Analysis
-
max time kernel
296s -
max time network
297s -
platform
windows10-1703_x64 -
resource
win10-20231215-en -
resource tags
arch:x64arch:x86image:win10-20231215-enlocale:en-usos:windows10-1703-x64system -
submitted
05-02-2024 04:55
Static task
static1
Behavioral task
behavioral1
Sample
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
Resource
win10-20231215-en
General
-
Target
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe
-
Size
774KB
-
MD5
a775dae66ce141797fe36ee3509c6177
-
SHA1
b822ee79f6cdfe299c70bbb14cb96f9560edb4f6
-
SHA256
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf
-
SHA512
c94d0bfc21d4ac08b13b45aacb30a7411cf59d01139c6a5c78146cfcdafa7375b55f48be4192b331ae47a86e4a591cebe95f2a2878dc963e9160e62c9d42590f
-
SSDEEP
12288:WVScQtCEfpoaOjz2BgoYuqUV7SSO4C2QB5P/ihmeu3XOVDuTF+d3N38Z872:3Ciu/qgZUV7B7siorXOVDh8Z87
Malware Config
Extracted
djvu
http://habrafa.com/test1/get.php
-
extension
.cdcc
-
offline_id
LBxKKiegnAy53rpqH3Pj2j46vwldiEt9kqHSuMt1
-
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iVcrVFVRqu Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0846ASdw
Extracted
vidar
7.6
1b9d7ec5a25ab9d78c31777a0016a097
https://t.me/tvrugrats
https://steamcommunity.com/profiles/76561199627279110
-
profile_id_v2
1b9d7ec5a25ab9d78c31777a0016a097
Signatures
-
Detect Vidar Stealer 9 IoCs
Processes:
resource yara_rule behavioral2/memory/760-47-0x00000000020D0000-0x0000000002100000-memory.dmp family_vidar_v7 behavioral2/memory/4268-48-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/4268-51-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/4268-52-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/4268-86-0x0000000000400000-0x0000000000643000-memory.dmp family_vidar_v7 behavioral2/memory/4612-100-0x0000000000A40000-0x0000000000B40000-memory.dmp family_vidar_v7 behavioral2/memory/1092-150-0x0000000000A90000-0x0000000000B90000-memory.dmp family_vidar_v7 behavioral2/memory/4264-177-0x00000000009B0000-0x0000000000AB0000-memory.dmp family_vidar_v7 behavioral2/memory/196-206-0x0000000000A40000-0x0000000000B40000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 16 IoCs
Processes:
resource yara_rule behavioral2/memory/1560-2-0x00000000021C0000-0x00000000022DB000-memory.dmp family_djvu behavioral2/memory/4708-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4708-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4708-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4708-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4708-17-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-23-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-24-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-29-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-36-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-37-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-53-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2104-72-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 14 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 760 build2.exe 4268 build2.exe 4576 build3.exe 2168 build3.exe 4612 mstsca.exe 1972 mstsca.exe 2472 mstsca.exe 420 mstsca.exe 1092 mstsca.exe 392 mstsca.exe 4264 mstsca.exe 2996 mstsca.exe 196 mstsca.exe 3472 mstsca.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4068299709-2976237847-2753307267-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6e466b24-75d7-4d7a-ba98-c5c439a95970\\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe\" --AutoStart" 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 1 api.2ip.ua 2 api.2ip.ua 10 api.2ip.ua -
Suspicious use of SetThreadContext 9 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 1560 set thread context of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 set thread context of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 760 set thread context of 4268 760 build2.exe build2.exe PID 4576 set thread context of 2168 4576 build3.exe build3.exe PID 4612 set thread context of 1972 4612 mstsca.exe mstsca.exe PID 2472 set thread context of 420 2472 mstsca.exe mstsca.exe PID 1092 set thread context of 392 1092 mstsca.exe mstsca.exe PID 4264 set thread context of 2996 4264 mstsca.exe mstsca.exe PID 196 set thread context of 3472 196 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2216 4268 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4968 schtasks.exe 3028 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exepid process 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exedescription pid process target process PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 1560 wrote to memory of 4708 1560 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4708 wrote to memory of 192 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe icacls.exe PID 4708 wrote to memory of 192 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe icacls.exe PID 4708 wrote to memory of 192 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe icacls.exe PID 4708 wrote to memory of 4308 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4708 wrote to memory of 4308 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4708 wrote to memory of 4308 4708 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 4308 wrote to memory of 2104 4308 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe PID 2104 wrote to memory of 760 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 2104 wrote to memory of 760 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 2104 wrote to memory of 760 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 760 wrote to memory of 4268 760 build2.exe build2.exe PID 2104 wrote to memory of 4576 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 2104 wrote to memory of 4576 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 2104 wrote to memory of 4576 2104 8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 4576 wrote to memory of 2168 4576 build3.exe build3.exe PID 2168 wrote to memory of 4968 2168 build3.exe schtasks.exe PID 2168 wrote to memory of 4968 2168 build3.exe schtasks.exe PID 2168 wrote to memory of 4968 2168 build3.exe schtasks.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 4612 wrote to memory of 1972 4612 mstsca.exe mstsca.exe PID 1972 wrote to memory of 3028 1972 mstsca.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\6e466b24-75d7-4d7a-ba98-c5c439a95970" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe"C:\Users\Admin\AppData\Local\Temp\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build2.exe"C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build2.exe"C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build2.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4268 -s 19647⤵
- Program crash
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build3.exe"C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build3.exe"C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"3⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD5c59708a86e78530488f2356251e775a2
SHA117e33e077261cdd9e54d4e58dfb168f15ee93efb
SHA25671719971666e64a4f767e8f9d0b52e822189c4bfb1fe449a0e7c8066c82813c2
SHA51242afd4d2c791ea8cb239130cf4f4d43da0ec39c63049c56796e082282e2ba2f0cd0fd8934b7de3b359ca433b0609ad159fda6f92168168f2d4517f13fbbb3fbf
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5a8b3127396079b5c119da7e4923c7215
SHA1c0b67ff79ebc0879337d3a7572b6d2a46b69c061
SHA2569f88be14eed1ef938768494204cf211e8bc720505c1af00326325de8417157b3
SHA512107f3a9291d907607207fc99763a4b5bb2d1ebd6819371c37b727f8a837308b6871adf477cf94fdc8451d1bdfbdc3380d9d5681d80a2881e4527f2c10705c0be
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD5d0890039f303cdc95e11da7caff2112f
SHA1d077534531d3e3d6140c367735858e654a01f564
SHA256fa5eda21f08f6d8760a3650f4d57e6c19f4d917bc26187ffea62ea9d440730da
SHA5123ceb1f8a13883fe748e91d4446865ebfff04ed846fa4d94c42fcc81ebc55b7536018a06e5c4c3d220a6215ac72ae8374fdfd89c406d159d4b657727a638cdf29
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build2.exeFilesize
385KB
MD563e4a9cd7a8b37335b5f18cefc5dd9d2
SHA1c781a30935afc452b108cc78724b60f389b78874
SHA256c1e75efde3fd1da605135e5c3ffab0073299c80632d136f8eeba9d4a7c98c70f
SHA5123818b5966938704c5830acb5426db7791f6ae476853248d8984b1aff35a6722a0684bea54a53ef6ded1f301f6de9ed044d45f007457a9c0f3a7ea3afc7bf0ecc
-
C:\Users\Admin\AppData\Local\0cdec233-d992-4ff4-ad96-6ab510fd5f8e\build3.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
C:\Users\Admin\AppData\Local\6e466b24-75d7-4d7a-ba98-c5c439a95970\8c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf.exeFilesize
774KB
MD5a775dae66ce141797fe36ee3509c6177
SHA1b822ee79f6cdfe299c70bbb14cb96f9560edb4f6
SHA2568c007c45f95884050ef0d13ab45605edbf1cb1cd26ca415bf0127cd8e6ca6dcf
SHA512c94d0bfc21d4ac08b13b45aacb30a7411cf59d01139c6a5c78146cfcdafa7375b55f48be4192b331ae47a86e4a591cebe95f2a2878dc963e9160e62c9d42590f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
256KB
MD5164bc11a628ff1722c833c8e2642aca5
SHA156d2d17695a85b876b736933a7f1cd5cf2acfdb1
SHA256e76e2fa66070991fff3747fd12185ec795651b8506f290a3f1214b0eab40d330
SHA512099d1715e47a2c4ea346b432f186ffb6fcd94f9ec6b28ffcf5047a57b686a0135e765db75150ac14420cb9285fb02c8d390751b239a2a9446219da587a89ce9b
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeFilesize
128KB
MD553bc6c328281928e94ac312f63f13f05
SHA1d49275ca0cd7f367733a365323b466ad588e5ce0
SHA2567278f0c920ff8dad67e62751745e858817abb1c5b461414162311e57eb833e7c
SHA51248e55739728038066eeb2fca5c20e5c6c25587860b2ac7f021218e66fe7c77894c09e0301c4ceb78b72ebc19d85203d8bd66e8c15a1e1aed9eee58c6d465fb77
-
memory/196-206-0x0000000000A40000-0x0000000000B40000-memory.dmpFilesize
1024KB
-
memory/760-47-0x00000000020D0000-0x0000000002100000-memory.dmpFilesize
192KB
-
memory/760-46-0x0000000000580000-0x0000000000680000-memory.dmpFilesize
1024KB
-
memory/1092-150-0x0000000000A90000-0x0000000000B90000-memory.dmpFilesize
1024KB
-
memory/1560-1-0x0000000002110000-0x00000000021AA000-memory.dmpFilesize
616KB
-
memory/1560-2-0x00000000021C0000-0x00000000022DB000-memory.dmpFilesize
1.1MB
-
memory/2104-24-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-53-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-30-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-34-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-36-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-37-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-23-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-22-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-29-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2104-72-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2168-76-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2168-80-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2168-82-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/2168-83-0x0000000000410000-0x00000000004D5000-memory.dmpFilesize
788KB
-
memory/2472-123-0x00000000008A0000-0x00000000009A0000-memory.dmpFilesize
1024KB
-
memory/4264-177-0x00000000009B0000-0x0000000000AB0000-memory.dmpFilesize
1024KB
-
memory/4268-52-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/4268-51-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/4268-48-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/4268-86-0x0000000000400000-0x0000000000643000-memory.dmpFilesize
2.3MB
-
memory/4308-20-0x00000000007A0000-0x000000000083E000-memory.dmpFilesize
632KB
-
memory/4576-77-0x0000000000850000-0x0000000000854000-memory.dmpFilesize
16KB
-
memory/4576-75-0x00000000009F0000-0x0000000000AF0000-memory.dmpFilesize
1024KB
-
memory/4612-100-0x0000000000A40000-0x0000000000B40000-memory.dmpFilesize
1024KB
-
memory/4708-6-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4708-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4708-4-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4708-17-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4708-3-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB