Malware Analysis Report

2024-10-23 16:23

Sample ID 240522-lgh2jsaf53
Target 35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22
SHA256 35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22

Threat Level: Known bad

The file 35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 09:30

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 09:30

Reported

2024-05-22 09:32

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\92e9acd4-2088-4a0b-9833-1799f598345a\\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4532 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 2604 wrote to memory of 2484 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 2604 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 2604 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 2604 wrote to memory of 876 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 876 wrote to memory of 728 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

Processes

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\92e9acd4-2088-4a0b-9833-1799f598345a" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 14.160.190.20.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
KR 123.140.161.243:80 cajgtus.com tcp
AZ 213.172.74.157:80 sdfjhuz.com tcp
KR 123.140.161.243:80 cajgtus.com tcp
US 8.8.8.8:53 243.161.140.123.in-addr.arpa udp
US 8.8.8.8:53 157.74.172.213.in-addr.arpa udp
KR 123.140.161.243:80 cajgtus.com tcp
KR 123.140.161.243:80 cajgtus.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
KR 123.140.161.243:80 cajgtus.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 udp

Files

memory/4532-1-0x0000000004930000-0x00000000049CC000-memory.dmp

memory/4532-2-0x0000000004AC0000-0x0000000004BDB000-memory.dmp

memory/2604-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2604-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2604-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2604-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\92e9acd4-2088-4a0b-9833-1799f598345a\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

MD5 8d35c959439087a5afeb4102f8d9a537
SHA1 9db82f937ff4e3ef9881c0d72557418cee6fb9b3
SHA256 35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22
SHA512 a7c49eca997c58bde5dc7e2edb53a310894f7fc17d4ff7e1c6ab9edf8927738d7143158eb71f7da60d5e268da3cb1f5066b90d514285f784b42f4417ff8dfefe

memory/2604-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-20-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 195fc28150bef9b30510eed36fb325af
SHA1 1ea8a314d8af1d431b77d5280d1782e9a8e867c6
SHA256 5c2e51ccf5767f80257a0a0bb66dee40957e5379431e15a118e7f1343ad1f6e0
SHA512 537da7e46d8b5afc796c1908042088c583c5380fb729f3665845fe36286b3efeaec9fa26475e9c2263f55b1eca04bd7ae26088a9a85950b2b7f750fd24eadcfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 ebae875c70c43966e9fc32aba2f29cbc
SHA1 b117fa04ef1700f0a484f48d46c8bb4589ef0e59
SHA256 c57cb73159dbcebfb7901c1525c2eb2ce0cff5a12925b5c0f52d7911c200adb3
SHA512 61678196f3fc5755d16cb00b044e4ddd8a66b10dee895b0e021c9f7e4f31243f683abc4f14edbe92922c0b1f5e2c72279069eed03f73a7e05f860e44da26e925

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 d3a63e66f5d9607a347a08deb3e1890b
SHA1 df2ed50de14bbb9f3e5ca1548cbd6bbb2daac99c
SHA256 b0e9296973270823be8a54e41454ea1e1df07f36b84672d6d9e1af86b7ba629a
SHA512 3cf4edf3fbb4f8c1af28af3390bff504d949818ebe16395f79ed1152907301db4b84fe42c8a4dea5bb6d088775b0a964b98ebe2aad586fa042bf3b57d7d13e1a

memory/728-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/728-35-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 09:30

Reported

2024-05-22 09:32

Platform

win11-20240419-en

Max time kernel

143s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4eed920d-ea67-4d70-8acf-3f3541d59579\\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4688 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4568 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 4568 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 4568 wrote to memory of 2792 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Windows\SysWOW64\icacls.exe
PID 4568 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4568 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 4568 wrote to memory of 772 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe
PID 772 wrote to memory of 1696 N/A C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

Processes

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\4eed920d-ea67-4d70-8acf-3f3541d59579" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

"C:\Users\Admin\AppData\Local\Temp\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
KR 123.140.161.243:80 cajgtus.com tcp
BR 191.186.138.218:80 sdfjhuz.com tcp
KR 123.140.161.243:80 cajgtus.com tcp
KR 123.140.161.243:80 cajgtus.com tcp
KR 123.140.161.243:80 cajgtus.com tcp
KR 123.140.161.243:80 cajgtus.com tcp

Files

memory/4688-1-0x0000000004AC0000-0x0000000004B55000-memory.dmp

memory/4688-3-0x0000000004C60000-0x0000000004D7B000-memory.dmp

memory/4568-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4568-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4568-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4568-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\4eed920d-ea67-4d70-8acf-3f3541d59579\35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22.exe

MD5 8d35c959439087a5afeb4102f8d9a537
SHA1 9db82f937ff4e3ef9881c0d72557418cee6fb9b3
SHA256 35139f78bc8d51dbb8951e76928b9e9ace87ded22239f1f27b24a82651ec4a22
SHA512 a7c49eca997c58bde5dc7e2edb53a310894f7fc17d4ff7e1c6ab9edf8927738d7143158eb71f7da60d5e268da3cb1f5066b90d514285f784b42f4417ff8dfefe

memory/4568-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 195fc28150bef9b30510eed36fb325af
SHA1 1ea8a314d8af1d431b77d5280d1782e9a8e867c6
SHA256 5c2e51ccf5767f80257a0a0bb66dee40957e5379431e15a118e7f1343ad1f6e0
SHA512 537da7e46d8b5afc796c1908042088c583c5380fb729f3665845fe36286b3efeaec9fa26475e9c2263f55b1eca04bd7ae26088a9a85950b2b7f750fd24eadcfc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 af0fa387b9d38e203b3eefebf97b9d58
SHA1 96b9b2ab775d75cdf6cd8a516fea1712a51e0478
SHA256 ba874824f09b6549ef9dcf2eade3e56c7a1c0f785e4cdcdbc9d480859201c329
SHA512 64c041440057f9b367dfbd885339d9d1f0909c6c49d93aaf2597c6af6635e05ac4ca5513fbcd23c244d05adb3f532da7f04e5c677fbd00105f95fcbae69953bb

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 156f206cb8a9d6d5bc25597f8cd77d49
SHA1 809565b0ad960893fa69582de66699affa1ff910
SHA256 729434fb1d861404e258918db3db1bf7976bb84c558552dadc804004cf7aaf3e
SHA512 b2662dfd4cf546b3ce78553643efe675268d5045ed0bca7d01f0b3c37456d7c608f614420d860059e71350f99fe5ba2332843cfcc66e8c75843d23d2621647fd

memory/1696-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1696-37-0x0000000000400000-0x0000000000537000-memory.dmp