Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-xncnwsch3y
Target 3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
SHA256 3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19

Threat Level: Known bad

The file 3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 18:59

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 18:59

Reported

2024-05-22 19:02

Platform

win7-20240221-en

Max time kernel

148s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b6a2d9ff-688c-4b01-8b31-8e5c8dabff9b\\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1936 wrote to memory of 2668 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2668 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 2668 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 2668 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 2668 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 2668 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2668 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2668 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2668 wrote to memory of 2664 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 2664 wrote to memory of 2436 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\b6a2d9ff-688c-4b01-8b31-8e5c8dabff9b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
US 8.8.8.8:53 sdfjhuz.com udp
JM 63.143.98.185:80 cajgtus.com tcp
MX 187.204.82.227:80 sdfjhuz.com tcp
JM 63.143.98.185:80 cajgtus.com tcp
JM 63.143.98.185:80 cajgtus.com tcp
JM 63.143.98.185:80 cajgtus.com tcp
JM 63.143.98.185:80 cajgtus.com tcp

Files

memory/1936-0-0x0000000002F80000-0x0000000003012000-memory.dmp

memory/1936-5-0x0000000002F80000-0x0000000003012000-memory.dmp

memory/1936-7-0x0000000003020000-0x000000000313B000-memory.dmp

memory/2668-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2668-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1936-1-0x0000000002F80000-0x0000000003012000-memory.dmp

memory/2668-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2668-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\b6a2d9ff-688c-4b01-8b31-8e5c8dabff9b\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

MD5 f47cff4805227d54842556b0bddaaf7e
SHA1 f734391825c9028127d49fd00dcfcc24aa801eaa
SHA256 3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19
SHA512 369af8e8e589126accc108c5e86484ce71d57646b2a7ee436cc2a1a0d71ca57422681590300215b4606306d5f9df6e1264c7ec8d87da8ccf12f8054a67f8964b

memory/2668-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2664-29-0x0000000000220000-0x00000000002B2000-memory.dmp

memory/2436-32-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b849f836a255d4267d28a7c94e3bfa5b
SHA1 fe722a0e03c09f0120b90f4454218098d39d2b9b
SHA256 da11366492df0442f2d5a0bd4e70cb95c914b61cb76aa6cee21f9b2b4e773a91
SHA512 6d1f4be85160c7fa8cb5457cc3b8565b0a50247189c71fafc55daf0ab0ee146721091d6895c8cb5e46332e94e622da72e9fdb05e01c67b2b4fd58de1f301a5ec

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 5915a2800fff1a1bcb3079a5bf33ec0a
SHA1 bd33173569875967675864cd077dabad73b8d5a0
SHA256 2c8de4f7f2f355b099baaa19ebe92e58821669cf6c6a0604936fa20b4462fe3a
SHA512 f1872b26ae0bc58d3d2cf7fc7165e43399912d5e9e74061a083c9c99c4ad39190b98ddc3f056af544f1167f8762fd9b3d66f9f13b25845eca94673a12610ad25

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 595580f3abd0271f733a4c8a787e7b67
SHA1 15b94fa1ddb8605ce4171336d8cdf4d4bfcfb019
SHA256 588d7fd9f3cd707ad7e9b116664730cbcff0ebeb0867fe5ee2d0bc1d55b0bed1
SHA512 c59e77bcb1270d0faad9535a37380c9771ac95a429fb2431166d331100efffba7954f4d290e509200b549751f0bd14bd3b2eb6dd218d5b67b4c3108f971ee270

C:\Users\Admin\AppData\Local\Temp\CabA979.tmp

MD5 ac05d27423a85adc1622c714f2cb6184
SHA1 b0fe2b1abddb97837ea0195be70ab2ff14d43198
SHA256 c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d
SHA512 6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

memory/2436-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-46-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-47-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-50-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2436-54-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 18:59

Reported

2024-05-22 19:02

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9f782054-e70f-4f23-b9d0-cd902dbf4481\\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1600 wrote to memory of 1612 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1612 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 1612 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 1612 wrote to memory of 324 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Windows\SysWOW64\icacls.exe
PID 1612 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1612 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 1612 wrote to memory of 4460 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe
PID 4460 wrote to memory of 4396 N/A C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\9f782054-e70f-4f23-b9d0-cd902dbf4481" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

"C:\Users\Admin\AppData\Local\Temp\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe" --Admin IsNotAutoStart IsNotTask

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4112 --field-trial-handle=3240,i,13319578961094268484,16557498665191861597,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 23.159.190.20.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
US 8.8.8.8:53 sdfjhuz.com udp
KR 211.168.53.110:80 cajgtus.com tcp
MX 187.156.100.217:80 sdfjhuz.com tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
KR 211.168.53.110:80 cajgtus.com tcp
US 8.8.8.8:53 110.53.168.211.in-addr.arpa udp
US 8.8.8.8:53 217.100.156.187.in-addr.arpa udp
KR 211.168.53.110:80 cajgtus.com tcp
GB 142.250.187.234:443 tcp
US 8.8.8.8:53 56.94.73.104.in-addr.arpa udp
KR 211.168.53.110:80 cajgtus.com tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 13.107.246.64:443 tcp
KR 211.168.53.110:80 cajgtus.com tcp
US 8.8.8.8:53 203.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 11.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 224.162.46.104.in-addr.arpa udp

Files

memory/1600-1-0x0000000004A80000-0x0000000004B16000-memory.dmp

memory/1600-2-0x0000000004B60000-0x0000000004C7B000-memory.dmp

memory/1612-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1612-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1612-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1612-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\9f782054-e70f-4f23-b9d0-cd902dbf4481\3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19.exe

MD5 f47cff4805227d54842556b0bddaaf7e
SHA1 f734391825c9028127d49fd00dcfcc24aa801eaa
SHA256 3a2093b715f42abed73e4fa37d3c58d1bb0cd6f4767ae096f43518e1b168cb19
SHA512 369af8e8e589126accc108c5e86484ce71d57646b2a7ee436cc2a1a0d71ca57422681590300215b4606306d5f9df6e1264c7ec8d87da8ccf12f8054a67f8964b

memory/1612-15-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1612-18-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-23-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 81d8847f143af110c8300ab4568ba0e8
SHA1 c5eda2a9ccea273811e317a6533f10d15d941f36
SHA256 3b4276ccdb7c79659e214d2adff90c9f56a04d898d2fc58e63eb069252a398bb
SHA512 6b190cb0726743c329824b81f73ad75874338c44097189fe7a59309b6b6987b132834737668c76a0a5b6dc08be96d1bd6ef66f94f48e18622788d9ec582d18cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 a326d394b26355e64d8649a7a0789bc0
SHA1 aa979c11d926cf203d0113911fec9ab1d77c0228
SHA256 020c9f25708bb48d9d437391ebd09600e93f0b8b0541e6d7a8ad5f588fce474f
SHA512 eea6b8fad0512cf60529939a6bfb3923e2c7d2d1b609962fcb9b8caacfb3ecb80847f1d76f9a382b6ad4cce98f566b079c3196387be5b06c3a7e2ed40d435e64

memory/4396-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4396-38-0x0000000000400000-0x0000000000537000-memory.dmp