Malware Analysis Report

2024-10-23 16:23

Sample ID 240522-fpkx8acf76
Target 58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed
SHA256 58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed

Threat Level: Known bad

The file 58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 05:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 05:02

Reported

2024-05-22 05:05

Platform

win10v2004-20240426-en

Max time kernel

144s

Max time network

136s

Command Line

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f515acef-0f32-48fe-827f-3d7a808ed7ff\\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 740 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4972 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 4972 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 4972 wrote to memory of 2988 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 4972 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4972 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4972 wrote to memory of 4012 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4012 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

Processes

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f515acef-0f32-48fe-827f-3d7a808ed7ff" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 82.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
BR 191.186.138.218:80 sdfjhuz.com tcp
US 8.8.8.8:53 cajgtus.com udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
MX 189.195.132.134:80 cajgtus.com tcp
MX 189.195.132.134:80 cajgtus.com tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 218.138.186.191.in-addr.arpa udp
US 8.8.8.8:53 134.132.195.189.in-addr.arpa udp
MX 189.195.132.134:80 cajgtus.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 149.220.183.52.in-addr.arpa udp
MX 189.195.132.134:80 cajgtus.com tcp
MX 189.195.132.134:80 cajgtus.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp

Files

memory/4972-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/740-4-0x0000000004AB0000-0x0000000004BCB000-memory.dmp

memory/4972-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4972-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/740-2-0x0000000004910000-0x00000000049AC000-memory.dmp

memory/4972-1-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\f515acef-0f32-48fe-827f-3d7a808ed7ff\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

MD5 34d48ac48d4fa713d24a1f14f1e37896
SHA1 0aa53f9d59f9d3818d7f90de12196907b00ad560
SHA256 58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed
SHA512 34206132228d25c18cb2a79df65a0243619634d44cee58972de833aff9877a4bb9bff410be07a62a194efd5acd430f49dfaa79cacfb99c85bd4277a490795e68

memory/4972-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 84e7c60c73ebebd1ed53a60f745be97c
SHA1 440cdeab1d97c1cd6a346316d07348fd215fe548
SHA256 ac41bbc21b7825febc710a640cbd2b9819a801141c2ecafc4a9ce29476021569
SHA512 327aa65e0146911494223891711f93d976d0954cbbe11d05e0afcb282fc1a78eb95bd9c32da5dbace0f0d2217a7996be054b3fa88058742df39aa7448318f8b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb35bd9d6c5a4fd50a9263018bbd9784
SHA1 efec24f93d2af7bd01969c36870ebc928fa6c790
SHA256 be648ee93df285417e494e28c01e3ab8f3d043845f4d3b397dfd137d187ed612
SHA512 ac26182fb167458da4b465b118720470859e8028db8d3d71ddbe0c5be0e46b9178c5f7ccb8b1252c38754e27da1af546f8d2f6e32e1bfcbeac0d510aa831bf11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 481ecbcf222fb81213118ce569474f0b
SHA1 630b19506afb3b22ef1c58fd0647fde0d71efaf4
SHA256 a8aa937ef93d6d41aec15c289a6d9442db913ba93a2dd4a9bc97e519a9db6cd5
SHA512 015d0856c502ead184055ff15d59bd4036dd3f2838c894928d55831cb5fc06f63741623427f25c63d2ee36acafd276986eee18d1d66aa19d5f2ec6004367160c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/4464-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-37-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 05:02

Reported

2024-05-22 05:05

Platform

win11-20240419-en

Max time kernel

143s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\160296cc-0a68-41b0-8560-0da6b818db2e\\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 4172 wrote to memory of 3300 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 3300 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 3300 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 3300 wrote to memory of 2560 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Windows\SysWOW64\icacls.exe
PID 3300 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 3300 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 3300 wrote to memory of 1868 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe
PID 1868 wrote to memory of 1528 N/A C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

Processes

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\160296cc-0a68-41b0-8560-0da6b818db2e" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

"C:\Users\Admin\AppData\Local\Temp\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
CO 190.147.2.86:80 cajgtus.com tcp
PA 190.218.35.220:80 sdfjhuz.com tcp
CO 190.147.2.86:80 cajgtus.com tcp
CO 190.147.2.86:80 cajgtus.com tcp
CO 190.147.2.86:80 cajgtus.com tcp
CO 190.147.2.86:80 cajgtus.com tcp

Files

memory/3300-1-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3300-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4172-4-0x0000000004B40000-0x0000000004C5B000-memory.dmp

memory/3300-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3300-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4172-2-0x0000000004A40000-0x0000000004AD8000-memory.dmp

C:\Users\Admin\AppData\Local\160296cc-0a68-41b0-8560-0da6b818db2e\58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed.exe

MD5 34d48ac48d4fa713d24a1f14f1e37896
SHA1 0aa53f9d59f9d3818d7f90de12196907b00ad560
SHA256 58c2337e3d3d8bdaf94adc978ae8d0856e7393a61e820a0a47da4d81630aa1ed
SHA512 34206132228d25c18cb2a79df65a0243619634d44cee58972de833aff9877a4bb9bff410be07a62a194efd5acd430f49dfaa79cacfb99c85bd4277a490795e68

memory/3300-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 cb35bd9d6c5a4fd50a9263018bbd9784
SHA1 efec24f93d2af7bd01969c36870ebc928fa6c790
SHA256 be648ee93df285417e494e28c01e3ab8f3d043845f4d3b397dfd137d187ed612
SHA512 ac26182fb167458da4b465b118720470859e8028db8d3d71ddbe0c5be0e46b9178c5f7ccb8b1252c38754e27da1af546f8d2f6e32e1bfcbeac0d510aa831bf11

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4b0bbd07dd1226bfa4ae0a5787f4416a
SHA1 4ffdc118bb8b28de4661bd202977024de279d826
SHA256 cd6e2b1f0de35639be49d8926f7688e914f567a77c1d95bc7a0ba0a77ab68923
SHA512 1c442dad66e860bdf3d23e85364139a97215d65a206cbccd1985443821b79f901b6ec890594f9f8f78864bdcdc5308a5cc4ea3e79621686774054e2c89327487

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 019c30f8b68cb1de891153248fc69e97
SHA1 a1046c3f0280c67f4a44caaa5da6c1ccaf78318e
SHA256 127699ce06652147c283966836f31b2b2173c8a3bd0b97e00e7f8ce4a1861545
SHA512 888c0d0a3552e35be8eb38285a2f998c09dce95947a6648746631da9aa2167c75b8fb8b3a0a497429fd356469f034c4f3a6ca93a2787965d07818180db40b7af

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/1528-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1528-37-0x0000000000400000-0x0000000000537000-memory.dmp