Malware Analysis Report

2024-10-23 16:23

Sample ID 240521-xx13vafe8v
Target a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5
SHA256 a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5

Threat Level: Known bad

The file a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Checks computer location settings

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-21 19:14

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-21 19:14

Reported

2024-05-21 19:17

Platform

win10v2004-20240426-en

Max time kernel

141s

Max time network

129s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\335fcf07-9df7-4d3d-b6ef-17f5c081e04e\\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 404 wrote to memory of 856 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 856 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 856 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 856 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 856 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 856 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 856 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 3300 wrote to memory of 4768 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\335fcf07-9df7-4d3d-b6ef-17f5c081e04e" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 144.107.17.2.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 172.67.139.220:443 api.2ip.ua tcp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
SI 93.103.167.123:80 cajgtus.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 123.167.103.93.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
MX 187.209.157.57:80 sdfjhuz.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 57.157.209.187.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
SI 93.103.167.123:80 cajgtus.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp

Files

memory/404-1-0x0000000002510000-0x00000000025AD000-memory.dmp

memory/404-2-0x0000000004150000-0x000000000426B000-memory.dmp

memory/856-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/856-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/856-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/856-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\335fcf07-9df7-4d3d-b6ef-17f5c081e04e\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

MD5 8858045135c3537e4cc0ea6c49532cc4
SHA1 03ea0b26b5766dfcf0cb376a408251755bb608f5
SHA256 a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5
SHA512 24edb6df506ed00d808f69e6494cdbaafa98c3387e698f2a0312b4feecf1a4008959c18e55f4b2ac62e488728cc0988d5b6b447c62b4e8b48b8faf4f1ea7a879

memory/856-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 991e196c1a868bec1d72cff5e169b98a
SHA1 d3c9d775393ba7aa6e8369dcce8348ae75efff90
SHA256 6dd434bcb6027f43d2b87519e7657fd4b62b356aaeb7c9db7ef25a0b3657bbc8
SHA512 c903f9393fffb9566f5f2038902ad7aab8046a6ad8cca38e46b609ce5eb9ed2975c746fa3456626770badd2624390bc337c532140bf29393028d95463f42fb69

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 bb94a67d131c34761ddfe7f90d464b05
SHA1 5535ea164296be3e24a24395a53939ee381c27af
SHA256 fddfc5e2266dbb086164d4805589b85adacede43f1ae9f447bb55ba369979781
SHA512 0fa6ab12ad6d94f946319ac01e115e2ca29c3a5da29841c583ba532733729d050dae25c5bac2edf64ed3e3cef023650912d73c9bd959030ae2c2547b17c4b7b4

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a1d955617a4d146e70544d0d9a0390ca
SHA1 5ffdc4453b23e24a7cb0e634b26864c169f5257b
SHA256 8dbff2c0018158256912d87dd495a68c351303a319f50f204a930317e867aeb3
SHA512 0bffbc27638b12cc04f335de8c4f3c74df01ae55b56f389f8d046d797b4c62d31bbff057ea75ce32f67cdd3b878fd0aad3eb62e983f814296e1b94de3c6ba810

memory/4768-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4768-37-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-21 19:14

Reported

2024-05-21 19:17

Platform

win11-20240426-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ec2f0452-d2cd-4ba1-bccd-1f917d64f456\\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 4820 wrote to memory of 832 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 832 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 1380 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Windows\SysWOW64\icacls.exe
PID 832 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 832 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 832 wrote to memory of 5112 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe
PID 5112 wrote to memory of 4136 N/A C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\ec2f0452-d2cd-4ba1-bccd-1f917d64f456" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

"C:\Users\Admin\AppData\Local\Temp\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
SI 93.103.167.123:80 cajgtus.com tcp
MX 189.143.204.149:80 sdfjhuz.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
SI 93.103.167.123:80 cajgtus.com tcp
SI 93.103.167.123:80 cajgtus.com tcp

Files

memory/4820-1-0x00000000026B0000-0x000000000274B000-memory.dmp

memory/4820-2-0x00000000041F0000-0x000000000430B000-memory.dmp

memory/832-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/832-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/832-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/832-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\ec2f0452-d2cd-4ba1-bccd-1f917d64f456\a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5.exe

MD5 8858045135c3537e4cc0ea6c49532cc4
SHA1 03ea0b26b5766dfcf0cb376a408251755bb608f5
SHA256 a5a27167e98c1ee093349bc0b341b8a9c73b0c43771b4b860c5ee72881a620a5
SHA512 24edb6df506ed00d808f69e6494cdbaafa98c3387e698f2a0312b4feecf1a4008959c18e55f4b2ac62e488728cc0988d5b6b447c62b4e8b48b8faf4f1ea7a879

memory/832-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a1d955617a4d146e70544d0d9a0390ca
SHA1 5ffdc4453b23e24a7cb0e634b26864c169f5257b
SHA256 8dbff2c0018158256912d87dd495a68c351303a319f50f204a930317e867aeb3
SHA512 0bffbc27638b12cc04f335de8c4f3c74df01ae55b56f389f8d046d797b4c62d31bbff057ea75ce32f67cdd3b878fd0aad3eb62e983f814296e1b94de3c6ba810

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 122123fc98ae8ff0cca16e51149c0578
SHA1 026c2b6bce228c25cb0be80ec973a3331579ab73
SHA256 53bbae2a580744aaa9f38180326644c690a8a419748b23fc310a03a6d0d0e09c
SHA512 06b2fa1271698bf7032ed7bd79e47d27e6d28a9dc5b9bd5b5671cd5c5f5824a5433cf3569bfcee5c0b665834df8a649484f64ceab0f42533efef68fcdc29ef60

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 bb39a70c259e83fe6a18f76077dda895
SHA1 2a485f4f32eae7aa4171a8b087e1ce5edd94d287
SHA256 7b563a58e88720ba14aac66312ab440d3c5bd68b3be89356fba308914f8e314a
SHA512 36b669b694604508e87ebf5b8a0b7fae7f29a89a348494ebde5a0dae1f74911b60123d0954eaaac3cda74671e5278f9a939a00691fe144e656defaa40ee5dbb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/4136-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4136-37-0x0000000000400000-0x0000000000537000-memory.dmp