Malware Analysis Report

2024-10-23 16:23

Sample ID 240522-h57s2aga74
Target 2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d
SHA256 2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d

Threat Level: Known bad

The file 2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 07:20

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 07:20

Reported

2024-05-22 07:22

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

155s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6e08f92e-b821-4748-9900-988d547f3bef\\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3608 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 428 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 428 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 428 wrote to memory of 4872 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 428 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 428 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 428 wrote to memory of 3656 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3656 wrote to memory of 5100 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\6e08f92e-b821-4748-9900-988d547f3bef" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
NL 23.62.61.194:443 www.bing.com tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 4.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 194.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
BR 189.61.54.32:80 cajgtus.com tcp
TR 88.225.215.104:80 sdfjhuz.com tcp
NL 23.62.61.194:443 www.bing.com tcp
BR 189.61.54.32:80 cajgtus.com tcp
US 8.8.8.8:53 104.215.225.88.in-addr.arpa udp
US 8.8.8.8:53 32.54.61.189.in-addr.arpa udp
BR 189.61.54.32:80 cajgtus.com tcp
BR 189.61.54.32:80 cajgtus.com tcp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
BR 189.61.54.32:80 cajgtus.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 9.179.89.13.in-addr.arpa udp

Files

memory/3608-1-0x0000000004920000-0x00000000049B6000-memory.dmp

memory/428-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3608-4-0x0000000004A70000-0x0000000004B8B000-memory.dmp

memory/428-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/428-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/428-5-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\6e08f92e-b821-4748-9900-988d547f3bef\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

MD5 e6ef999725d74157da2a50696d30db78
SHA1 1c87613f9d25fc1d2cb1c53c2149c032c8622436
SHA256 2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d
SHA512 0219f8c142821d06cea4b717d387a3c2b84c1da1f2161bd8bcbb16ef5b79e77b9bdb3fc9d527a639d601c6aedc9ff6e1aad664bfb9e9757081958811a5ee2e11

memory/428-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-20-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 b85d909c81a55fdbb3d34f5e16969506
SHA1 9694c875fbf43ebbd348affe5b9f45a4e63ed992
SHA256 aefc119def303a0d4ae92a29b69322f7799532cb2c11488ad42942ccaf3e626b
SHA512 4ac0456b02dc346636fca9047128732ae1451bfa2698da5a5dd54e9e1c3787de717cd76745d2ee133f91dc7ba7a885cf3eddf519d7e63ecd8c34f06dd9e336a7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 195fc28150bef9b30510eed36fb325af
SHA1 1ea8a314d8af1d431b77d5280d1782e9a8e867c6
SHA256 5c2e51ccf5767f80257a0a0bb66dee40957e5379431e15a118e7f1343ad1f6e0
SHA512 537da7e46d8b5afc796c1908042088c583c5380fb729f3665845fe36286b3efeaec9fa26475e9c2263f55b1eca04bd7ae26088a9a85950b2b7f750fd24eadcfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 f3d1100b42e53933ca3c4d959a0f0a37
SHA1 f8024f14a2eb264a12bbcf4ac564c063dfbbd5d7
SHA256 22aab6e8c7e526f79540f001b1253508ae6a045248b09c6ba4a112380617face
SHA512 1174c8969034790387a78c60ad2e88ff501d2f7734ea45a5c8fb3c6f23a77108b2474a7c41aba0dc418c02e57b0d412a9adda5de5cf687077015377d08139755

memory/5100-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5100-35-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 07:20

Reported

2024-05-22 07:22

Platform

win11-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3107365284-1576850094-161165143-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b6b277c1-fb4b-4ed4-8f0b-137351a49816\\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3056 wrote to memory of 5008 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 5008 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 5008 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 5008 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Windows\SysWOW64\icacls.exe
PID 5008 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 5008 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 5008 wrote to memory of 3932 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe
PID 3932 wrote to memory of 412 N/A C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\b6b277c1-fb4b-4ed4-8f0b-137351a49816" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

"C:\Users\Admin\AppData\Local\Temp\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
MX 187.199.150.21:80 cajgtus.com tcp
MX 187.199.150.21:80 cajgtus.com tcp
MX 187.199.150.21:80 cajgtus.com tcp
MX 187.199.150.21:80 cajgtus.com tcp
MX 187.199.150.21:80 cajgtus.com tcp
MX 187.199.150.21:80 cajgtus.com tcp

Files

memory/3056-1-0x0000000004A50000-0x0000000004AE6000-memory.dmp

memory/5008-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3056-4-0x0000000004AF0000-0x0000000004C0B000-memory.dmp

memory/5008-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5008-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5008-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\b6b277c1-fb4b-4ed4-8f0b-137351a49816\2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d.exe

MD5 e6ef999725d74157da2a50696d30db78
SHA1 1c87613f9d25fc1d2cb1c53c2149c032c8622436
SHA256 2c01d80246365b0edf490a8417303cb4263a2ddf10830a2a26a7455ce4ba1e8d
SHA512 0219f8c142821d06cea4b717d387a3c2b84c1da1f2161bd8bcbb16ef5b79e77b9bdb3fc9d527a639d601c6aedc9ff6e1aad664bfb9e9757081958811a5ee2e11

memory/5008-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 fa048d5434a6be56d4634500edbc5d97
SHA1 fcc1e949151529dd63905d4413ca541405894823
SHA256 ead252dc91d567e145974bac45078cf5124cf72642fa97b27d8d9f4bbf68bb36
SHA512 551afaf80a721a1d45b6c7e94bdd0c1ba08f4958cb8d6985998feb975cd5dc57d08577a0e451b71a40eea48447025781e72a0470f658e29a6e940595b1566472

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 195fc28150bef9b30510eed36fb325af
SHA1 1ea8a314d8af1d431b77d5280d1782e9a8e867c6
SHA256 5c2e51ccf5767f80257a0a0bb66dee40957e5379431e15a118e7f1343ad1f6e0
SHA512 537da7e46d8b5afc796c1908042088c583c5380fb729f3665845fe36286b3efeaec9fa26475e9c2263f55b1eca04bd7ae26088a9a85950b2b7f750fd24eadcfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 5e30e3a98c4e4f9e402fb647a18fffac
SHA1 dcfcfbc61ab903a524b2a127b9ba4ff54cf8b37a
SHA256 87dfeeb139de09ff4f4179e48d75a50cd2196c6172e69f64eb95bd5437b4cfcc
SHA512 6a5138a939d6f5f475dd2f8d0c1bc3ba58a63e2528b4281bfc1aa614f7060e34c273c77661b33fd1a58b1fd44d5510dc63ed392363612d9f2dbc8c483f07d35f

memory/412-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/412-37-0x0000000000400000-0x0000000000537000-memory.dmp