Analysis
-
max time kernel
319s -
max time network
321s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
29-03-2024 01:49
Static task
static1
Behavioral task
behavioral1
Sample
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe
Resource
win10-20240221-en
General
-
Target
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe
-
Size
810KB
-
MD5
064d9695567ef3e6dae8948f0f1da0ec
-
SHA1
9efca461702e29435e51e3ef43733fdd892d38c1
-
SHA256
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254
-
SHA512
aefd8f0c3f81095d27be88e84ff00248cbf55167333a2cf8886d116086810a774aa2e8f55bba0235cec72b1acb330149e7d90337821156ada3f5a3ec0c338ec4
-
SSDEEP
12288:nupGpZVmbb25DNn2EArpaViAiE5BpLzMDwrqtHryYUK7/9l6LL6qF3:vZY8N4laAJeBVXqtHryYT/jqF
Malware Config
Extracted
djvu
http://sajdfue.com/test2/get.php
-
extension
.looy
-
offline_id
1eSPzWRaNslCgtjBZfL5pzvovoiaVI4IZSnvAwt1
-
payload_url
http://sdfjhuz.com/dl/build2.exe
http://sajdfue.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/3ed7a617738550b0a00c5aa231c0752020240316170955/d71ce1 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0858PsawqS
Extracted
vidar
8.6
5739ef2bbcd39fcd59c5746bfe4238c5
https://steamcommunity.com/profiles/76561199658817715
https://t.me/sa9ok
-
profile_id_v2
5739ef2bbcd39fcd59c5746bfe4238c5
-
user_agent
Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36
Signatures
-
Detect Vidar Stealer 6 IoCs
Processes:
resource yara_rule behavioral1/memory/2324-80-0x0000000000240000-0x0000000000271000-memory.dmp family_vidar_v7 behavioral1/memory/1804-82-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/1804-85-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/1804-86-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/1804-230-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 behavioral1/memory/1804-264-0x0000000000400000-0x0000000000644000-memory.dmp family_vidar_v7 -
Detected Djvu ransomware 16 IoCs
Processes:
resource yara_rule behavioral1/memory/2336-3-0x0000000002420000-0x000000000253B000-memory.dmp family_djvu behavioral1/memory/2068-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2068-7-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2068-8-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2068-26-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/2068-30-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-39-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-40-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-55-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-60-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-63-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-62-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-75-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-97-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1664-99-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 12 IoCs
Processes:
build2.exebuild2.exebuild3.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exemstsca.exepid process 2324 build2.exe 1804 build2.exe 1448 build3.exe 1440 build3.exe 1988 mstsca.exe 928 mstsca.exe 2892 mstsca.exe 1048 mstsca.exe 1216 mstsca.exe 2376 mstsca.exe 2504 mstsca.exe 2620 mstsca.exe -
Loads dropped DLL 8 IoCs
Processes:
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exeWerFault.exepid process 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 2760 WerFault.exe 2760 WerFault.exe 2760 WerFault.exe 2760 WerFault.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2461186416-2307104501-1787948496-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3c689cc1-9d87-4607-9282-9c7746e46a1a\\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe\" --AutoStart" 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 11 api.2ip.ua 3 api.2ip.ua 4 api.2ip.ua -
Suspicious use of SetThreadContext 8 IoCs
Processes:
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exebuild2.exebuild3.exemstsca.exemstsca.exemstsca.exemstsca.exedescription pid process target process PID 2336 set thread context of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 set thread context of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2324 set thread context of 1804 2324 build2.exe build2.exe PID 1448 set thread context of 1440 1448 build3.exe build3.exe PID 1988 set thread context of 928 1988 mstsca.exe mstsca.exe PID 2892 set thread context of 1048 2892 mstsca.exe mstsca.exe PID 1216 set thread context of 2376 1216 mstsca.exe mstsca.exe PID 2504 set thread context of 2620 2504 mstsca.exe mstsca.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2760 1804 WerFault.exe build2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2960 schtasks.exe 1900 schtasks.exe -
Processes:
build2.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a build2.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exepid process 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exebuild2.exebuild3.exebuild3.exetaskeng.exedescription pid process target process PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2336 wrote to memory of 2068 2336 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2068 wrote to memory of 1736 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe icacls.exe PID 2068 wrote to memory of 1736 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe icacls.exe PID 2068 wrote to memory of 1736 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe icacls.exe PID 2068 wrote to memory of 1736 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe icacls.exe PID 2068 wrote to memory of 1732 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2068 wrote to memory of 1732 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2068 wrote to memory of 1732 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 2068 wrote to memory of 1732 2068 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1732 wrote to memory of 1664 1732 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe PID 1664 wrote to memory of 2324 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build2.exe PID 1664 wrote to memory of 2324 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build2.exe PID 1664 wrote to memory of 2324 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build2.exe PID 1664 wrote to memory of 2324 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 2324 wrote to memory of 1804 2324 build2.exe build2.exe PID 1664 wrote to memory of 1448 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build3.exe PID 1664 wrote to memory of 1448 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build3.exe PID 1664 wrote to memory of 1448 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build3.exe PID 1664 wrote to memory of 1448 1664 6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1448 wrote to memory of 1440 1448 build3.exe build3.exe PID 1440 wrote to memory of 1900 1440 build3.exe schtasks.exe PID 1440 wrote to memory of 1900 1440 build3.exe schtasks.exe PID 1440 wrote to memory of 1900 1440 build3.exe schtasks.exe PID 1440 wrote to memory of 1900 1440 build3.exe schtasks.exe PID 2084 wrote to memory of 1988 2084 taskeng.exe mstsca.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\3c689cc1-9d87-4607-9282-9c7746e46a1a" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe"C:\Users\Admin\AppData\Local\Temp\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build2.exe"C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build2.exe"C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build2.exe"6⤵
- Executes dropped EXE
- Modifies system certificate store
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 14687⤵
- Loads dropped DLL
- Program crash
-
C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build3.exe"C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build3.exe"C:\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build3.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"7⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {2F87D194-E716-4FD6-8079-158045D76094} S-1-5-21-2461186416-2307104501-1787948496-1000:MGILJUBR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
1KB
MD52a789d6b366b95c47c2e68c27f863f81
SHA11b123bd94179f5b8746bc960691ddb9546855e05
SHA256ba4990d90cdd27ce932e39c10e178659436aeb5a290faa47f4825da9eca6bc94
SHA512027180aabc65ae3ca35f83161b11d289d87af854656483ac2cf703d94f695c4d5bce0fce1901278ab4cbfc985c9b9aa1f455c889913834c4b1734a365c7f8e3b
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
68KB
MD529f65ba8e88c063813cc50a4ea544e93
SHA105a7040d5c127e68c25d81cc51271ffb8bef3568
SHA2561ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
1KB
MD5a266bb7dcc38a562631361bbf61dd11b
SHA13b1efd3a66ea28b16697394703a72ca340a05bd5
SHA256df545bf919a2439c36983b54cdfc903dfa4f37d3996d8d84b4c31eec6f3c163e
SHA5120da8ef4f8f6ed3d16d2bc8eb816b9e6e1345dfe2d91160196c47e6149a1d6aedaafadcefd66acdea7f72dcf0832770192ceac15b0c559c4ccc2c0e5581d5aefc
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EAFilesize
410B
MD5be8a78f94728666cfa25bcc5205d7496
SHA1c4a42a3f925502bef1555ff3442fe4bbd32cf215
SHA256d944ca86c70291a0836ecbcca5b76d787bab59e9c2441f40f07e08321f752217
SHA512474b45e3cb11fa4e5bbfbc0c484afec57977b9c33c2138aa2af069cfea45ba27a1233cdb9a8fe6181c50873338a0c9cb8733dad3bec2c196f8d700da8f2ea6b8
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015Filesize
344B
MD592a1bfb5e91d8a9e8f34d2c0bd3796d4
SHA16e4893c315ec5129f5d89285800e6859bcf7b222
SHA2569abb16917ce1a105a3b0115ddb08480270e75155fa438230e617b6340c575db2
SHA512744a65221b8d59d303b3fa7c68192d00312fb55411755f9f2115f546ea7493af4525c53818886daedc3b8821e17d2d4828b0360b9f366cf069c2331f341c9c0d
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464Filesize
392B
MD54d98641e77b871f8947ae9d9fc5fad97
SHA179656d3925ddfd5d133eeeb20560b264d7222a92
SHA2563092373642aa84d2514f5debbe8ba524566429388c1b3649f1722d19ff225075
SHA512d53e3e64d382f2965746f6657d09ecba0e59c2a9e145de4a94e9680a3d685b9b1f49a5d689532690d9a0bb980919f2cecfc8db583ebde2c4444ff96e3a2ebf68
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F0ACCF77CDCBFF39F6191887F6D2D357Filesize
242B
MD565acbb3bc347b8224fb22ee703d8d510
SHA170bf154bb69007615eeb944b908059fdae008dab
SHA2565a6a7b11f4b73da743bcc252e12694428f14dcfa370f8a47c2d5dd898a23b85e
SHA5121c17f25c966edeb9a6f4fba2949525eadd709bc84534575e2e5dac59aa918dbbb38bdecd0259e7daa4d7480f62fb0818c5c18110bbb382e1a1a8ba8c292ac614
-
C:\Users\Admin\AppData\Local\3c689cc1-9d87-4607-9282-9c7746e46a1a\6045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254.exeFilesize
810KB
MD5064d9695567ef3e6dae8948f0f1da0ec
SHA19efca461702e29435e51e3ef43733fdd892d38c1
SHA2566045e387fc9e1b23471ba44a76d8f54cde172b2f28c467875eb6e5c567d6f254
SHA512aefd8f0c3f81095d27be88e84ff00248cbf55167333a2cf8886d116086810a774aa2e8f55bba0235cec72b1acb330149e7d90337821156ada3f5a3ec0c338ec4
-
C:\Users\Admin\AppData\Local\Temp\Cab955D.tmpFilesize
65KB
MD5ac05d27423a85adc1622c714f2cb6184
SHA1b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA5126d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d
-
C:\Users\Admin\AppData\Local\Temp\TarCDAC.tmpFilesize
171KB
MD59c0c641c06238516f27941aa1166d427
SHA164cd549fb8cf014fcd9312aa7a5b023847b6c977
SHA2564276af3669a141a59388bc56a87f6614d9a9bdddf560636c264219a7eb11256f
SHA512936ed0c0b0a7ff8e606b1cc4175a1f9b3699748ccbba1c3aff96203033d2e9edabf090e5148370df42fbfc4e31d7229493706ff24f19ff42ff7bef74a6baad06
-
C:\Users\Admin\AppData\Local\Temp\TarD12B.tmpFilesize
177KB
MD5435a9ac180383f9fa094131b173a2f7b
SHA176944ea657a9db94f9a4bef38f88c46ed4166983
SHA25667dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34
SHA5121a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a
-
\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build2.exeFilesize
277KB
MD58dae8b6a6be6e3527183594d1c26a2d3
SHA1b87e40cee60869a36e79c88c8a3a34baf0bc4889
SHA256afce72cd3bc717c784962083066e3ede2b0aaadbe0908ec7360096c923774fa5
SHA5120bf065700db647efba39a13a58242a595907e6c11885575cf0bdad9e23ab40583c8a6535464e46d75d075e20d88b7a6305a761df9da787fdc8728483dd48f96e
-
\Users\Admin\AppData\Local\0bc00503-276e-4eb8-8784-83b0177ad4f8\build3.exeFilesize
299KB
MD541b883a061c95e9b9cb17d4ca50de770
SHA11daf96ec21d53d9a4699cea9b4db08cda6fbb5ad
SHA256fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408
SHA512cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319
-
memory/1216-314-0x00000000002F0000-0x00000000003F0000-memory.dmpFilesize
1024KB
-
memory/1440-111-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1440-103-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1440-106-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1440-109-0x0000000000400000-0x0000000000406000-memory.dmpFilesize
24KB
-
memory/1448-102-0x0000000000250000-0x0000000000350000-memory.dmpFilesize
1024KB
-
memory/1448-104-0x00000000001B0000-0x00000000001B4000-memory.dmpFilesize
16KB
-
memory/1664-40-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-60-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-63-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-62-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-55-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-75-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-56-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-39-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-99-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1664-97-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1732-31-0x0000000002310000-0x00000000023A2000-memory.dmpFilesize
584KB
-
memory/1732-33-0x0000000002310000-0x00000000023A2000-memory.dmpFilesize
584KB
-
memory/1732-38-0x0000000002310000-0x00000000023A2000-memory.dmpFilesize
584KB
-
memory/1804-230-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/1804-86-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/1804-85-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/1804-82-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/1804-264-0x0000000000400000-0x0000000000644000-memory.dmpFilesize
2.3MB
-
memory/1804-78-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1988-232-0x0000000000910000-0x0000000000A10000-memory.dmpFilesize
1024KB
-
memory/2068-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2068-26-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-8-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-7-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2068-30-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/2324-80-0x0000000000240000-0x0000000000271000-memory.dmpFilesize
196KB
-
memory/2324-79-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/2336-3-0x0000000002420000-0x000000000253B000-memory.dmpFilesize
1.1MB
-
memory/2336-0-0x0000000000310000-0x00000000003A2000-memory.dmpFilesize
584KB
-
memory/2336-1-0x0000000000310000-0x00000000003A2000-memory.dmpFilesize
584KB
-
memory/2504-343-0x00000000008F0000-0x00000000009F0000-memory.dmpFilesize
1024KB
-
memory/2892-287-0x0000000000C50000-0x0000000000D50000-memory.dmpFilesize
1024KB