Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-szqbxaxfml
Target 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
SHA256 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db
Tags
djvu aspackv2 discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db

Threat Level: Known bad

The file 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe was found to be: Known bad.

Malicious Activity Summary

djvu aspackv2 discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

ASPack v2.12-2.42

Modifies file permissions

Loads dropped DLL

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 15:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 15:34

Reported

2024-07-25 15:36

Platform

win7-20240705-en

Max time kernel

149s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4b034534-617a-4232-b13d-2653f0baddfc\\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSTORDB.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Eula.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SETLANG.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVE.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\INFOPATH.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Backgammon\bckgzm.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2256 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 2256 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 2256 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 2256 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2256 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2376 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 2376 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 2376 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 2376 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 2796 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 2796 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 2796 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 2796 wrote to memory of 1872 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 2796 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2796 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2796 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 2796 wrote to memory of 1116 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1116 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1116 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1116 wrote to memory of 1576 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1576 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1576 wrote to memory of 1760 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1116 wrote to memory of 1724 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\10547f9d.bat" "

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\4b034534-617a-4232-b13d-2653f0baddfc" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\57794527.bat" "

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 fuyt.org udp
US 8.8.8.8:53 zerit.top udp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp

Files

\Users\Admin\AppData\Local\Temp\GTpwsO.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/2376-12-0x0000000000030000-0x0000000000039000-memory.dmp

memory/2256-9-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/2256-8-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/2256-7-0x0000000000400000-0x000000000050B000-memory.dmp

memory/2256-15-0x0000000000580000-0x0000000000612000-memory.dmp

memory/2796-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2256-21-0x0000000000400000-0x000000000050B000-memory.dmp

memory/2256-16-0x0000000000580000-0x0000000000612000-memory.dmp

memory/2256-22-0x00000000021B0000-0x00000000022BB000-memory.dmp

memory/2796-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2256-20-0x0000000001E20000-0x0000000001F3B000-memory.dmp

memory/2796-25-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\10547f9d.bat

MD5 87d361295cd4ed3653ca37223c27da58
SHA1 e1104ef122a456e49eb7b063ff20e63facbeabf8
SHA256 b21b70c84d997356d74a43afe11e86048bfe3f199dbcf8c904bba4555692708c
SHA512 d2d5ef6a06c275eac4b5e39868391512de2c6c04d1237948c59ea13715437ff6a0d8366e8cb7f9ee6e7c31d97773c5dc4b0ffed7a9694b763899efdbf5d5a99e

memory/2376-41-0x0000000000030000-0x0000000000039000-memory.dmp

C:\Users\Admin\AppData\Local\4b034534-617a-4232-b13d-2653f0baddfc\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

MD5 4e8dcbde14041ca343eea4ab3f0966c6
SHA1 ed696645eca467d84ea2fd5c7d03517f3762da93
SHA256 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db
SHA512 fd31800fa8139f4cda7977b4bf4c298359e39d606f5db480063546765f9b4a1e3280abce985cb58fe8ae783479e0f006350e52e4bd6b8160a19ec2b3cb4f31bc

memory/2796-60-0x0000000003B10000-0x0000000003C1B000-memory.dmp

memory/2796-61-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1576-72-0x00000000001F0000-0x00000000001F9000-memory.dmp

memory/1116-71-0x0000000000220000-0x0000000000229000-memory.dmp

memory/1116-70-0x0000000000220000-0x0000000000229000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\57794527.bat

MD5 978c806902fa7f93eed6969d5afecfb8
SHA1 baa500adfac294af28a166b2e62b170e49421969
SHA256 67fe90a5160c588ce11d03efb53093c7da911e7e9358a1f5e775be3c500a817a
SHA512 894944bd10c4dfbca857e82d25260c52c93cce92fcdc5404a22b179dac3dd127c2908306b6bfd2e8599aa742e12bfee043d97f0679585b8011b26d16e5c5bd2f

memory/1576-82-0x00000000001F0000-0x00000000001F9000-memory.dmp

memory/1116-85-0x00000000002B0000-0x0000000000342000-memory.dmp

memory/1116-89-0x0000000000400000-0x000000000050B000-memory.dmp

memory/1724-88-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 da77c883c1da18c25110cf829b7df83f
SHA1 4228ed423f4d1aaadbfa5583166d01945dd698e9
SHA256 7af665acd1fb523ed1fdf2a950d9a08800055cdd8be8bac1ee8eb1a96cbabfca
SHA512 e6637419624723726b5783752e461d3016f91d78540137013376f5a987fe0a5e020c7d515a60c9a445520ba9b5b041b1a3cdd0fd196f8fd679c917b9e3f702b7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 ac76a5de9de580d9b5cc9493d6902985
SHA1 2a13fa62d8565b0ea8dcd418b0e5ad3bd489cef4
SHA256 8c316ccbaccae3e8507531bbab1f272fa10fdb5c11608dad53c10a7181964a0d
SHA512 ade94f3cd4e1a8bd01baf15c04bb5c88c5542592231b377fc6b19411eee22f98e28051465490305255bacd6f6670d1cc64f6873e9e995f0e50a191ecf1112404

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

C:\Users\Admin\AppData\Local\Temp\CabDBFD.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1724-101-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-102-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-103-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-111-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-114-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-117-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-116-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1724-118-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 15:34

Reported

2024-07-25 15:36

Platform

win10v2004-20240709-en

Max time kernel

147s

Max time network

132s

Command Line

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2636447293-1148739154-93880854-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0197d4f0-99cd-4f58-99b7-75b2de68df15\\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelperBgt.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\updater.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\EXCEL.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxTsr.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PDFREFLOW.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SDXHelper.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\IntegratedOffice.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.Brokered.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Microsoft.MicrosoftSolitaireCollection.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\Installer\setup.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MixedReality.Portal_2000.19081.1301.0_x64__8wekyb3d8bbwe\MixedRealityPortal.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOXMLED.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 384 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 384 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 384 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 4760 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 4760 wrote to memory of 3476 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 384 wrote to memory of 4640 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 4640 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 4640 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 4640 wrote to memory of 748 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Windows\SysWOW64\icacls.exe
PID 4640 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 4640 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 4640 wrote to memory of 1288 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1288 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1288 wrote to memory of 1020 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe
PID 1020 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1020 wrote to memory of 5040 N/A C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe C:\Windows\SysWOW64\cmd.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe
PID 1288 wrote to memory of 3088 N/A C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

Processes

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\126764c9.bat" "

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\0197d4f0-99cd-4f58-99b7-75b2de68df15" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\62760151.bat" "

C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

"C:\Users\Admin\AppData\Local\Temp\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 2.159.190.20.in-addr.arpa udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 10.171.59.23.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 19.229.111.52.in-addr.arpa udp

Files

memory/384-0-0x0000000000400000-0x000000000050B000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\GTpwsO.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/4760-5-0x0000000000650000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\297902C4.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\5G8JI3LV\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/4760-46-0x0000000000650000-0x0000000000659000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\126764c9.bat

MD5 5a38b27d8834711c4c2b36cc60ced2cd
SHA1 f5d930894ae2d5c00b08fc9e1be1d974ff276f23
SHA256 673a442373e8cb026b56707ad947dd6852c8db77d4c24bfa742bb9dfb1948960
SHA512 d730fb55c02aba55ea8774c0dbbe6060b08ac1ced7175747560c94bcdd65e6eb7e5764ab22cefe936e2f808cd54a5296a8fd47d5764ea920c45b511d3f470345

memory/384-49-0x0000000002340000-0x00000000023DA000-memory.dmp

memory/384-50-0x00000000023E0000-0x00000000024FB000-memory.dmp

memory/4640-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4640-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4640-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/384-54-0x0000000000400000-0x000000000050B000-memory.dmp

memory/4640-51-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\0197d4f0-99cd-4f58-99b7-75b2de68df15\0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db.exe

MD5 4e8dcbde14041ca343eea4ab3f0966c6
SHA1 ed696645eca467d84ea2fd5c7d03517f3762da93
SHA256 0fca5cc453a703c35c7c311dd7d7d0ffd64d5551f874399eef8aa25cd46fc6db
SHA512 fd31800fa8139f4cda7977b4bf4c298359e39d606f5db480063546765f9b4a1e3280abce985cb58fe8ae783479e0f006350e52e4bd6b8160a19ec2b3cb4f31bc

memory/1288-68-0x0000000000400000-0x000000000050B000-memory.dmp

memory/4640-67-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1020-71-0x0000000000400000-0x0000000000409000-memory.dmp

memory/1020-76-0x0000000000400000-0x0000000000409000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\62760151.bat

MD5 95879db5dd3d9ddeaa78c3fcb8d795ee
SHA1 24c71a2b5dbc58b75318f3122be4c3bc3c503ab4
SHA256 9078f1d1518d0c9bf6cc9b030f9fe4d016e6d2c417f9100baba89bca85d3a5f5
SHA512 80d35b5f7ac076abe57da81cf24dd75d5f9da889a38124b0a5b800b09ffa5f965f9697ca57195d90164f6ba0c84aee9824c2b8afe43bf47f6fced7b5d6da4eb9

memory/1288-82-0x0000000000400000-0x000000000050B000-memory.dmp

memory/3088-81-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 3fef17aa69250ae33a67dd10066a05da
SHA1 a162a4844d444067b9c2e781d075c54edca51079
SHA256 79c6f2fd6f87d498f84128a56d582b807677b075ff2124f03105aba0d83bb7f0
SHA512 5798c869c63b143d32de600ecb923a0959bea482734b2c302a7bebeef01c89ba14506f4f1637480754961cc7f8023a7e0e8b80c8c682681ecacb90d75a09acb0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 71dcdf29dc5cb8f63787ff71e2efcdc1
SHA1 e11b97feaa0ebb589af8718a30817959f5a94c0f
SHA256 c9c9705064101b71457d95a526664471af619ac64fe8746550475ec0f69cc36d
SHA512 b63de9c1981525117d6309f6e327caafa355e12bbe1084d6049854c10c42e38145a56c43c53420dee93e809173846aa8c70bdff0a001647797f720eb61cd094d

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

memory/3088-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-88-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-89-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-97-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-100-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-103-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-102-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-104-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3088-105-0x0000000000400000-0x0000000000537000-memory.dmp