Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-2j96tayhpr
Target 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981
SHA256 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981

Threat Level: Known bad

The file 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 22:37

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 22:37

Reported

2024-07-25 22:43

Platform

win7-20240708-en

Max time kernel

291s

Max time network

174s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\73042143-848b-415c-bb70-f562489f0cf6\\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2500 wrote to memory of 1928 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 1928 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 1928 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 1928 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 1928 wrote to memory of 1812 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 1928 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 1928 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 1928 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 1928 wrote to memory of 2852 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2852 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\73042143-848b-415c-bb70-f562489f0cf6" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
PE 190.187.52.42:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp

Files

memory/2500-0-0x0000000000350000-0x00000000003E2000-memory.dmp

memory/1928-1-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2500-5-0x00000000039F0000-0x0000000003B0B000-memory.dmp

memory/2500-4-0x0000000000350000-0x00000000003E2000-memory.dmp

memory/1928-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1928-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1928-8-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\73042143-848b-415c-bb70-f562489f0cf6\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

MD5 b3757b09ed2150ce857f446c0c61363c
SHA1 04536100a4a8fc27dde91e006f4e2ea6b398b65e
SHA256 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981
SHA512 c7fb0efb95a96177bcbc50a60f2d900f4f7328a0a98a64ead6fc6e00f52502c904815e1e0a8b309a764c77db1fa65a8e5da5104593e0d987fb6bf3f794a82119

memory/1928-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2852-29-0x0000000000330000-0x00000000003C2000-memory.dmp

memory/1084-32-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 10df758a55138eeab799bac4acb85452
SHA1 e42c83cd3d8493aecd7fd5295cabbe12f4920b5e
SHA256 ca976f8895bc6e8d1e70969fae34fe2f824e9d4fd4a80302781179e9cd064756
SHA512 c3f23769fc9ad193ecbc14d26fdbd8e826e027779c4b7ad59cc5f8b59c0a089412f6a8b410ece5a810388050bcc7fbfa9ba8540154131cfad43f100ae5866968

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 e9945a4bac803c72c73aa5fe74cb1c12
SHA1 bcdb061713c4cf726958dbc978e031b3dbdf01be
SHA256 653a97a41144a31e98ef83484a415bd010284da0390c94fe934a0751312785f0
SHA512 02280452144b921aede9eb50b66a997304e956691b27608bd0fd2087a7bb612f83d52ffac2f2f42f7de3eff6386fed0285788c3de6008dc89b8e1eb2540025b1

C:\Users\Admin\AppData\Local\Temp\CabF6DD.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1084-47-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-48-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-46-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1084-56-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 22:37

Reported

2024-07-25 22:43

Platform

win10-20240404-en

Max time kernel

296s

Max time network

288s

Command Line

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f2ccf0de-7245-4a27-a99f-afceac4d4a28\\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 4240 wrote to memory of 3464 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 3464 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 3464 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 3464 wrote to memory of 4408 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Windows\SysWOW64\icacls.exe
PID 3464 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 3464 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 3464 wrote to memory of 2688 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe
PID 2688 wrote to memory of 3788 N/A C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

Processes

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f2ccf0de-7245-4a27-a99f-afceac4d4a28" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

"C:\Users\Admin\AppData\Local\Temp\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
CO 181.204.98.226:80 cajgtus.com tcp
US 8.8.8.8:53 226.98.204.181.in-addr.arpa udp
US 52.111.227.14:443 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 48.229.111.52.in-addr.arpa udp
US 8.8.8.8:53 123.10.44.20.in-addr.arpa udp

Files

memory/4240-1-0x0000000003D40000-0x0000000003DDD000-memory.dmp

memory/4240-4-0x0000000003E50000-0x0000000003F6B000-memory.dmp

memory/3464-2-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3464-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3464-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3464-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\f2ccf0de-7245-4a27-a99f-afceac4d4a28\4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981.exe

MD5 b3757b09ed2150ce857f446c0c61363c
SHA1 04536100a4a8fc27dde91e006f4e2ea6b398b65e
SHA256 4bb311ba0e479264b1d3c7deab5bfb44b0c1fb100d82aa7d605369b0ac938981
SHA512 c7fb0efb95a96177bcbc50a60f2d900f4f7328a0a98a64ead6fc6e00f52502c904815e1e0a8b309a764c77db1fa65a8e5da5104593e0d987fb6bf3f794a82119

memory/3464-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 501b5a515677853c92274a69169155dd
SHA1 645181b0ea1c1ca2c224906384e2a2a20dcee1f1
SHA256 b4a66874acc1ed1596d61780ec89de4c42029f2f9142faed51e929573aa2d9f7
SHA512 a535a176fb5986f17a625484482da7aa24087c241a47d94655fa4fbc725e754632590419f52f2a3c6ee34e63c2bd391e3201a0caaf362ff5ae332e60e45fda44

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 5456a83df563781e04f940facaa038e8
SHA1 fb275af32044a0bf61bdc381ae47e7d777c8b303
SHA256 d370cc7b51844c44d6192012fa6fc34f022100f25cf16ae0460db1ed7dc91545
SHA512 1415a659826083294b2fed0cabdec135b7a89308770af49503cd4643fc4d3eba14aacd84844827d1829cc7260376c06ae67d7b6b593e1c7e0f0da0fca444c547

memory/3788-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-40-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3788-41-0x0000000000400000-0x0000000000537000-memory.dmp