Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-vn9bratamm
Target 202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
SHA256 202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3
Tags
djvu aspackv2 discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3

Threat Level: Known bad

The file 202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe was found to be: Known bad.

Malicious Activity Summary

djvu aspackv2 discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Loads dropped DLL

Modifies file permissions

ASPack v2.12-2.42

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 17:09

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 17:09

Reported

2024-07-25 17:12

Platform

win7-20240704-en

Max time kernel

143s

Max time network

145s

Command Line

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\aba2e54c-f996-4eeb-be9f-5ecc76e9c16f\\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLICONS.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{8EA3FE23-8E0B-4836-8777-C2D6ED0590DC}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CNFNOT32.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCICONS.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32Info.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateSetup.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\native2ascii.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\DisabledGoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\plugin-container.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateComRegisterShell64.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSQRY32.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ONENOTE.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1684 wrote to memory of 2372 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 2372 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2372 wrote to memory of 2736 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1684 wrote to memory of 2748 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2748 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2748 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2748 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2748 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2748 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2748 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2748 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2748 wrote to memory of 432 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 432 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 432 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 432 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 2764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2764 wrote to memory of 2292 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 432 wrote to memory of 1716 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7ccb1d0b.bat" "

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\aba2e54c-f996-4eeb-be9f-5ecc76e9c16f" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\7dc94874.bat" "

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 173.222.211.50:80 crl.microsoft.com tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp

Files

memory/1684-1-0x0000000000400000-0x0000000000505000-memory.dmp

\Users\Admin\AppData\Local\Temp\lgYdZ.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/1684-4-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

memory/2372-12-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

memory/1684-9-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\35A55781.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\Z7V06J7Q\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\7ccb1d0b.bat

MD5 2b452b6a8af26ded87d61fe28e524929
SHA1 5f4376af5323e909ceb02c5ec8fa31c7c3962e20
SHA256 21af7bd8327954c853d4f15c8fa84ffca8ad7c383d96d99eec4d2f5ed1c05dba
SHA512 a758cb84dfa27fa9a7ee40925fcb99590770219c64d0ee6b4999eabec58187b796278b89826d513a3b03433860368aa9969378789944f693b6b4d3d592af4069

memory/2372-54-0x0000000000CF0000-0x0000000000CF9000-memory.dmp

memory/1684-56-0x0000000000220000-0x00000000002B1000-memory.dmp

memory/1684-57-0x0000000000220000-0x00000000002B1000-memory.dmp

memory/2748-58-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1684-66-0x0000000000220000-0x00000000002B1000-memory.dmp

memory/2748-67-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1684-65-0x0000000000400000-0x0000000000505000-memory.dmp

memory/2748-64-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1684-63-0x0000000002110000-0x0000000002215000-memory.dmp

memory/1684-62-0x0000000000510000-0x000000000062B000-memory.dmp

memory/2748-60-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\aba2e54c-f996-4eeb-be9f-5ecc76e9c16f\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

MD5 801a00a6c89dcb9b7839a53eccfc8fc1
SHA1 eb9ee227ca410890e51d954de4b63e1cca69f0ad
SHA256 202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3
SHA512 c2a329b139bd110e2550dcd63ba496f9b55196b259a33241067812a00ca6860eaf6023ed90fa02b9ec76212b660dcab135cddfef6dd49ea05421d897764df4c8

memory/2748-85-0x0000000003960000-0x0000000003A65000-memory.dmp

memory/2748-86-0x0000000003970000-0x0000000003A75000-memory.dmp

memory/2748-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2764-100-0x0000000000DF0000-0x0000000000DF9000-memory.dmp

memory/432-99-0x0000000000DF0000-0x0000000000DF9000-memory.dmp

memory/432-98-0x0000000000DF0000-0x0000000000DF9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7dc94874.bat

MD5 71a0f3421a15c1844b4f91fc8149b547
SHA1 891717fb89987990823a318f3efa3adaaea9c570
SHA256 74343f0c9f38384c82f4e78fae5d346a076849cb25b8ccaceb857ff9b8403461
SHA512 b4cb54b4f9b31801a43b110547cb40a4477bbb46ac2c9491a94e9e8cf5d483043b93ee7b3c51cef4f4fc45614a2d62145cd2d0b97800fe485bcaf8ee3a9aebb3

memory/432-111-0x0000000000580000-0x0000000000611000-memory.dmp

memory/432-115-0x0000000000400000-0x0000000000505000-memory.dmp

memory/1716-114-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 3f009a50039e14a7ad6a5c2c3162a07a
SHA1 ece37efbf932213fe7adee727f7d1650337033db
SHA256 8d6dfdb760b2b7ab561f997c206df96555acd8481477c961220536df982f0e0b
SHA512 eec2e96a9db07cdc83a3123ae1735f4f83b12b7bb99674e9b73ea36babf1b631f2246e43f6a20999e785ce99f18550000a518aadcb9b8158240d4bf32a9fb41a

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 d4004313ba8af28ec1366cccafc3279f
SHA1 4a705a30966b8ca6389599882f9f5eefdfe749d6
SHA256 51c558b5248c4b92b9fd474f8541edcb5f8619de1445733ccd4576ffc7e28367
SHA512 1a7be546a5d71c26bac79512d7ff1a965d09c9b385247e8fe066bbb0c3a52f23f431eb4bb85b9d1ddea2a85d9730e880ba53828eb96ad53f93bf4b44d87471df

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\Local\Temp\CabCFEC.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 3f84086f6ed66c4aad842069a1b657d9
SHA1 7826b5ca6afbbbddbe95e0a528b825cf01baa664
SHA256 62738dce196d9c59eefac8d3d35c56b2688ed33592949bfcbd44035f20b83089
SHA512 c7d55488a6219e3ae86d7ef1dad9009df03bd992b6e38f22ed2b9b24c0d84a927a2a031fa8cd62a1f53ff12e7909fc856ecfcc7e0c8bc810229d9e9969910cec

memory/1716-128-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-129-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-130-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-134-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-145-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-143-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-146-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1716-147-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 17:09

Reported

2024-07-25 17:12

Platform

win10v2004-20240709-en

Max time kernel

148s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b0ae16ae-111f-40ee-84ec-5465db254df8\\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files (x86)\Windows Mail\wabmig.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\pingsender.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\HxCalendarAppImm.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoia.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\GameBar.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSREC.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jsadebugd.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\elevation_service.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\YourPhone.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstack.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WORDICON.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdateBroker.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOSYNC.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msotd.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1500 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1500 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1500 wrote to memory of 4700 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 1500 wrote to memory of 2104 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 4700 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 4700 wrote to memory of 1312 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2104 wrote to memory of 4356 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Windows\SysWOW64\icacls.exe
PID 2104 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2104 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2104 wrote to memory of 2532 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 2532 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 2532 wrote to memory of 4248 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe
PID 4248 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 4248 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 4248 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe C:\Windows\SysWOW64\cmd.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe
PID 2532 wrote to memory of 3036 N/A C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

Processes

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe"

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\50d92b60.bat" "

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\b0ae16ae-111f-40ee-84ec-5465db254df8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\6dff589c.bat" "

C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

"C:\Users\Admin\AppData\Local\Temp\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 c.pki.goog udp
US 13.107.21.237:443 g.bing.com tcp
GB 172.217.169.3:80 c.pki.goog tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 138.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 26.35.223.20.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 19.58.20.217.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/1500-0-0x0000000000400000-0x0000000000505000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\lgYdZ.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/4700-4-0x0000000000690000-0x0000000000699000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\7C0536BA.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\3WWFCFW4\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/1500-36-0x00000000021A0000-0x000000000223A000-memory.dmp

memory/1500-37-0x0000000002240000-0x000000000235B000-memory.dmp

memory/2104-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2104-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1500-41-0x0000000000400000-0x0000000000505000-memory.dmp

memory/2104-42-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2104-40-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\50d92b60.bat

MD5 f0c21f2f29d7c603a99df1fdc509caab
SHA1 7ae268fb4a9df21b59c1478c5ebb307e3e72cdf9
SHA256 2e0d608e6d2625e365a78b6af54d2b057e23558e0b3a5aa7edb5fb61e9059727
SHA512 b360d981d4423253615c45578c7b368872f8d84dcaf51548ae509442c4907edebe041deb51a0660ffc03eed71a03517797e627e5a66789a7057283b62dfbb132

memory/4700-55-0x0000000000690000-0x0000000000699000-memory.dmp

C:\Users\Admin\AppData\Local\b0ae16ae-111f-40ee-84ec-5465db254df8\202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3.exe

MD5 801a00a6c89dcb9b7839a53eccfc8fc1
SHA1 eb9ee227ca410890e51d954de4b63e1cca69f0ad
SHA256 202259937df72d3e7e341ce852a48938616e0d98a091d976f5342bf82e132ce3
SHA512 c2a329b139bd110e2550dcd63ba496f9b55196b259a33241067812a00ca6860eaf6023ed90fa02b9ec76212b660dcab135cddfef6dd49ea05421d897764df4c8

memory/2104-68-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4248-73-0x0000000000570000-0x0000000000579000-memory.dmp

memory/2532-70-0x0000000000400000-0x0000000000505000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\6dff589c.bat

MD5 183ef3ffa0bfbb06bac98a92916e73aa
SHA1 61f9959b7a3849bbdf2e9564693e25499d573411
SHA256 ef73d80c409a7072358509cea1f7f40758474dfef3bc0f30e2a5b9d2cd2ffca5
SHA512 5b2bb5bf871ca08a37bd21ebc5bfa5be1b106f4032bea642f08dba6ff959cfc0481bbeeea23736e87c180e559d3b4e4817d17f66aec8e4170c0b99ca19a6d252

memory/3036-81-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2532-82-0x0000000000400000-0x0000000000505000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 c4b83a3082ead448b75950cba03a3b74
SHA1 8b2c33902c8f54ef2b827270581f063962f038ca
SHA256 ae20ee2c0d3ce4e4f49fea59201fa1b1a9539c7b29fa9a25dc8d46e60eb50fca
SHA512 3d2864ad9626233cd4f08d34239aec50a807b50e40aebe41cc4fc871f21e003d4dbd54305c7b0ced9f859a0e218466e6af016c908cee34fc4e5c63dc0e580213

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 cc6c9fe54580d4b7bc2e03ff97e1471d
SHA1 29e8691ef78d93a6e421f45acb78f8b678992e16
SHA256 c39a22a5a650275f6187b5d2e96411682be140eb10215d773557f259455ec709
SHA512 fbe852a7d5805cd982370d4cfb69b5a7f801ef1c42aae91efd73b311cad49dcf6baddcb25b36c9a6e83db8aee5ba79ab63cc07e16c85b4b25bdb48a9c7d41018

memory/3036-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-88-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-89-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-93-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-102-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-104-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-105-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-106-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3036-107-0x0000000000400000-0x0000000000537000-memory.dmp