Malware Analysis Report

2024-10-19 01:49

Sample ID 240523-a1qd7afc48
Target 944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286
SHA256 944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286

Threat Level: Known bad

The file 944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-05-23 00:40

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-23 00:40

Reported

2024-05-23 00:43

Platform

win10v2004-20240508-en

Max time kernel

144s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1181767204-2009306918-3718769404-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1bd3e992-ab38-444b-af8b-fcea3a1de723\\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4008 wrote to memory of 3760 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 3760 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 3760 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 3760 wrote to memory of 4200 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 3760 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 3760 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 3760 wrote to memory of 984 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 984 wrote to memory of 2772 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

Processes

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1bd3e992-ab38-444b-af8b-fcea3a1de723" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe" --Admin IsNotAutoStart IsNotTask

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --field-trial-handle=1288,i,11746347647270949551,7786733067759450703,262144 --variations-seed-version --mojo-platform-channel-handle=3940 /prefetch:8

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 240.197.17.2.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 67.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 sdfjhuz.com udp
US 8.8.8.8:53 cajgtus.com udp
MX 189.181.49.206:80 cajgtus.com tcp
KR 211.202.224.10:80 sdfjhuz.com tcp
MX 189.181.49.206:80 cajgtus.com tcp
US 8.8.8.8:53 10.224.202.211.in-addr.arpa udp
US 8.8.8.8:53 206.49.181.189.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
MX 189.181.49.206:80 cajgtus.com tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
MX 189.181.49.206:80 cajgtus.com tcp
MX 189.181.49.206:80 cajgtus.com tcp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 26.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp

Files

memory/4008-1-0x0000000004910000-0x00000000049AE000-memory.dmp

memory/4008-2-0x00000000049B0000-0x0000000004ACB000-memory.dmp

memory/3760-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3760-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3760-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3760-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\1bd3e992-ab38-444b-af8b-fcea3a1de723\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

MD5 cca9237edd4e63088fea283e633dbd83
SHA1 5bcfc7b04f39607d284e830d4996eee55b27153f
SHA256 944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286
SHA512 0e7b51516dfe659815ea9ea16346e02b0399776e126b96b0d4843ff2c2cf18044c5c294b62e9ccfd8908987aa7ec7f50f07e0bd49cd31ede4b223d63352b239f

memory/3760-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-26-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7575c39a544943a68ce6e709c586005a
SHA1 4874b30bd1d455b28a95c4e21c5aecd1ea043d7a
SHA256 4737de49245ace1ca1fdeaacd5feee9bbda88bc6f42c84a1ea7d316383792cf8
SHA512 abf3d85393725113e720cbe8980b369236511e3984e8cbfa795f19bb5d6e39822e80a835caeb498581797a74b349765ba1a27f26586a17a66ae1c88bd066a3d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 b123af24d20e4450408bd6bf5acd1a1b
SHA1 68c62539c667ee2d8cc1b9f257aaae3e2887d27b
SHA256 6a16e8b8371b9573692b150e98639223ec8c5302a466141c5a6b2c45a5e0c8d1
SHA512 ed734a0ad525b98b51675875959b2938f70cf0def46e8a3b393c646dbe74c7b5e25d9511a22942d871886cd132af98b9b5bc8f84521ad484b1ea583664fca3d6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 269d47583e7e0d58e82d34c18810621d
SHA1 20d53f39858e34008cd5580f9effe411d7de3368
SHA256 832cf38edc7999edb0b0f38c940fbde3dea69cf8c37b0bd035e41bccfb402610
SHA512 e800b6906c5d60b9f7bd9b731e2a94cf80c07e24ea7d7954030237783fb797b3755117db24e3b889f4560d5447ac0accb2c58b87237be6a8f0fec9b71b42f22d

memory/2772-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-40-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-42-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2772-43-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-23 00:40

Reported

2024-05-23 00:43

Platform

win11-20240419-en

Max time kernel

143s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1474490143-3221292397-4168103503-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\29d93a45-dca2-49f7-a52c-194dc5f5b181\\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4796 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 2768 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 2768 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 2768 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Windows\SysWOW64\icacls.exe
PID 2768 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 2768 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 2768 wrote to memory of 4740 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe
PID 4740 wrote to memory of 564 N/A C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

Processes

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\29d93a45-dca2-49f7-a52c-194dc5f5b181" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

"C:\Users\Admin\AppData\Local\Temp\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
CR 201.191.99.134:80 cajgtus.com tcp
KR 211.202.224.10:80 sdfjhuz.com tcp
CR 201.191.99.134:80 cajgtus.com tcp
CR 201.191.99.134:80 cajgtus.com tcp
CR 201.191.99.134:80 cajgtus.com tcp
CR 201.191.99.134:80 cajgtus.com tcp

Files

memory/4796-1-0x0000000004A10000-0x0000000004AAC000-memory.dmp

memory/4796-2-0x0000000004AB0000-0x0000000004BCB000-memory.dmp

memory/2768-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2768-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2768-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2768-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\29d93a45-dca2-49f7-a52c-194dc5f5b181\944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286.exe

MD5 cca9237edd4e63088fea283e633dbd83
SHA1 5bcfc7b04f39607d284e830d4996eee55b27153f
SHA256 944caafd53b910f522348b9d82241855b1e1dd055da2d7db4930eef673d2c286
SHA512 0e7b51516dfe659815ea9ea16346e02b0399776e126b96b0d4843ff2c2cf18044c5c294b62e9ccfd8908987aa7ec7f50f07e0bd49cd31ede4b223d63352b239f

memory/2768-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 7575c39a544943a68ce6e709c586005a
SHA1 4874b30bd1d455b28a95c4e21c5aecd1ea043d7a
SHA256 4737de49245ace1ca1fdeaacd5feee9bbda88bc6f42c84a1ea7d316383792cf8
SHA512 abf3d85393725113e720cbe8980b369236511e3984e8cbfa795f19bb5d6e39822e80a835caeb498581797a74b349765ba1a27f26586a17a66ae1c88bd066a3d1

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

MD5 f2dfaade87c46824df94f1a640877ed0
SHA1 07fe5d7ad4097b87c210bb46c31ce9909567ef08
SHA256 21a6bf6bffc0eba476841beb1b65da99bf96eef7bf0d794ecaf515a9847c9049
SHA512 6afd017ea562f4391f2f9a018aa91dbd1fbbe24f3016d25ff5b1a1c7418dbee4b76f1b4f86584f4dfdb78a619916ce0b672dba1a819bf5fe6279921be1b8a018

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

MD5 bf76ac4a412972243d3010463dad33ac
SHA1 9fab9d7724cc4875e1754affe44562d8b35e3990
SHA256 7f9b97dfcb1b6647639f3f79ece1c67008766bc96a6719c2f8898319eeba3faf
SHA512 02c3e26d620c413a5a44f2313edb54f58797ea838fd80ad3334aa904f0ab54edce9a31032b376f44b019071247b2c78e84f007751be2b2fb177e9c1ffcc05767

memory/564-27-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/564-37-0x0000000000400000-0x0000000000537000-memory.dmp