Malware Analysis Report

2024-10-19 01:49

Sample ID 240522-ywq2xsef8t
Target 4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82
SHA256 4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82

Threat Level: Known bad

The file 4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-22 20:08

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-22 20:08

Reported

2024-05-22 20:11

Platform

win10v2004-20240226-en

Max time kernel

145s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9be106ad-a5d7-4952-900d-ac74f6c02cbf\\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2260 wrote to memory of 4152 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 4152 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 4152 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 4152 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 4152 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 4152 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 4152 wrote to memory of 2016 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2016 wrote to memory of 5404 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\9be106ad-a5d7-4952-900d-ac74f6c02cbf" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe" --Admin IsNotAutoStart IsNotTask

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1324 --field-trial-handle=2280,i,1836084024518340990,18250262151825427757,262144 --variations-seed-version /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 100.58.20.217.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 140.32.126.40.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
CO 181.52.122.51:80 cajgtus.com tcp
UY 179.27.75.59:80 sdfjhuz.com tcp
CO 181.52.122.51:80 cajgtus.com tcp
US 8.8.8.8:53 51.122.52.181.in-addr.arpa udp
US 8.8.8.8:53 59.75.27.179.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
CO 181.52.122.51:80 cajgtus.com tcp
CO 181.52.122.51:80 cajgtus.com tcp
GB 142.250.187.202:443 tcp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
CO 181.52.122.51:80 cajgtus.com tcp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 21.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 23.173.189.20.in-addr.arpa udp

Files

memory/2260-1-0x0000000004A70000-0x0000000004B0A000-memory.dmp

memory/2260-2-0x0000000004B10000-0x0000000004C2B000-memory.dmp

memory/4152-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4152-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4152-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4152-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\9be106ad-a5d7-4952-900d-ac74f6c02cbf\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

MD5 fda708b84341e23d935dbbd3328d324b
SHA1 9ba9f633af7afe8b69f81c50beb2dda944938304
SHA256 4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82
SHA512 345d7bfaa645b4bdc91b69cf4f1d5a1c3cbc64cd48e3db1e2a90c6a7074893e6951e13623094fe12b79cd1dcd8d2ba7dfd83c76d31f61fe4c642520b254c6a56

memory/4152-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 4adbbd5b0ba6f8029efe0e89374c4042
SHA1 01fa3ffdb795257863cf85367c2be220f3935e92
SHA256 782ba656165e436506b2b7bc9a48bec132b4707a6b16d8e1dd69628670caaa83
SHA512 6c8a0696fcef4ec64d99ce2a0cc752832e3101743e1a6ac8914e25ebac06b51dd3f08158963f17bb7eb68820e574ee9a6bb0ac456ef736ceaaf4a50f816a293d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 78f37a88570fee69422284cfe2b6647d
SHA1 35fd4afd34757fbfdc467e36e98aad4f55727316
SHA256 bf5e8cb8a9af124b81b08dcd34e2e3b141a272531b9e6d5ecc3ff023b25e9820
SHA512 3801e7eaf4bd6e76258d5fa2dcdd588a4494e796b719b5b07604e81f1bc5276180a3a02333bd91ef379c41d9034958d81134dd485cb56715824788e21e1d6135

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

memory/5404-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5404-39-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-22 20:08

Reported

2024-05-22 20:11

Platform

win11-20240426-en

Max time kernel

146s

Max time network

153s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2994005945-4089876968-1367784197-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f0d6b676-6b68-4c8a-9960-4d7a6e36e7ba\\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3144 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2744 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2744 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 2744 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe
PID 3036 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f0d6b676-6b68-4c8a-9960-4d7a6e36e7ba" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

"C:\Users\Admin\AppData\Local\Temp\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 172.67.139.220:443 api.2ip.ua tcp
SA 94.98.224.40:80 cajgtus.com tcp
BG 130.204.29.121:80 sdfjhuz.com tcp
SA 94.98.224.40:80 cajgtus.com tcp
SA 94.98.224.40:80 cajgtus.com tcp
SA 94.98.224.40:80 cajgtus.com tcp
SA 94.98.224.40:80 cajgtus.com tcp
US 8.8.8.8:53 131.83.221.88.in-addr.arpa udp
US 52.111.229.43:443 tcp

Files

memory/3144-1-0x0000000004A20000-0x0000000004AC2000-memory.dmp

memory/3144-2-0x0000000004AD0000-0x0000000004BEB000-memory.dmp

memory/2744-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-5-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\f0d6b676-6b68-4c8a-9960-4d7a6e36e7ba\4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82.exe

MD5 fda708b84341e23d935dbbd3328d324b
SHA1 9ba9f633af7afe8b69f81c50beb2dda944938304
SHA256 4def6b165636f77785a33c3b18117d74f5e930701dfe20f2bfb11ddb24924b82
SHA512 345d7bfaa645b4bdc91b69cf4f1d5a1c3cbc64cd48e3db1e2a90c6a7074893e6951e13623094fe12b79cd1dcd8d2ba7dfd83c76d31f61fe4c642520b254c6a56

memory/2744-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 6728aea2631b86a76c237508d8ba9b55
SHA1 7a670f95cac088313f7558869162fe01c6dc0ec9
SHA256 e1dd7380c6df33cd5702b032e0e359029d3ef7630f06ceb42cfdc154fd0baf7b
SHA512 533080cd1ec40b8530cad5c9914e0a5156d225f7392283ed2607eda4f1db4a6930002274060ed9130a6f634222c2e15818e16a50579cfe7f5274d028d31212f5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 437b9eba01c7013bf33af0a881a5aa73
SHA1 8d793e3247528b9c428082ee1a590056c2c21895
SHA256 0a27cd4217dfc53df82625b39ca2bdacb071cef39cffba4a1eecc1f7dd82b52b
SHA512 05913c0f164087cbf68210228cbce85e24918144aee960b723065231ebdfcd3415ce46ceacefaa8c9d6b278984be84a4369fae6f03da8040293d6f5f3a4fa336

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 1cef8b4012142aecbe8f055f8152d4d5
SHA1 3fcb8b08b418d66aa57ec33a1a56f3af714bc2d1
SHA256 4af6371ef0c5f77e8ca4a679efdded68a3116d2c69c42873a3b23dab93793566
SHA512 ef7dba8abf59d24d4fbbd496ebbf564312758f7b25614bda42561a92f254517d10c5808340d12e40aab71084661f1782200f4185f64016db011b5538d98e72ec

memory/2372-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2372-37-0x0000000000400000-0x0000000000537000-memory.dmp