djvu | 81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3

Analysis

max time kernel
299s
max time network
293s
platform
windows10-1703_x64
resource
win10-20231215-en
resource tags

arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system
submitted
05-02-2024 04:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
Size

736KB
MD5

adb72c7dec5dd45c7f172f4d2d01e1ae
SHA1

9a375b6d4a413807e7775b87722b3f10ce1fe511
SHA256

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3
SHA512

e9da509a506028ee72cfb986bba23a158ee40f58f516b423b1cc7d20472299fc0791b7faf86ed13c94db7a98791a4bae63c783013793012dec43951783001c3c
SSDEEP

12288:k6B0LvP6A0BEE0/wPSZUh6p7N23h8ByUtgLtRGVA50z9btGdQCAP:kT7cgZUO7Y3WzgpchJGiCAP

Score

10^/10

djvu vidar 1b9d7ec5a25ab9d78c31777a0016a097 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdcc
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0846ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

7.6

Botnet

1b9d7ec5a25ab9d78c31777a0016a097

https://t.me/tvrugrats

https://steamcommunity.com/profiles/76561199627279110

Attributes

profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097

Signatures

Detect Vidar Stealer 6 IoCs

stealer

Processes:

resource	yara_rule
behavioral2/memory/2192-52-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/4424-51-0x0000000000560000-0x0000000000590000-memory.dmp	family_vidar_v7
behavioral2/memory/2192-50-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2192-46-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/2192-66-0x0000000000400000-0x0000000000643000-memory.dmp	family_vidar_v7
behavioral2/memory/1152-177-0x0000000000990000-0x0000000000A90000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 16 IoCs

Processes:

resource	yara_rule
behavioral2/memory/96-2-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/96-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/96-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3948-4-0x00000000021F0000-0x000000000230B000-memory.dmp	family_djvu
behavioral2/memory/96-1-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/96-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-53-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4616-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 13 IoCs

Processes:

build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exe

pid	process
4424	build2.exe
2192	build2.exe
3460	build3.exe
3448	build3.exe
2016	mstsca.exe
3660	mstsca.exe
1864	mstsca.exe
2292	mstsca.exe
4804	mstsca.exe
2956	mstsca.exe
1152	mstsca.exe
2304	mstsca.exe
4964	mstsca.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4900 icacls.exe

pid	process
4900	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-655921741-723621465-1580683668-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\85de51f5-af44-4e1c-ac94-65512b941c1c\\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe\" --AutoStart"	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.2ip.ua
2 api.2ip.ua
10 api.2ip.ua

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
10	api.2ip.ua

Suspicious use of SetThreadContext 8 IoCs

Processes:

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exe

description	pid	process	target process
PID 3948 set thread context of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 set thread context of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 4424 set thread context of 2192	4424	build2.exe	build2.exe
PID 3460 set thread context of 3448	3460	build3.exe	build3.exe
PID 2016 set thread context of 3660	2016	mstsca.exe	mstsca.exe
PID 1864 set thread context of 2292	1864	mstsca.exe	mstsca.exe
PID 4804 set thread context of 2956	4804	mstsca.exe	mstsca.exe
PID 1152 set thread context of 2304	1152	mstsca.exe	mstsca.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3348 2192 WerFault.exe build2.exe
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task/Job
T1053

Processes:

schtasks.exeschtasks.exe

pid process

2524 schtasks.exe
1004 schtasks.exe

pid	pid_target	process	target process
3348	2192	WerFault.exe	build2.exe

pid	process
2524	schtasks.exe
1004	schtasks.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe

pid	process
96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exe

description	pid	process	target process
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 3948 wrote to memory of 96	3948	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 96 wrote to memory of 4900	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	icacls.exe
PID 96 wrote to memory of 4900	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	icacls.exe
PID 96 wrote to memory of 4900	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	icacls.exe
PID 96 wrote to memory of 2188	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 96 wrote to memory of 2188	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 96 wrote to memory of 2188	96	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 2188 wrote to memory of 4616	2188	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
PID 4616 wrote to memory of 4424	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build2.exe
PID 4616 wrote to memory of 4424	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build2.exe
PID 4616 wrote to memory of 4424	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4424 wrote to memory of 2192	4424	build2.exe	build2.exe
PID 4616 wrote to memory of 3460	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build3.exe
PID 4616 wrote to memory of 3460	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build3.exe
PID 4616 wrote to memory of 3460	4616	81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3460 wrote to memory of 3448	3460	build3.exe	build3.exe
PID 3448 wrote to memory of 2524	3448	build3.exe	schtasks.exe
PID 3448 wrote to memory of 2524	3448	build3.exe	schtasks.exe
PID 3448 wrote to memory of 2524	3448	build3.exe	schtasks.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 2016 wrote to memory of 3660	2016	mstsca.exe	mstsca.exe
PID 3660 wrote to memory of 1004	3660	mstsca.exe	schtasks.exe

C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
"C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3948

C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
"C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:96

C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
"C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2188

C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
"C:\Users\Admin\AppData\Local\Temp\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4616

C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe
"C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4424

C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe
"C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe"
5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3460

C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe
"C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe"
6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3448

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
7⤵
- Creates scheduled task(s)
PID:2524

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\85de51f5-af44-4e1c-ac94-65512b941c1c" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4900

C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe
"C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe"
1⤵
- Executes dropped EXE
PID:2192

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 2192 -s 1860
2⤵
- Program crash
PID:3348

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2016

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3660

C:\Windows\SysWOW64\schtasks.exe
/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
3⤵
- Creates scheduled task(s)
PID:1004

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1864

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2292

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:4804

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2956

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
PID:1152

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
2⤵
- Executes dropped EXE
PID:2304

C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
1⤵
- Executes dropped EXE
PID:4964

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
c59708a86e78530488f2356251e775a2

SHA1
17e33e077261cdd9e54d4e58dfb168f15ee93efb

SHA256
71719971666e64a4f767e8f9d0b52e822189c4bfb1fe449a0e7c8066c82813c2

SHA512
42afd4d2c791ea8cb239130cf4f4d43da0ec39c63049c56796e082282e2ba2f0cd0fd8934b7de3b359ca433b0609ad159fda6f92168168f2d4517f13fbbb3fbf

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
ae9634db3ef7b33a742f29945bd16f37

SHA1
573ab298616b779ef20d8f54938530a6b734848a

SHA256
d386ab974e494eeb0903c968df84306c193b2286071746dde7b192f3a38acfe8

SHA512
72e01d9c7bf142cd026f676cee47863a8f185a9c9469188f1fc1fcb739933b7f09ceea98e706fab0a4aba4b73d247d88022fcb5697e6bc33de8a6340036932f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
db7ee325f1e15f47176d21e5633e1b16

SHA1
97e80e669f1f2eb2a3453ad5b4da230b66454fae

SHA256
0beca98452b3c1938acc8e37da251a0555498964bbbc1736315c36a332226ea4

SHA512
1d6b3eadd4d5fd5e3e98ec95036ea6a6458974c5a6bef99da9381ca432073d0a64f2f19fbcccb19e8780485b8bc7072e74203eed5eb1fe762291aca5ee90fd70

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe
Filesize
117KB

MD5
89604ae17c8b53bf03b38dbd4f4ce11a

SHA1
c319d0d354f2b23b8e8fb63c24fd9508960435e9

SHA256
867700569ae5c9ab0b5a5a3c93f6f57bbc0e481058caa15d6fce7b703c963470

SHA512
805aeb7aad6abe54d05a2da19e9442d0930fc86d007e56e970b025a4d2eb0e564ba4785832e3436b429e2c83f9464841e7eedbcfcf410716373d33e5cb08b46f

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe
Filesize
88KB

MD5
9ec1db88fbceb8f0bd4c0071f94d8ab5

SHA1
ebbe06c2fafe341b9ed6913e310463b2f6f37759

SHA256
41ae841d0a3eafd12a8b8ff0a76f0d5ff82ae0781edca69873d53de11487ac39

SHA512
1ef9f8311189285e5f064bdc6b6a4161b02df0daaed2edd57d7e58bd404efce8cc409bf86aa01ff0fd01052df1b39373b8c88f98b7209ee68966c47b6022080d

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build2.exe
Filesize
152KB

MD5
9b1273a7d3c5766672f25b6955c0e185

SHA1
9e159de6c6433a55dd2e22e79aa5d20efb640988

SHA256
00f2238c87fd3424518b50ac81aad8adf426df593ab867f17b824a3249a3db0f

SHA512
0cbbf3dd56791399d713b99ada521cbf7aa6b83f253388d70ddb3ebd945eeeb0e7ea1a22f7c7d3bbb89f658e31e0b2a175d964399699607b009f8bb25ef60b89

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe
Filesize
110KB

MD5
e30f2a4315397441682236321541230f

SHA1
d9e7f8dfecae59ca50b05a95a9f04250d6782967

SHA256
eb9590cfed5835b5c6a4d611be51d1ab02c1ba01d38cc68d1aedd331765cda97

SHA512
e5e5f86b30bc72ac704f3236967734182d8c75682d408eb9b4dd33e85f01a05314684a6beb376ea056c1fe055eab48963ee85d0a08960d37c9ec32415a6b8e96

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe
Filesize
140KB

MD5
51580778e8b9c0012074ca8c0b29451d

SHA1
2b3023b4d38109a763954f2cf554d1cb90d7ff43

SHA256
d3aa28a07374a926d58ac8df9cc7d9f34c912eb6c6f0ededa87acb7406b6df06

SHA512
d1ba683fe5a50e0154a2f5b867f89b5e4f988f7f612b9e385be02760592899e99c2f6fda6e33aaebb0d70d95d4a1a018b928167aeeeeb9d0ee5c16deae24dae9

Download Submit
C:\Users\Admin\AppData\Local\5e3a1669-d0ff-40b0-98f0-69b4778b41b4\build3.exe
Filesize
299KB

MD5
41b883a061c95e9b9cb17d4ca50de770

SHA1
1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

SHA256
fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

SHA512
cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

Download Submit
C:\Users\Admin\AppData\Local\85de51f5-af44-4e1c-ac94-65512b941c1c\81bc674ece66294d98951305f4734f6ef520d3331901586efb895abf353b3be3.exe
Filesize
352KB

MD5
12f3ea1497fa63c0001ecf2d5e52effe

SHA1
7fe0dd438bb900137747a6cd9b991de301fcad12

SHA256
1fc5d50f1d07a43cf961e21de91164047b866d049b7b8b4909818f869b8d2554

SHA512
d1ef282c64d4c1cd07fce859109261ae37a9c45e08946283771a7521fbc3d2779d0659fb92974b06eccafcca4bbb80f5c8c2fe0b1e68fd8d1fcd19133b72aa91

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
176KB

MD5
b22b5daa20b57f0b4598f771be2b0c2a

SHA1
f1118d07c0a44bf5b070796c944947805e4f5d52

SHA256
5edb436b58d9ec28225b1507491bb18191b2fadbe3c262ed983f52b23f895b26

SHA512
b99e632859638265107caecf2265af7d0378cd58a1e5e99374a9a9b53185f4f8fd04830d4ac6b0baaa3ee931a92a7048cb6343f5414db091b88b81f8e9c6f126

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
Filesize
184KB

MD5
24c425bcb8559118f52615444c069794

SHA1
f7b26f372e094f8e0c7ed80e5191600c89cecd1a

SHA256
9b6d2160b6faea5c9ec79cf824b234624ca448377d7fe77a386c12fed6cb41d6

SHA512
b21251995dc61ae1d04c06721ad740595487afc366ec0779690a1a8ca9acd0e5b351aff040bebb82ede64f532417d303cdefa4d98e7546042512af7c8d426252

Download Submit
memory/96-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/96-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/96-2-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/96-1-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/96-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1152-177-0x0000000000990000-0x0000000000A90000-memory.dmp

Filesize
1024KB

Download
memory/1864-123-0x0000000000A50000-0x0000000000B50000-memory.dmp

Filesize
1024KB

Download
memory/2016-100-0x0000000000A9A000-0x0000000000AAA000-memory.dmp

Filesize
64KB

Download
memory/2188-22-0x0000000001FBC000-0x000000000204D000-memory.dmp

Filesize
580KB

Download
memory/2192-52-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2192-50-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2192-66-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2192-46-0x0000000000400000-0x0000000000643000-memory.dmp

Filesize
2.3MB

Download
memory/2292-128-0x0000000000410000-0x0000000000411000-memory.dmp

Filesize
4KB

Download
memory/3448-78-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3448-75-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3448-71-0x0000000000400000-0x0000000000406000-memory.dmp

Filesize
24KB

Download
memory/3460-74-0x0000000000A70000-0x0000000000B70000-memory.dmp

Filesize
1024KB

Download
memory/3460-76-0x0000000000920000-0x0000000000924000-memory.dmp

Filesize
16KB

Download
memory/3460-85-0x0000000000920000-0x0000000000924000-memory.dmp

Filesize
16KB

Download
memory/3948-4-0x00000000021F0000-0x000000000230B000-memory.dmp

Filesize
1.1MB

Download
memory/3948-3-0x0000000002150000-0x00000000021E7000-memory.dmp

Filesize
604KB

Download
memory/4424-49-0x0000000000620000-0x0000000000720000-memory.dmp

Filesize
1024KB

Download
memory/4424-69-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/4424-51-0x0000000000560000-0x0000000000590000-memory.dmp

Filesize
192KB

Download
memory/4616-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4616-53-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4804-151-0x0000000000B7E000-0x0000000000B8E000-memory.dmp

Filesize
64KB

Download