Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-tt8fzaha6t
Target 09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972
SHA256 09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972

Threat Level: Known bad

The file 09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 16:22

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 16:22

Reported

2024-05-22 16:24

Platform

win10v2004-20240426-en

Max time kernel

144s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3571316656-3665257725-2415531812-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\dc03cace-e85c-428a-bfcc-bd533513b21e\\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4836 wrote to memory of 2388 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 2388 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 2388 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 2388 wrote to memory of 2968 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 2388 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 2388 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 2388 wrote to memory of 1900 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1900 wrote to memory of 5084 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\dc03cace-e85c-428a-bfcc-bd533513b21e" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
PK 116.58.10.60:80 cajgtus.com tcp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
IR 2.185.214.11:80 cajgtus.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
CZ 95.100.146.33:443 www.bing.com tcp
PK 116.58.10.60:80 cajgtus.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 60.10.58.116.in-addr.arpa udp
US 8.8.8.8:53 33.146.100.95.in-addr.arpa udp
US 8.8.8.8:53 11.214.185.2.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
CZ 95.100.146.33:443 www.bing.com tcp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
PK 116.58.10.60:80 cajgtus.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
PK 116.58.10.60:80 cajgtus.com tcp
PK 116.58.10.60:80 cajgtus.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/4836-1-0x0000000004950000-0x00000000049F2000-memory.dmp

memory/2388-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2388-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2388-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2388-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4836-4-0x0000000004A00000-0x0000000004B1B000-memory.dmp

C:\Users\Admin\AppData\Local\dc03cace-e85c-428a-bfcc-bd533513b21e\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

MD5 40036b013c2180c9327edb88b03fd68b
SHA1 dd8e9ce493da9acd69f551b2767b25f5ae05fbd1
SHA256 09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972
SHA512 0a671b357a97612d201f035283dfa18185b64802a0ee604f9f229d1805db8fca51346f2a75ba7ff040fb059a1de74c1daa24e66ade3c204fff01f80b323bb816

memory/2388-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 79e8608eddcd502ae2a6a52c11d851c1
SHA1 eb627e01b2f8ce9e4e886582d00fd532356c0c12
SHA256 3629c50dac4b797e611d69329c97aaa323cb4820a50eab287935cd19247fce98
SHA512 db5f747bee8607718ce43e5298708c15bf969a33f203c8d627f488de84b8d9ce48ff58573b47a9694b0a55192b88287e4c28489aa879bc3b8fd9fa65ed9d71cc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 e61ca76489064679c99186aa629316d8
SHA1 57bcdb91b0a5b9a39c07accff6fe2b6bdaa07f7e
SHA256 d9f761603370045bbd5174ff51e2766485a84e9d1eb70c9e72eeb14d0a7b2e78
SHA512 005adde57decdcb1bf74c9c9a08e38edb5f787da027174fb124f6f8d8dd076385e09bcbdac173aafa581fcad6fc3433eac337e0e81d6f951b4fe223a90ac4776

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

memory/5084-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5084-37-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 16:22

Reported

2024-05-22 16:24

Platform

win11-20240508-en

Max time kernel

146s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3001105534-2705918504-2956618779-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1a34a770-2019-4f56-b61c-7aa59bd13ad0\\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 3844 wrote to memory of 4132 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4132 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 4132 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 4132 wrote to memory of 1516 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Windows\SysWOW64\icacls.exe
PID 4132 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4132 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 4132 wrote to memory of 1012 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe
PID 1012 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

Processes

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1a34a770-2019-4f56-b61c-7aa59bd13ad0" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

"C:\Users\Admin\AppData\Local\Temp\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 188.114.96.2:443 api.2ip.ua tcp
US 8.8.8.8:53 2.96.114.188.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 188.114.96.2:443 api.2ip.ua tcp
MY 175.137.36.144:80 cajgtus.com tcp
CZ 95.100.146.32:443 www.bing.com tcp
CL 190.13.174.94:80 sdfjhuz.com tcp
MY 175.137.36.144:80 cajgtus.com tcp
MY 175.137.36.144:80 cajgtus.com tcp
MY 175.137.36.144:80 cajgtus.com tcp
MY 175.137.36.144:80 cajgtus.com tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp

Files

memory/3844-1-0x0000000004A70000-0x0000000004B0E000-memory.dmp

memory/3844-2-0x0000000004B10000-0x0000000004C2B000-memory.dmp

memory/4132-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4132-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4132-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4132-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\1a34a770-2019-4f56-b61c-7aa59bd13ad0\09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972.exe

MD5 40036b013c2180c9327edb88b03fd68b
SHA1 dd8e9ce493da9acd69f551b2767b25f5ae05fbd1
SHA256 09484b9bdfb7a0f1486211178e0c36c45e5e0898466699ca1c1922b2f1f7f972
SHA512 0a671b357a97612d201f035283dfa18185b64802a0ee604f9f229d1805db8fca51346f2a75ba7ff040fb059a1de74c1daa24e66ade3c204fff01f80b323bb816

memory/4132-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 556059105cddec842b37cfd0e14229ec
SHA1 21855183774aa4cff3cb56e7d5947bb8d62a7760
SHA256 24d85f21dc6fc0e18cb5f50d322e8be0c18c1a03ceef34d8b0deca7bf5f79c8f
SHA512 6163acd97f9829a5640e63b84145e9337cb2f9e8148c6506ab4c1f6cf45fc2753d57b55ee2f5154e5be508d341935a063572cc76a3a7bc6fa49778016bb20613

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 833d70ebdf7ebe186f249193a792a907
SHA1 e06d1f67af5042ea0c1bda27890a830cf76387d8
SHA256 c60a2cbf943ad53e3602b2a18b3f6632da5282aabf19870d7d3ad3e37b3abd2b
SHA512 862c93668f9ddd567f68c741d8825bf3c916131b48c37bace4297cc6101433476de75c6507288798c6c63f8a7408a2a60da7dbf0d8d4e909c87f7f158ffaa7a5

memory/3424-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3424-37-0x0000000000400000-0x0000000000537000-memory.dmp