
4560	build3.exe
1864	mstsca.exe
4064	mstsca.exe
4928	mstsca.exe
2904	mstsca.exe
1056	mstsca.exe
4204	mstsca.exe
4660	mstsca.exe
2240	mstsca.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4380 icacls.exe

pid	process
4380	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6f1d05ac-5564-49f5-a63b-10e9879561a7\\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe\" --AutoStart"	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.2ip.ua
2 api.2ip.ua
8 api.2ip.ua

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
8	api.2ip.ua

Suspicious use of SetThreadContext 8 IoCs

Processes:

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exe

description	pid	process	target process
PID 4332 set thread context of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 set thread context of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4548 set thread context of 4744	4548	build2.exe	build2.exe
PID 3552 set thread context of 4560	3552	build3.exe	build3.exe
PID 1864 set thread context of 4064	1864	mstsca.exe	mstsca.exe
PID 4928 set thread context of 2904	4928	mstsca.exe	mstsca.exe
PID 1056 set thread context of 4204	1056	mstsca.exe	mstsca.exe
PID 4660 set thread context of 2240	4660	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

5112 4744 WerFault.exe build2.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2080 schtasks.exe
1756 schtasks.exe

pid	pid_target	process	target process
5112	4744	WerFault.exe	build2.exe

pid	process
2080	schtasks.exe
1756	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe

pid	process
3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exe

description	pid	process	target process
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 4332 wrote to memory of 3428	4332	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 3428 wrote to memory of 4380	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	icacls.exe
PID 3428 wrote to memory of 4380	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	icacls.exe
PID 3428 wrote to memory of 4380	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	icacls.exe
PID 3428 wrote to memory of 2904	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 3428 wrote to memory of 2904	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 3428 wrote to memory of 2904	3428	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 2904 wrote to memory of 5116	2904	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
PID 5116 wrote to memory of 4548	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build2.exe
PID 5116 wrote to memory of 4548	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build2.exe
PID 5116 wrote to memory of 4548	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 4548 wrote to memory of 4744	4548	build2.exe	build2.exe
PID 5116 wrote to memory of 3552	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build3.exe
PID 5116 wrote to memory of 3552	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build3.exe
PID 5116 wrote to memory of 3552	5116	66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 3552 wrote to memory of 4560	3552	build3.exe	build3.exe
PID 4560 wrote to memory of 2080	4560	build3.exe	schtasks.exe
PID 4560 wrote to memory of 2080	4560	build3.exe	schtasks.exe
PID 4560 wrote to memory of 2080	4560	build3.exe	schtasks.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 1864 wrote to memory of 4064	1864	mstsca.exe	mstsca.exe
PID 4064 wrote to memory of 1756	4064	mstsca.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4332

C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3428

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\6f1d05ac-5564-49f5-a63b-10e9879561a7" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4380

C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2904

C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
"C:\Users\Admin\AppData\Local\Temp\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5116

C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe
"C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4548

C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe
"C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe"
6⤵
- Executes dropped EXE
PID:4744

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4744 -s 2072
7⤵
- Program crash
PID:5112

C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe
"C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3552

C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe
"C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4560

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:2080

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1864

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4064

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:1756

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4928

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2904

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1056

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:4204

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4660

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2240

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
3769f53ac22cdf6658c874805d9983a5

SHA1
53ba470f9cd12bbfde1d1149bcad0029e0f8a84f

SHA256
87ec66df2ed0afbd05a6094ba5ad5bc5b3ef6807828d00323b1addb6addd1c17

SHA512
56ce76ea6aeaaafac14128912b31e12a16a2ca85b97ece7f3034bea5ca3b249c0cfe974b2823f35d38c46d6b3faa7278732b183a86c85f469c422384f08f2925

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
a42eff3d6f359a005a24f56de3ca69a5

SHA1
b7e0348bb744c919b18c6f7ba8ec30ebe37a68a9

SHA256
78dae56a6d4932ebfc35263d19033126b82347d4e3e146fabd8c8c7b10602c02

SHA512
56c86e34743d8dfb33698d89f2e2f7a6a39faaf9819275443eec92ae6c24e38c80b4704b839324591517b70877818bca9b459d94e8493609c50685ac766e1510

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
673e6bd3318a23bfde4f31972dc17961

SHA1
d32fa8afc40efbcbfc20d0417e80d5c1944911e4

SHA256
a7ec6709a79b1be4c666b1fbd43436d7615c73abadbb0df60825210f2c776d7b

SHA512
1e5ae8707aaf9c0c5a936778d14dbcdbeaab5a9bc7a64fc054b0e8720f0b1cc2ab07d6dbd47b1f295062b6be91f432599ba5d6488acc64858ba01c60feb69fc4

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe
Filesize
154KB

MD5
459679b1db8af09ffc1c96fc489b571d

SHA1
684d1b5d79b7eab67eff516a278c475346dcc401

SHA256
b52114e00711f22bd60577ba0a4ef7d7f5fad76af59911219d73c0f2576f83c8

SHA512
95b92879ac86756ff9d43f8a5600db1d383cf747b64cbeefe5f249c0c5152c467976ce9ba6d52f3ff5a39f6c39502f23eba98252c3ce149a5e5fa42178654ae9

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe
Filesize
110KB

MD5
8f4375f9e59fccce1c35ced67ea7a4e5

SHA1
47a5b8424bcba17e2fc64464def68f9025da555e

SHA256
3286ef3dbbcffa980823192eb9c610a39e0b418c1597d37330d23503da92ec65

SHA512
1ab4d341c397c571b68a8c3e8d35b06d0fd7fbc9477797eac6fb1481583b938a4508ae7514a1e8c62da37d35cbc18822b37925c8bddc41975f8b6da332ec9f8b

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build2.exe
Filesize
300KB

MD5
49a7cd126e2abbf7767107e155d04618

SHA1
867223c6bcecaf219cbce3b65105af46dfbc09e8

SHA256
51eb55421d185365eeac0257e530e5fd82e7d86511dbc55e4a2468be009e61be

SHA512
8ed9f9602e38069c49722fb69803796c25f5bf092e772149b1e2a802cf795a8e1122760fd2802020269432e38d9712182ba42df7c4d27006e65cef88f1ac83c4

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe
Filesize
71KB

MD5
0c4e2329bed4df6937c37868e7d0a109

SHA1
aa315fd2e02a5c41368d502dfae0356794367f50

SHA256
5a9e0271f87f0f609d9a40d0cba47eabbb46b3820c3cb6232528054c2f0ca95f

SHA512
d2831a53ea80c8c03be498ed025ac4e6ec96670faf3d8c94d182efe0bbc9a0f469712b66d41c1f3b63c266bcfefe9355c80f9c057d91815e0ef215d365c2f2d0

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe
Filesize
52KB

MD5
79460d190d2fea999ba57be3db578d4a

SHA1
149ab564619065c988c857d7618979e19dfebf76

SHA256
1bd1949fbf3dfe9e319abec9cc3f5b654089c2f751fea14882265010692dceb1

SHA512
b294dc53aacb6ba71e149761508f916f9783fcb216b178d1474079c635999b67d6eec9d330bc6c54b3cb540482b6d7b734502eccc06ffc0316af08c576942f49

Download Submit
C:\Users\Admin\AppData\Local\22a593b1-184d-4300-a2b1-6600ff800156\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
C:\Users\Admin\AppData\Local\6f1d05ac-5564-49f5-a63b-10e9879561a7\66281e09139f827829da257b0976c5bca2db8150b8422da7582bc2c2db33e8ba.exe
Filesize
61KB

MD5
07f9d0da48e9fb3bce4b8ef1ee88a0fb

SHA1
8515188ed5e60b99b81d19812a4f063222a67fb3

SHA256
812fa99f71dee7ccad1643412d6493a23d65a2ee2a25ac61ca600b4fb1bb6cd4

SHA512
04a7733000430c4ac961f64f5e030054d4fa178c8c8421cfea91b388a864bae9a96926e98a1ec11ca19f0ed33cfd7d2d89cc69b4cae9771f3bae999bf5d705c8

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
68KB

MD5
b3087de634ee92a4bcea1f514761f285

SHA1
e0b309fd3c6031c23353de3377956c1701fb84c8

SHA256
663bd047fd9fc486b61d488102b158d9773a718d56181a163173cb246547127f

SHA512
02f17c22d320d90e3e59871b9e708e53d897381119c482cf44f5fcb858e70a3162c314b677fee8ed493fe21d5af6369847fbc0c9aec54c4a10a6739ed4b151a6

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
98KB

MD5
0c986d9088aad386eed87a40bada5953

SHA1
bdabec9b84f7fa371e6909426e12d8dee965db68

SHA256
47ec1bc2237ce1a5775753dff142c6f26c801f591f746f4520651f4091365826

SHA512
62234d81778fe5e27a475a09dbc503a12d67872f0ad7d3dfed0b4dea3c83d601a8a13a45db27870c7b2f87afefacee0615cd2836b1091ff5bce939ba8ca0331a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
162KB

MD5
893082c4ffbb1675b6b63f6d0b42e6a5

SHA1
793bc93298ab43dde1f0bf7b6445870ae45d0e67

SHA256
a23e381cfac23e695e10f23b1bcce899b30dadb75ed8c184ee7d72e10f8967f5

SHA512
f5c0b39ea24fe739cc7d6fd52bcb23d0dfd2f2f314fc08b7e4be440ed52cdcfb37f223831935ee11d48fe6fce5633c326379b24ffb6815f1adb17e4723175ecc

Download Submit
memory/1056-155-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/1056-166-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/1864-104-0x0000000000900000-0x0000000000A00000-memory.dmp

Filesize
1024KB

Download
memory/2904-21-0x0000000002070000-0x000000000210F000-memory.dmp

Filesize
636KB

Download
memory/3428-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3428-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3428-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3428-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3428-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3552-72-0x0000000000810000-0x0000000000814000-memory.dmp

Filesize
16KB

Download
memory/3552-71-0x00000000008C0000-0x00000000009C0000-memory.dmp

Filesize
1024KB

Download
memory/4332-2-0x00000000022D0000-0x00000000023EB000-memory.dmp

Filesize
1.1MB

Download
memory/4332-1-0x0000000002120000-0x00000000021B9000-memory.dmp

Filesize
612KB

Download
memory/4548-48-0x0000000000660000-0x0000000000760000-memory.dmp

Filesize
1024KB

Download
memory/4548-50-0x0000000000470000-0x00000000004A0000-memory.dmp

Filesize
192KB

Download
memory/4560-75-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4560-77-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4560-70-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/4560-78-0x0000000000410000-0x00000000004D5000-memory.dmp

Filesize
788KB

Download
memory/4660-180-0x0000000000840000-0x0000000000940000-memory.dmp

Filesize
1024KB

Download
memory/4744-46-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4744-66-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4744-51-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4744-52-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/4928-129-0x00000000009A0000-0x0000000000AA0000-memory.dmp

Filesize
1024KB

Download
memory/5116-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/5116-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download