Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-xzyeqsdd85
Target 844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08
SHA256 844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08

Threat Level: Known bad

The file 844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 19:18

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 19:18

Reported

2024-05-22 19:20

Platform

win10v2004-20240426-en

Max time kernel

142s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-540404634-651139247-2967210625-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2d6c7953-2aac-4621-b12c-c1439b7d44a4\\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3844 wrote to memory of 392 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 392 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 392 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 392 wrote to memory of 3972 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 392 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 392 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 392 wrote to memory of 5088 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 5088 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

Processes

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\2d6c7953-2aac-4621-b12c-c1439b7d44a4" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 183.142.211.20.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
AR 200.45.93.45:80 cajgtus.com tcp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
MX 189.195.132.134:80 sdfjhuz.com tcp
AR 200.45.93.45:80 cajgtus.com tcp
US 8.8.8.8:53 134.132.195.189.in-addr.arpa udp
US 8.8.8.8:53 45.93.45.200.in-addr.arpa udp
AR 200.45.93.45:80 cajgtus.com tcp
US 8.8.8.8:53 97.17.167.52.in-addr.arpa udp
AR 200.45.93.45:80 cajgtus.com tcp
AR 200.45.93.45:80 cajgtus.com tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 208.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
NL 23.62.61.72:443 www.bing.com tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 72.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/3844-1-0x00000000049A0000-0x0000000004A42000-memory.dmp

memory/3844-2-0x0000000004A50000-0x0000000004B6B000-memory.dmp

memory/392-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/392-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/392-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/392-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\2d6c7953-2aac-4621-b12c-c1439b7d44a4\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

MD5 f9139094053186c48b13bc99c9adf7b3
SHA1 bc35ca5986f7f6bd25fdf532bd6479de79f06335
SHA256 844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08
SHA512 8f33df09e10d594ab3c99c21f91b3d9846950362d137fce1236ad00f4fbdf25fcfaea25790447a18154300c809f4e767661deb9235b098bfd88860e285feef8c

memory/392-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 07a0362933d61640420f606e8a57ebf1
SHA1 c62122f7da8de4e20bd06cf0069841b1b02d6768
SHA256 f18619b45ae44974bb3977f4e4e0e898794faff3419f11b0c09b00e1e8b9c7f1
SHA512 dc63ad4bf570b5761c976843c3cabf11193671fd2a856bf197b335e5523c30c16741ae0f18c6696af11cd30af186445c1ef10629d16822053ff51d17f0901e80

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 b5e47a9c5ad308667083d98698e98423
SHA1 1ef2cd5ffa701d79d3d5d6206702fff5b11c7fa6
SHA256 c73b050b1adabc4c6c109640e3f61ad42725fb390e470d199fdb797111dbd65c
SHA512 b44aafba068c126cb41f35658ac449de225c64cf37662730fe96cd7ab83538828964dfa118f77b404cfece7c8d4f54939f57b7bf01ad9387c2ab29b009bd0a28

memory/2796-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-37-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 19:18

Reported

2024-05-22 19:20

Platform

win11-20240508-en

Max time kernel

146s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1672260578-815027929-964132517-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d59068e2-e584-456c-a971-da328e4088e9\\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3264 wrote to memory of 3520 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3520 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 3520 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 3520 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Windows\SysWOW64\icacls.exe
PID 3520 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3520 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 3520 wrote to memory of 1100 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe
PID 1100 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

Processes

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\d59068e2-e584-456c-a971-da328e4088e9" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

"C:\Users\Admin\AppData\Local\Temp\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 241.197.17.2.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
CO 190.146.112.188:80 cajgtus.com tcp
MX 187.212.249.248:80 sdfjhuz.com tcp
CO 190.146.112.188:80 cajgtus.com tcp
CO 190.146.112.188:80 cajgtus.com tcp
CO 190.146.112.188:80 cajgtus.com tcp
CO 190.146.112.188:80 cajgtus.com tcp
IE 52.111.236.22:443 tcp

Files

memory/3264-1-0x0000000004A10000-0x0000000004AA3000-memory.dmp

memory/3264-2-0x0000000004B00000-0x0000000004C1B000-memory.dmp

memory/3520-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3520-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3520-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3520-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\d59068e2-e584-456c-a971-da328e4088e9\844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08.exe

MD5 f9139094053186c48b13bc99c9adf7b3
SHA1 bc35ca5986f7f6bd25fdf532bd6479de79f06335
SHA256 844a51152049af67c9cc604b324da1e5f949fd1b18b6a06a93fea730750a3a08
SHA512 8f33df09e10d594ab3c99c21f91b3d9846950362d137fce1236ad00f4fbdf25fcfaea25790447a18154300c809f4e767661deb9235b098bfd88860e285feef8c

memory/3520-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 db3708e6920e8bce34b8d783b599ae4c
SHA1 34349d4b5ed7f608164bd187cf4d26ce21a7101a
SHA256 b3e090c7e06f4ed7c7d5a89ba5bb7694b160182a49cab7f3410dc63a5be3a5ff
SHA512 43651210ff4fa6b62eaf2868defc927c5765014976d937f1264d19207ceb0c5bbf7e39dcbf48720983da262e9b519ae1399442dc37c1e4fb45150ac808ccc15f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 a5d4f088e96547b3dab304f5e0304405
SHA1 b1ad96e1306891dfab6e6b894b637bc28b8e6b9f
SHA256 99248eebdb235875f09fd672cf8dda845555b8a53db4705527f9c5549e1f68c4
SHA512 4ec954b05a92ed6fc140011964d8e843f5ec825ecb1da428f06f4e7318492a8d1d6658151ba91dbd08b83310cb89b4e121ea24ca5e2b88555650d5a9fd0c4fd5

memory/1156-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1156-37-0x0000000000400000-0x0000000000537000-memory.dmp