Malware Analysis Report

2025-04-13 10:27

Sample ID 240415-tpp4tsaf58
Target e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148
SHA256 e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148

Threat Level: Known bad

The file e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-15 16:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-15 16:14

Reported

2024-04-15 16:16

Platform

win11-20240412-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1734202354-1504186683-2192872036-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\72d955fc-7c30-4782-96cd-245dfafc7346\\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4524 wrote to memory of 3444 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3444 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 3444 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 3444 wrote to memory of 2868 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 3444 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3444 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3444 wrote to memory of 3876 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 3876 wrote to memory of 1360 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\72d955fc-7c30-4782-96cd-245dfafc7346" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 172.67.139.220:443 api.2ip.ua tcp
CO 181.55.190.201:80 sajdfue.com tcp
MY 175.138.146.92:80 sdfjhuz.com tcp
CO 181.55.190.201:80 sajdfue.com tcp
CO 181.55.190.201:80 sajdfue.com tcp
CO 181.55.190.201:80 sajdfue.com tcp
CO 181.55.190.201:80 sajdfue.com tcp

Files

memory/4524-1-0x0000000004BF0000-0x0000000004C8B000-memory.dmp

memory/4524-2-0x0000000004C90000-0x0000000004DAB000-memory.dmp

memory/3444-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3444-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3444-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3444-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\72d955fc-7c30-4782-96cd-245dfafc7346\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

MD5 c5c1ca56d106806d9b23a85fd3dd08dc
SHA1 c665b88616eb5c4283c25188ff078145b218f07d
SHA256 e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148
SHA512 a0517342af6f496eba51b823e0d96ab33a1d6079fa2f6c01bc754f29ca28ed5324b88c8e82175a3b97e8e6d5ff029f20640a419aa7ba49089e57af813a8113e9

memory/3444-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3876-20-0x0000000004AD0000-0x0000000004B67000-memory.dmp

memory/1360-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-23-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f741810cb830974aebab5f43eb80bc43
SHA1 1019ffd11ba07f662659b7f244d2743b4b1562c3
SHA256 20c4d592f763227cd6ed7fc812ae9d65edd6e046c30a70e7c694c579d9f1580a
SHA512 607ca542510b2a90fbade08569e449fdf35673dc4f045c4ca61982666fe2dd694d265835ebe2d90146dfcecedc7f229804c8e235d8eb9ca36f761064522539f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7371cd129f3b63bde1c1cd814e0b92fc
SHA1 e51674e55951bf5bcbeb3d937de4750e7c7d5f51
SHA256 a8ac7fa3cb85c5c3d42c9fb3c902eab5df256646f038f2245869def0518c8efc
SHA512 bbbdc9e89e54db3a36aeaeaa8a0f8075bb22ae8f49c7ab15d04f96622990b0d7deb62783ea5bbec9631ea9f11798ddde7dd48cea547ea59b9fe6ee0f84e11633

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 3a9b423c973618dc59ac56206f2c0661
SHA1 6acb97b51ecae83085335275a8de4d6a21b06007
SHA256 d23dc95d1fc8f6ab032ba288173da2c4e4c3d1a84d09167e89e9716dc2537fbf
SHA512 6af9082f35a6c1e91c892885defb89bd7540508a4b242f1cfa179913b856f0a37718167aaa9e0837e3b56a4ad07c7ddd463e9a0cf29e563ef5dcd1b6c4fcc182

memory/1360-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1360-39-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-15 16:14

Reported

2024-04-15 16:16

Platform

win10v2004-20240412-en

Max time kernel

147s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3198953144-1466794930-246379610-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3c72a42b-b2d7-4eed-9fc5-632b5574b6d3\\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4576 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4704 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 4704 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 4704 wrote to memory of 440 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Windows\SysWOW64\icacls.exe
PID 4704 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4704 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4704 wrote to memory of 4092 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe
PID 4092 wrote to memory of 3472 N/A C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

Processes

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\3c72a42b-b2d7-4eed-9fc5-632b5574b6d3" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

"C:\Users\Admin\AppData\Local\Temp\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 9.228.82.20.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 21.114.53.23.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 8.8.8.8:53 3.180.250.142.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 sajdfue.com udp
KW 62.150.232.50:80 sajdfue.com tcp
BG 93.152.141.65:80 sdfjhuz.com tcp
KW 62.150.232.50:80 sajdfue.com tcp
US 8.8.8.8:53 50.232.150.62.in-addr.arpa udp
US 8.8.8.8:53 65.141.152.93.in-addr.arpa udp
KW 62.150.232.50:80 sajdfue.com tcp
KW 62.150.232.50:80 sajdfue.com tcp
KW 62.150.232.50:80 sajdfue.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 168.117.168.52.in-addr.arpa udp

Files

memory/4576-1-0x00000000049A0000-0x0000000004A3E000-memory.dmp

memory/4576-2-0x0000000004A40000-0x0000000004B5B000-memory.dmp

memory/4704-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4704-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4704-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4704-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\3c72a42b-b2d7-4eed-9fc5-632b5574b6d3\e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148.exe

MD5 c5c1ca56d106806d9b23a85fd3dd08dc
SHA1 c665b88616eb5c4283c25188ff078145b218f07d
SHA256 e904ad323124cfdc673dbdaa260b75f2cd592bacc5f4b442d2c00d759538f148
SHA512 a0517342af6f496eba51b823e0d96ab33a1d6079fa2f6c01bc754f29ca28ed5324b88c8e82175a3b97e8e6d5ff029f20640a419aa7ba49089e57af813a8113e9

memory/4704-15-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4092-18-0x00000000049D0000-0x0000000004A64000-memory.dmp

memory/3472-20-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f741810cb830974aebab5f43eb80bc43
SHA1 1019ffd11ba07f662659b7f244d2743b4b1562c3
SHA256 20c4d592f763227cd6ed7fc812ae9d65edd6e046c30a70e7c694c579d9f1580a
SHA512 607ca542510b2a90fbade08569e449fdf35673dc4f045c4ca61982666fe2dd694d265835ebe2d90146dfcecedc7f229804c8e235d8eb9ca36f761064522539f4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7d239292529ac220a22978a9bb964d73
SHA1 9baab3021acea6aa3e100986d0970960a0329292
SHA256 b6e99c7eb6f2b36cb6cd8b777484ec45d27f90759c3376ec8ba87c743d7a99ad
SHA512 e98beaa915dd0aa094377aeb47f64090a82a76d869573fc972e5c2a324a12475af9d83f72d62e89ecfedc4c90e885a900afe190e8d2594323d3466fc23a895be

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 9e4e8915e111e1b47ab28007cc1e5fea
SHA1 e98a128d5d5c1fd8bc713a8f1c00687d4c80e17e
SHA256 55e785c63565c804838093baeb2fe57ac8256b1043889eaa7217e80cd0859a6e
SHA512 5bd5933cf209b8ff8249c892ffa40956dea33aa566318b8535eb4f0d7656212606972d97e7b4b82036d7b72589f33d02d3a309328f26eb39bae18aad0b2a7b3b

memory/3472-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3472-37-0x0000000000400000-0x0000000000537000-memory.dmp