Malware Analysis Report

2024-10-23 16:23

Sample ID 240521-sqavvsab46
Target 09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319
SHA256 09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319

Threat Level: Known bad

The file 09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 15:19

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 15:19

Reported

2024-05-21 15:22

Platform

win10v2004-20240226-en

Max time kernel

151s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a23cfecf-08ad-4d44-af00-bffacd7b0153\\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 3544 wrote to memory of 4392 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 4392 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 4392 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 4392 wrote to memory of 3548 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 4392 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 4392 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 4392 wrote to memory of 5452 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5452 wrote to memory of 5364 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\a23cfecf-08ad-4d44-af00-bffacd7b0153" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe" --Admin IsNotAutoStart IsNotTask

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3984 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
GB 142.250.187.202:443 tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
US 8.8.8.8:53 sdfjhuz.com udp
BR 177.129.90.106:80 cajgtus.com tcp
CO 190.146.112.188:80 sdfjhuz.com tcp
US 8.8.8.8:53 17.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
BR 177.129.90.106:80 cajgtus.com tcp
US 8.8.8.8:53 106.90.129.177.in-addr.arpa udp
US 8.8.8.8:53 188.112.146.190.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
BR 177.129.90.106:80 cajgtus.com tcp
BR 177.129.90.106:80 cajgtus.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
BR 177.129.90.106:80 cajgtus.com tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp

Files

memory/3544-1-0x0000000004130000-0x00000000041D1000-memory.dmp

memory/3544-2-0x00000000041E0000-0x00000000042FB000-memory.dmp

memory/4392-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4392-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4392-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4392-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\a23cfecf-08ad-4d44-af00-bffacd7b0153\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

MD5 afc2780d65fe1e67d01ae629cd2f1e0f
SHA1 cabfc8608feca588c98e30476e79b9df85171c6f
SHA256 09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319
SHA512 390b4b8a11c099d512e2388c408492190311b2daaefc063c9279b6cc3f3a96ec3b71a1905556188439b42d29d2bde40662241a4ba08a456e5c72af3307f915b5

memory/4392-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-20-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4392-25-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 1cfbe0c60c34be3d40893c3a11d61674
SHA1 0669783ca1f50381103b014b185f1faf28d6f290
SHA256 6afdd946e9700d2396d57ab143b83aba05ba2326096eaedec06bb11e86c86774
SHA512 26003c8b3ef4cab30f689aea32b49bdd133b7ddf6195d47f1f6f3bb27071dda62e89e102569645865da1f1951d4bd1b05aa6019cb5c06a20224eb7708a3d5d55

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 df80f9ba75076db634761b6132e0d4e3
SHA1 07983946fb660752c7cccb2ef82d01ec4c9ecc5d
SHA256 d5ff96fd8b416de93a85783192206224cf8821c240cd8ff755f2e8270153dd99
SHA512 4ec734c5d29e9ce00b00e42b627253195e8c7a158433fedfcee428e692a6501981c33d7c8a39235f8b691f087145cdbe660b430493edbeedb12588c5cdd5a66a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 71337f56f251f6817e96cdd5a57f008f
SHA1 2cd2610a56d0157b245da3572b19230e88095416
SHA256 5a7f2ff5db3cf828a70623358742c7fac5761488cf9cfd7b451eb43be48bc9dc
SHA512 8c688416aff913c1f788d9eaf89abdeb317fd096ed4928ec0e69eace4a4e166d262e65a1df9667cce5495bb3b2bf2eeb5fa39e616e189f1957a7e66423b21df5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/5364-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5364-40-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 15:19

Reported

2024-05-21 15:21

Platform

win11-20240426-en

Max time kernel

143s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3938118698-2964058152-2337880935-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\169efb0b-ea79-4a42-9a64-ddc60b2b1e86\\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 5024 wrote to memory of 124 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 124 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 124 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 124 wrote to memory of 3916 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Windows\SysWOW64\icacls.exe
PID 124 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 124 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 124 wrote to memory of 2200 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe
PID 2200 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\169efb0b-ea79-4a42-9a64-ddc60b2b1e86" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

"C:\Users\Admin\AppData\Local\Temp\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
KR 211.171.233.129:80 cajgtus.com tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
KR 175.119.10.231:80 sdfjhuz.com tcp
KR 211.171.233.129:80 cajgtus.com tcp
KR 211.171.233.129:80 cajgtus.com tcp
KR 211.171.233.129:80 cajgtus.com tcp
KR 211.171.233.129:80 cajgtus.com tcp

Files

memory/124-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/124-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/124-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/124-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5024-2-0x0000000004290000-0x00000000043AB000-memory.dmp

memory/5024-1-0x0000000004140000-0x00000000041DD000-memory.dmp

C:\Users\Admin\AppData\Local\169efb0b-ea79-4a42-9a64-ddc60b2b1e86\09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319.exe

MD5 afc2780d65fe1e67d01ae629cd2f1e0f
SHA1 cabfc8608feca588c98e30476e79b9df85171c6f
SHA256 09c996d86da2ff031b3039f9d0c26411ab6e4ef60042c1927d21b83c50104319
SHA512 390b4b8a11c099d512e2388c408492190311b2daaefc063c9279b6cc3f3a96ec3b71a1905556188439b42d29d2bde40662241a4ba08a456e5c72af3307f915b5

memory/124-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 a3c4f59b445cc6ce8d6bd967738b2466
SHA1 c965d616dfc20ade69f654fdd64940ae0ec71585
SHA256 1366d188516345257e9717ade350dd7ee1bcfb647eb96e7abcc0b1aa0e97a2ce
SHA512 72ff1445b776189a0fa4c14a18cc2a38f5efa0db3b92ed9c3a432048b2281d8b8a6e88812711b85c995a26cb6a76b1bf68b8df1b3a6d30f33868216bfd13dfce

memory/4900-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-27-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 df80f9ba75076db634761b6132e0d4e3
SHA1 07983946fb660752c7cccb2ef82d01ec4c9ecc5d
SHA256 d5ff96fd8b416de93a85783192206224cf8821c240cd8ff755f2e8270153dd99
SHA512 4ec734c5d29e9ce00b00e42b627253195e8c7a158433fedfcee428e692a6501981c33d7c8a39235f8b691f087145cdbe660b430493edbeedb12588c5cdd5a66a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 76acad754bd7aa5340ced025611ead1a
SHA1 cd7d8adaa97daa47c3ef494bb0c00c247a39cf7d
SHA256 ef9f4cf873820999a935507be6da187aa42e0b2d8fc0467a7182805b768bc759
SHA512 2b0ff969b2108e2d043f88f43ea4a2d8d44eae069981b809d238e78f8dd436f6e5b449c0d40ad4f0e69c9429669406a5772e84c181447089a9f9584a90e294c9

memory/4900-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4900-37-0x0000000000400000-0x0000000000537000-memory.dmp