Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-w2p1psca28
Target 41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
SHA256 41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925

Threat Level: Known bad

The file 41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 18:25

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 18:25

Reported

2024-05-22 18:27

Platform

win7-20240508-en

Max time kernel

143s

Max time network

122s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ff12ad45-d01d-4ed4-8db0-61cb70754f97\\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2020 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 1808 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 1808 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 1808 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 1808 wrote to memory of 2672 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 1808 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 1808 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 1808 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 1808 wrote to memory of 3048 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3048 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\ff12ad45-d01d-4ed4-8db0-61cb70754f97" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
US 8.8.8.8:53 sdfjhuz.com udp
CO 190.156.239.49:80 cajgtus.com tcp
KR 125.7.253.10:80 sdfjhuz.com tcp
CO 190.156.239.49:80 cajgtus.com tcp
CO 190.156.239.49:80 cajgtus.com tcp
CO 190.156.239.49:80 cajgtus.com tcp
CO 190.156.239.49:80 cajgtus.com tcp

Files

memory/2020-0-0x0000000000290000-0x0000000000322000-memory.dmp

memory/2020-1-0x0000000000290000-0x0000000000322000-memory.dmp

memory/2020-5-0x00000000023E0000-0x00000000024FB000-memory.dmp

memory/1808-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1808-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-8-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\ff12ad45-d01d-4ed4-8db0-61cb70754f97\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

MD5 05567327c48b4b2af47574295ee9748b
SHA1 7595f946efc74526f2b989413e73e3f37c4b4765
SHA256 41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925
SHA512 293c0df46670b450a5a840a424ef1848a2dd8634a5e837b1ace4196ba76ba040dcb12a8a0397a4c1583af3d1b63227653999b64247f6b593ef5c1cf2ec33fdea

memory/1808-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3048-29-0x0000000000220000-0x00000000002B2000-memory.dmp

memory/2776-32-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 fc473cf2643629a54c08d1e2174b949d
SHA1 1d4633bb5b80a23be2a03c660a230571f7bdc772
SHA256 4c65535ecd8fc5c14280ce2a0164f676a3e321ef0b5c239abda2abcf3e05255d
SHA512 4755f92ad1b839f876cb9afb0dd6539ddee701697e189f79ff7dbb09ecfe4ae7a80426e778b1eb898d3bd64deae7e186fd82d8c1ff3430c972c5d5f5cec2acbe

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a97661ea82df9457de6e42b0eae25bc4
SHA1 faff1318303c561752949cea0813db9479c39ac3
SHA256 4d18d46a639e0899812ce81b647c2ae6969aa68598015568ed6cf83a763602e9
SHA512 acaa6d907e578ec63043704f8cbdb2082f4b940eae128068edbd3b7d8051278fe8a505256261fc7697c8879a0715c16950f1d81c2fe61ce27ad1fa7e89f12e3a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 69fe966b7a876086497de3f2be45762a
SHA1 c58f805947816980095e8e24a6f3fe66fcae9048
SHA256 a1b7da3dc73254d5e13e1f782cadb4f77f77599a86f0aacd9fca1c98b5ed70c8
SHA512 0579e22d5b449bf140a4fdd6dc60068a578b495a74537e99ad4627a8bb13b1016d78edcde3a810e4bbb9abfc0df295355b2d1a8513f169243c4c9846e03ced9d

C:\Users\Admin\AppData\Local\Temp\Cab2D57.tmp

MD5 29f65ba8e88c063813cc50a4ea544e93
SHA1 05a7040d5c127e68c25d81cc51271ffb8bef3568
SHA256 1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184
SHA512 e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

memory/2776-46-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2776-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2776-47-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2020-50-0x00000000023E0000-0x00000000024FB000-memory.dmp

memory/2776-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2776-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2776-51-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2776-55-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 18:25

Reported

2024-05-22 18:27

Platform

win10v2004-20240508-en

Max time kernel

149s

Max time network

157s

Command Line

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a0f8d110-3a71-471d-84a6-59f3f952f32e\\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 2372 wrote to memory of 3428 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3428 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 3428 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 3428 wrote to memory of 1392 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Windows\SysWOW64\icacls.exe
PID 3428 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3428 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3428 wrote to memory of 3060 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe
PID 3060 wrote to memory of 2956 N/A C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

Processes

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\a0f8d110-3a71-471d-84a6-59f3f952f32e" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

"C:\Users\Admin\AppData\Local\Temp\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
CO 181.55.190.201:80 cajgtus.com tcp
MX 189.163.44.235:80 sdfjhuz.com tcp
CO 181.55.190.201:80 cajgtus.com tcp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 201.190.55.181.in-addr.arpa udp
US 8.8.8.8:53 235.44.163.189.in-addr.arpa udp
CO 181.55.190.201:80 cajgtus.com tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
CO 181.55.190.201:80 cajgtus.com tcp
CO 181.55.190.201:80 cajgtus.com tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 13.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 131.72.42.20.in-addr.arpa udp

Files

memory/2372-2-0x0000000004100000-0x000000000421B000-memory.dmp

memory/2372-1-0x00000000026C0000-0x0000000002759000-memory.dmp

memory/3428-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3428-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3428-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3428-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\a0f8d110-3a71-471d-84a6-59f3f952f32e\41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925.exe

MD5 05567327c48b4b2af47574295ee9748b
SHA1 7595f946efc74526f2b989413e73e3f37c4b4765
SHA256 41414ecd1275b4aaa6c0b82659b622a46426b599855cb402ace8358e42e18925
SHA512 293c0df46670b450a5a840a424ef1848a2dd8634a5e837b1ace4196ba76ba040dcb12a8a0397a4c1583af3d1b63227653999b64247f6b593ef5c1cf2ec33fdea

memory/3428-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-20-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 3373dbeea4ce7ec1624a25669b96c0d0
SHA1 a1cef0ea77fac36fdfb3fb6fdfede45370146534
SHA256 cf1c7062acc7a650a31bfb3653c8e7064cd27326594e00e94f1d31f4e3c15753
SHA512 caad38da82117157b25db851a0e011722013bf37403d46be992f91ca623820ecacbe327b38e62b2511db5425e8f37a6672b9421ef534d14aa99dc83babc35c3d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 cadba2e275b58dd22a66c2ff973b3bfd
SHA1 18bb988169b11e47968d54b3f1df17f4d6d713a3
SHA256 9884762bca242b6e7b45947b55c5a822081c50b33203ec99887de619ae0b8e82
SHA512 56d8a85f9f3260a8afb217f05c237bdc4fc9562162df552d5769d6b1f27630e9a021e1100161bd210c3532dbb3ea223870c59e5028d1f185d5cf3ca5f9cede87

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/2956-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2956-35-0x0000000000400000-0x0000000000537000-memory.dmp