Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-2t7tfatbjh
Target f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01
SHA256 f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01

Threat Level: Known bad

The file f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 22:53

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 22:53

Reported

2024-07-25 22:59

Platform

win7-20240704-en

Max time kernel

298s

Max time network

246s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b36f53cc-f14b-4a91-8a32-fa2cdeafa5e1\\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2552 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2712 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2844 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2712 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2712 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2712 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2712 wrote to memory of 2752 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2752 wrote to memory of 2928 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\b36f53cc-f14b-4a91-8a32-fa2cdeafa5e1" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
AR 190.224.203.37:80 cajgtus.com tcp
AR 190.224.203.37:80 cajgtus.com tcp
AR 190.224.203.37:80 cajgtus.com tcp
AR 190.224.203.37:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp

Files

memory/2552-0-0x0000000000230000-0x00000000002C1000-memory.dmp

memory/2712-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2552-5-0x0000000003D40000-0x0000000003E5B000-memory.dmp

memory/2712-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2552-1-0x0000000000230000-0x00000000002C1000-memory.dmp

memory/2712-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2552-9-0x0000000000230000-0x00000000002C1000-memory.dmp

C:\Users\Admin\AppData\Local\b36f53cc-f14b-4a91-8a32-fa2cdeafa5e1\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

MD5 4b53133b0e11c01f58a1ad4eb69fa0ce
SHA1 00a3b78374a127bcb3c944f4a65ff0fe5ba04d37
SHA256 f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01
SHA512 95d6245010d4784c2bc8e06965d097997f5c70af6f57e8a5c89845920641db493ca2a659ff3b93bcfac2d927434d4589b37de1364d919947a5c687f3f89fcab1

memory/2712-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2752-30-0x0000000000280000-0x0000000000311000-memory.dmp

memory/2928-33-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 139d8702db8d2fb180c4bedf1a17ab4c
SHA1 22cf299152feea8024d4eb6bde05b960b911bcb9
SHA256 c001f28c543a4dac7a1fc56edd19a5b8f117d88c5ce1b6059308f916f14baf9f
SHA512 b77f004f99fbf1976dc2b440c637070184d74fb2315a926a51fe5fbff4768397306c145a91fe5918fd51a03cb38471852dd398aeff40505f9e8868fb3aafaf9c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 76d650bc1058ee2e24c19f662b76f57b
SHA1 6ec42bd6162db2bfaf755c310bfebffac7c6b4bb
SHA256 9300b0b8017279e3866c144618331064be49046e7568fafe78ac02f3ff59724d
SHA512 d96fd121fe62e600fa7185fc27e117aecb811b8559d8781fe0fc148fc6ff39b09578f8a0e2c891552ded94fe434c5a8daea15d053479d6ace5febb3f5d09e17e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\Cab90CB.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2928-48-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-49-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-47-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-50-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2928-56-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 22:53

Reported

2024-07-25 22:58

Platform

win10-20240404-en

Max time kernel

296s

Max time network

299s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3699363923-1875576828-3287151903-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f70c24b5-0f68-475a-b6f8-c66e456ec08b\\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 588 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2056 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2056 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2056 wrote to memory of 3208 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Windows\SysWOW64\icacls.exe
PID 2056 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2056 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2056 wrote to memory of 2944 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe
PID 2944 wrote to memory of 644 N/A C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f70c24b5-0f68-475a-b6f8-c66e456ec08b" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

"C:\Users\Admin\AppData\Local\Temp\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
KW 78.89.199.216:80 cajgtus.com tcp
US 8.8.8.8:53 216.199.89.78.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 10.173.189.20.in-addr.arpa udp

Files

memory/588-1-0x0000000004130000-0x00000000041CB000-memory.dmp

memory/588-2-0x0000000004280000-0x000000000439B000-memory.dmp

memory/2056-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\f70c24b5-0f68-475a-b6f8-c66e456ec08b\f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01.exe

MD5 4b53133b0e11c01f58a1ad4eb69fa0ce
SHA1 00a3b78374a127bcb3c944f4a65ff0fe5ba04d37
SHA256 f874d2ec768aac73111ccc280352a8769b03d1789327b0b3e9674c55e0de1c01
SHA512 95d6245010d4784c2bc8e06965d097997f5c70af6f57e8a5c89845920641db493ca2a659ff3b93bcfac2d927434d4589b37de1364d919947a5c687f3f89fcab1

memory/2056-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 492e6b9ce669abcee99a2890ea861df9
SHA1 99348f5e97cb1158a1258e96d01964efad6b95ab
SHA256 16e24a5f75fce3d04ac961bfc1f62fcf490e24ca78f550ca54aa259ccdaae0fa
SHA512 d7babbf89f5f5648fc471848d68fce4e72e82e12ae8df3a10fe49e541c37d3fc4710ad41998f1bd146552823ad783431ebb5ed165def619461d94d75a337d7b6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 591c0b6b740633dd6b9470e887b9b1f6
SHA1 93780fbf1bd18c27433e4077d86beb581b710160
SHA256 8b001854c3648927bdfa66dd4529ff42f3788a1c3b5e03b62f65b610ab435e20
SHA512 9a65450939785fbba8ee06bdc91f8d759a447a61a1e7fe930c210483c813c2de2831a0cbc05916e552d89f5732c524a70e2abe49ea40acd44179bb76a835c165

memory/644-32-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-40-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/644-41-0x0000000000400000-0x0000000000537000-memory.dmp