djvu | c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578

Analysis

max time kernel
299s
max time network
197s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
21/02/2024, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
Size 777KB
Sample240221-fm95bscd37
SHA256 c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578
MD5 a4af885a87c407354aea09fe8f1f7903
SHA1 8531fbefc239c6416e4c43fbb8dd95a5db37a187
SHA512 72f3b81f082f26f43d8ad3bcd34638420e6dcb304c23c777ec44c7a1f016407a1004c57b6575390ace01d7f434894528fe75c0694a14d9718c7bc2ea51fcf069
SSDEEP 12288:pmLVGXBU3SdSq42UuyBvx3g6cPairZVxZjAJsvH1zHY:pwIX+3Sr4VfNxdYairZVXAUz4
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu vidar 7f6c51bbce50f99b5a632c204a5ec558 discovery persistence ransomware stealer

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.lkhy
offline_id
OxV6DGl22io8sqMOW1zCCOlzPiv4f1Vqzw7Y8zt1
payload_url
http://brusuax.com/dl/build2.exe

http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://we.tl/t-uNdL2KHHdy Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0851ASdw

rsa_pubkey.plain

Extracted

Family

vidar

Version

Botnet

7f6c51bbce50f99b5a632c204a5ec558

https://t.me/hypergog
https://steamcommunity.com/profiles/76561199642171824

Attributes

profile_id_v2
7f6c51bbce50f99b5a632c204a5ec558
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36

Signatures

Detect Vidar Stealer 5 IoCs

stealer

resource	yara_rule
behavioral1/memory/2996-74-0x0000000000400000-0x0000000000649000-memory.dmp	family_vidar_v7
behavioral1/memory/2948-78-0x0000000000230000-0x0000000000266000-memory.dmp	family_vidar_v7
behavioral1/memory/2996-79-0x0000000000400000-0x0000000000649000-memory.dmp	family_vidar_v7
behavioral1/memory/2996-80-0x0000000000400000-0x0000000000649000-memory.dmp	family_vidar_v7
behavioral1/memory/2996-227-0x0000000000400000-0x0000000000649000-memory.dmp	family_vidar_v7

Detected Djvu ransomware 14 IoCs

resource	yara_rule
behavioral1/memory/1840-2-0x00000000004E0000-0x00000000005FB000-memory.dmp	family_djvu
behavioral1/memory/2772-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2772-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2772-9-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2772-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-50-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-54-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-56-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-57-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-58-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2852-140-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
Downloads MZ/PE file

Executes dropped EXE 4 IoCs

pid	Process
2948	build2.exe
2996	build2.exe
848	build3.exe
1132	build3.exe

Loads dropped DLL 8 IoCs

pid	Process
2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
1040	WerFault.exe
1040	WerFault.exe
1040	WerFault.exe
1040	WerFault.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2860	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\25ea4ede-1530-42e6-8668-2d641edc7681\\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe\" --AutoStart"	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.2ip.ua
4	api.2ip.ua
9	api.2ip.ua

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1840 set thread context of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 2728 set thread context of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2948 set thread context of 2996	2948	build2.exe	34
PID 848 set thread context of 1132	848	build3.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1040	2996	WerFault.exe	34

Modifies system certificate store 2 TTPs 3 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a	build2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25	build2.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 1840 wrote to memory of 2772	1840	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	28
PID 2772 wrote to memory of 2860	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	29
PID 2772 wrote to memory of 2860	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	29
PID 2772 wrote to memory of 2860	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	29
PID 2772 wrote to memory of 2860	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	29
PID 2772 wrote to memory of 2728	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	30
PID 2772 wrote to memory of 2728	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	30
PID 2772 wrote to memory of 2728	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	30
PID 2772 wrote to memory of 2728	2772	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	30
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2728 wrote to memory of 2852	2728	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	31
PID 2852 wrote to memory of 2948	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	33
PID 2852 wrote to memory of 2948	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	33
PID 2852 wrote to memory of 2948	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	33
PID 2852 wrote to memory of 2948	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	33
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2948 wrote to memory of 2996	2948	build2.exe	34
PID 2852 wrote to memory of 848	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	35
PID 2852 wrote to memory of 848	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	35
PID 2852 wrote to memory of 848	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	35
PID 2852 wrote to memory of 848	2852	c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe	35
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 848 wrote to memory of 1132	848	build3.exe	37
PID 2996 wrote to memory of 1040	2996	build2.exe	39
PID 2996 wrote to memory of 1040	2996	build2.exe	39
PID 2996 wrote to memory of 1040	2996	build2.exe	39
PID 2996 wrote to memory of 1040	2996	build2.exe	39

C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
"C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840
- C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
  "C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\25ea4ede-1530-42e6-8668-2d641edc7681" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2860
- - C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
    "C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2728
  - - C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
      "C:\Users\Admin\AppData\Local\Temp\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Loads dropped DLL
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of WriteProcessMemory
      PID:2852
    - - C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build2.exe
        
        "C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build2.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:2948
      - C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build2.exe
        
        "C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build2.exe"
        6⤵
        Executes dropped EXE
        Modifies system certificate store
        Suspicious use of WriteProcessMemory
        
        PID:2996
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 1468
        7⤵
        Loads dropped DLL
        Program crash
        
        PID:1040
    - - C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build3.exe
        
        "C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build3.exe"
        5⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious use of WriteProcessMemory
        
        PID:848
      - C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build3.exe
        
        "C:\Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build3.exe"
        6⤵
        Executes dropped EXE
        
        PID:1132

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 be5e49321a83292427e10c5bf9df0b12e01fd2454fe341b3cd90b1966170f08b
MD5 959e538521e7b8ed167a11c81850ea23
SHA1 71e2fd9af7cc0b2da303778189c6e1ac7ed0acfd
SHA512 a59d9a9df4a0e9be6effd94a094a25219050ecd9585377d0e7ff0acfd28e9228637b538f6fb4a94f01a95fe00f7c380e8f0fc899e9877b7877574f7985ae5b0b
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 92e3908be262d3b07c63f26a3abd49e70e2151c76732928e9f1e65e89a0c6939
MD5 350a17a92d327f03a9015c60e2bfdf44
SHA1 53372c80fb1980bdc0b4360f7fdd7d8f91982edd
SHA512 dd08881779dee539d5fdf8632ed03ac8d4efe6cf76b97f4bde17cbf668ababa8d119a5c06972a8b625caa587f10904f296de81d2eb65ae4a010a4c3b78d5c62c
MD5 SHA1 SHA512

Submit Download

94308059B57B3142E455B38A6EB92015

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Size 344B
SHA256 34df3b662e6a038157e89ff1addc7c42bda6fd3c7845c021ab4413970c5ecade
MD5 b47ebeae92421b57bbecd889c53148fb
SHA1 492c810ea7338e9b5ab0a1cfe6402aacc76c7e92
SHA512 70bef7afc99a593bfe8c22c8a7b4d00b87f3e8047b43036f5a21973e2206c265ab8c3c00d3eb5deb96be0783511506671307d511ed9eeb8cc7a08609e6ae1442
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 2647b0907135c5c67d653ba7e359e21c445b9bde73254a031efc29251608322e
MD5 f15a4449fff76f7cae88e94214c8b5a4
SHA1 fcfcb8339dfdb0976dc6c956cc2f5a7126b81d1d
SHA512 efaf345ad5a63343c1b3cf2dc655c581694d0e62d5122d49b12b4c1c3f6380fcfa6e8d4cca7d17a7c680e7f9c9287c05d9b073f0bbc56e40a489f6dcab1899f0
MD5 SHA1 SHA512

Submit Download

c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe

Path C:\Users\Admin\AppData\Local\25ea4ede-1530-42e6-8668-2d641edc7681\c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578.exe
Size 777KB
SHA256 c3defce61cc00c18fe9418b471f0f5fd54c8ca0e6d5534e95db2492770420578
MD5 a4af885a87c407354aea09fe8f1f7903
SHA1 8531fbefc239c6416e4c43fbb8dd95a5db37a187
SHA512 72f3b81f082f26f43d8ad3bcd34638420e6dcb304c23c777ec44c7a1f016407a1004c57b6575390ace01d7f434894528fe75c0694a14d9718c7bc2ea51fcf069
SSDEEP 12288:pmLVGXBU3SdSq42UuyBvx3g6cPairZVxZjAJsvH1zHY:pwIX+3Sr4VfNxdYairZVXAUz4
MD5 SHA1 SHA512 SSDEEP

Submit Download

Cab63C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\Cab63C2.tmp
Size 65KB
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
SSDEEP 1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5 SHA1 SHA512 SSDEEP

Submit Download

Tar83E0.tmp

Path C:\Users\Admin\AppData\Local\Temp\Tar83E0.tmp
Size 171KB
SHA256 4276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
MD5 9c0c641c06238516f27941aa1166d427
SHA1 64cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA512 936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
SSDEEP 1536:+AuJ+lCUs0RvWqgCyPW5BXNWdm1wpyru2/3EwjYoz0VDTrubmt6mJp:+9J+q0RuXCyfdmAyru2/RAKtgp
MD5 SHA1 SHA512 SSDEEP

Submit Download

build2.exe

Path \Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build2.exe
Size 334KB
SHA256 7754125653413cfca3bde887fb2a22f0cd5144ec447bb274c69b005861b70a0a
MD5 c6d3d647baad8a5b93b81d2487f4f072
SHA1 e9c1105dc41f85d4f7e94d4e004f8427787c8802
SHA512 55425dc95161e627e19e17f1bb910f958dade0c2b12da5eaad31159f0e2dc5217ff293c52f39d860d399807d5b4a814f1bb24376c58b40cc171d298282052049
SSDEEP 6144:IDoxKCr2ngud29B94PYJmHhxUONHWCKj:YoAnfiu2qx9W
MD5 SHA1 SHA512 SSDEEP

Submit Download

build3.exe

Path \Users\Admin\AppData\Local\f65eeed5-d022-4388-aca6-c28eb6d2b0d6\build3.exe
Size 299KB
SHA256 fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
MD5 41b883a061c95e9b9cb17d4ca50de770
SHA1 1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA512 cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
SSDEEP 6144:2neDcgRQv5VaNT9DW7a6dtM9VstSttuvqIT:2O0v5VuT9DW7hdt9tKt2qI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/848-219-0x00000000001B0000-0x00000000001B4000-memory.dmp

Download

memory/848-215-0x0000000000270000-0x0000000000370000-memory.dmp

Download

memory/1132-220-0x0000000000400000-0x0000000000406000-memory.dmp

Download

memory/1840-0-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/1840-7-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/1840-1-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/1840-2-0x00000000004E0000-0x00000000005FB000-memory.dmp

Download

memory/2728-28-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/2728-30-0x0000000000220000-0x00000000002B1000-memory.dmp

Download

memory/2772-9-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2772-8-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2772-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2772-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2772-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-49-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-36-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-57-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-35-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-58-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-50-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-140-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-54-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2852-56-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2948-76-0x00000000005E2000-0x0000000000602000-memory.dmp

Download

memory/2948-78-0x0000000000230000-0x0000000000266000-memory.dmp

Download

memory/2948-231-0x0000000000230000-0x0000000000266000-memory.dmp

Download

memory/2996-80-0x0000000000400000-0x0000000000649000-memory.dmp

Download

memory/2996-72-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download

memory/2996-79-0x0000000000400000-0x0000000000649000-memory.dmp

Download

memory/2996-74-0x0000000000400000-0x0000000000649000-memory.dmp

Download

memory/2996-227-0x0000000000400000-0x0000000000649000-memory.dmp

Download