Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-t3fgjshc39
Target 3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4
SHA256 3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4

Threat Level: Known bad

The file 3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 16:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 16:34

Reported

2024-05-22 16:37

Platform

win11-20240426-en

Max time kernel

147s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1230210488-3096403634-4129516247-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\79eaf2df-fa92-47ff-899c-aa87d71f5c99\\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4468 wrote to memory of 2060 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2060 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 2060 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 2060 wrote to memory of 4492 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 2060 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2060 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2060 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3352 wrote to memory of 3892 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\79eaf2df-fa92-47ff-899c-aa87d71f5c99" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
IR 217.219.131.81:80 sdfjhuz.com tcp
MX 201.119.122.3:80 cajgtus.com tcp
MX 201.119.122.3:80 cajgtus.com tcp
MX 201.119.122.3:80 cajgtus.com tcp
MX 201.119.122.3:80 cajgtus.com tcp
MX 201.119.122.3:80 cajgtus.com tcp

Files

memory/4468-1-0x0000000004AA0000-0x0000000004B37000-memory.dmp

memory/2060-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2060-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4468-4-0x0000000004B40000-0x0000000004C5B000-memory.dmp

memory/2060-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2060-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\79eaf2df-fa92-47ff-899c-aa87d71f5c99\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

MD5 c3cdc4206b45b5a62d65c9830bd4b069
SHA1 d529698f023e3a58c255286fc03fcde61478ea7a
SHA256 3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4
SHA512 528e0dcb5d7a8b71a9d03631adb39a75aad8e4c1799bc33b001f7111467adb164ed9f670948aa4b5f37627ffa1cd86d7430d612d86489de4410358a196f73dc3

memory/2060-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 d0c1c70a9e787abc31e0577791f569e0
SHA1 e50b0f424bad8626362fd5a401435a20175b1a18
SHA256 8a0f18719084c32f430aca4c0e4998d30e3e54f06603e463b9b2a2cde7049e95
SHA512 1cae9562eed2fd4398c43f688ecea741e7528704c8d8fc0441b8e58cb04e9554535aeadd57527686e73964e11297bd208ee4509c2384a2fa7530ccd5091b2801

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 a3aee276e5e93b74c5d8188a08ef4a4f
SHA1 ab48b0c83a99344d42f41c6695c69f1720e7ca14
SHA256 e26b19683c7d3ccc5176022615d7d21c368c87368e31ef2de5cf3d7cf744677f
SHA512 98c1d47d9069493aac471057b0cd03d58ff657b3bd3e5cd5f852d667cc42f7e5043c56643a0fdca84ffcf9465bd47e2cd452685f49cddae2029fb2d0ad8e29dc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/3892-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3892-37-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 16:34

Reported

2024-05-22 16:37

Platform

win10v2004-20240426-en

Max time kernel

149s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4cd38d46-e08f-416e-8fd8-450ccba4790d\\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 2700 wrote to memory of 4684 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4684 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 4684 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 4684 wrote to memory of 3056 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Windows\SysWOW64\icacls.exe
PID 4684 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4684 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 4684 wrote to memory of 3716 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe
PID 3716 wrote to memory of 536 N/A C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\4cd38d46-e08f-416e-8fd8-450ccba4790d" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

"C:\Users\Admin\AppData\Local\Temp\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 137.211.222.173.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 0.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
MX 187.134.55.166:80 cajgtus.com tcp
AR 190.224.203.37:80 sdfjhuz.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
MX 187.134.55.166:80 cajgtus.com tcp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 166.55.134.187.in-addr.arpa udp
US 8.8.8.8:53 160.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 37.203.224.190.in-addr.arpa udp
NL 23.62.61.160:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
MX 187.134.55.166:80 cajgtus.com tcp
MX 187.134.55.166:80 cajgtus.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
MX 187.134.55.166:80 cajgtus.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/2700-1-0x0000000004960000-0x00000000049FB000-memory.dmp

memory/4684-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4684-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4684-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4684-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2700-2-0x0000000004A00000-0x0000000004B1B000-memory.dmp

C:\Users\Admin\AppData\Local\4cd38d46-e08f-416e-8fd8-450ccba4790d\3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4.exe

MD5 c3cdc4206b45b5a62d65c9830bd4b069
SHA1 d529698f023e3a58c255286fc03fcde61478ea7a
SHA256 3f3d7acba3d06187949309fdfcbb66aa6223218af3393f619fb4754c54f7fad4
SHA512 528e0dcb5d7a8b71a9d03631adb39a75aad8e4c1799bc33b001f7111467adb164ed9f670948aa4b5f37627ffa1cd86d7430d612d86489de4410358a196f73dc3

memory/4684-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 1be5cc99f62d4382ccb3d51c31a56e8c
SHA1 1b7d83e4cfa28e5aeeb8fd1655a758e5d9c572a4
SHA256 622287a45aed5bf20f25cb3465b5d669c03185cf9156dac00ef31f7f3f0bbddb
SHA512 eaf1e1f81a18900ae46a8ac6015712ac8b219d8f830a2f831687999656c620ea5a956edf242317e68472caebe5981f04736733d5d5106c2429d57114b7f0a9ef

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 430754119d690cd8dcfddbecee676e53
SHA1 5c16069d65e6785207ff38f043f6f27295012673
SHA256 73ec1aff226676f024f6e468e8312e1e9044ad21f3311eb690c94cc6875494db
SHA512 fb268528951113b87dc59b8b0da32992cdbcc387ee6b395b1d1e1c2be9248ef997fa0158f7c70feef4461a6422ee816967968075f47a54384af6af0cedf8ec56

memory/536-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/536-37-0x0000000000400000-0x0000000000537000-memory.dmp