Malware Analysis Report

2024-10-19 01:46

Sample ID 240725-vz2faatfjp
Target 232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
SHA256 232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b
Tags
djvu aspackv2 discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b

Threat Level: Known bad

The file 232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe was found to be: Known bad.

Malicious Activity Summary

djvu aspackv2 discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

ASPack v2.12-2.42

Executes dropped EXE

Loads dropped DLL

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Drops file in Program Files directory

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-25 17:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-25 17:26

Reported

2024-07-25 17:29

Platform

win7-20240705-en

Max time kernel

142s

Max time network

130s

Command Line

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2660163958-4080398480-1122754539-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6bbb4c64-2f37-4419-a5b5-ae6a2e8164fb\\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\7-Zip\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Hearts\Hearts.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Mozilla Maintenance Service\Uninstall.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Windows Journal\Journal.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaws.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jstat.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\launcher.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\SC_Reader.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SCANPST.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jhat.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AdobeCollabSync.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\notification_helper.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OUTLOOK.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\idlj.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\nbexec64.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Windows Mail\wab.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 344 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 344 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 344 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 344 wrote to memory of 2704 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 344 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2744 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 348 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 2744 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2744 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2744 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2744 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2544 wrote to memory of 2236 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 2704 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe C:\Windows\SysWOW64\cmd.exe
PID 2704 wrote to memory of 2656 N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\6bbb4c64-2f37-4419-a5b5-ae6a2e8164fb" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\41b81ab3.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 fuyt.org udp
US 8.8.8.8:53 zerit.top udp
DE 92.246.89.93:80 zerit.top tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp
DE 92.246.89.93:80 zerit.top tcp

Files

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/2704-12-0x00000000009D0000-0x00000000009D9000-memory.dmp

memory/344-11-0x00000000009D0000-0x00000000009D9000-memory.dmp

memory/344-10-0x00000000009D0000-0x00000000009D9000-memory.dmp

memory/344-9-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2744-14-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2744-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/344-18-0x0000000001D60000-0x0000000001DF2000-memory.dmp

memory/2744-16-0x0000000000400000-0x0000000000537000-memory.dmp

memory/344-21-0x0000000001E00000-0x0000000001F1B000-memory.dmp

memory/2744-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/344-20-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Local\6bbb4c64-2f37-4419-a5b5-ae6a2e8164fb\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

MD5 20741efb92edd220de77c9e7e59b6c29
SHA1 61091ff70842a709c0283253be9b0e473bfa1054
SHA256 232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b
SHA512 fb66a40b9e65c73f525dcf4ca9c8a3eb3411aa4bee584fc6138ab4a8fba88cdc9cfeec26fe6c3dc38d18d6a8a8af550471d1bb6ef087433124c3898fb4b8f691

C:\Users\Admin\AppData\Local\Temp\1C851CF3.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\NIUC9X25\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

memory/2744-56-0x0000000003A50000-0x0000000003B52000-memory.dmp

memory/2544-57-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2744-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2544-68-0x0000000002170000-0x0000000002272000-memory.dmp

memory/2544-67-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2236-66-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Cab2C7D.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 539bd6d6a22518af81b031deff2ef4b0
SHA1 b1cafcb5a1119d28420984682239c4d0b1f63fd7
SHA256 6f99fd703b139c6ac1eacfa420d89c5a005eb5461100088488fe3a8d71efda71
SHA512 841bc00bb6c1b14cc42d58a1f82aeb138ea9c04208b10ae5f56fe84f993a706441587e881876696ff8a7a53468b440f6a857c44bc776d56885be99fcf382aeda

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 2274e146aa5c44e68e29b6973d7af757
SHA1 673c67387e3a6ca46416dcbc029dce7d65a0455f
SHA256 73363323a6519c0857df872f64d96e8af43f9817de9d1568f8c7c461087f0437
SHA512 e7512b1699a5dd763aa51c2f8cc461ae2fa7e7f7c2232b5360737299a1cfc268c995875dc84c89d2fcd13deadf12073fcdd2acd281d408db4fc795ddcaa4968e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

memory/2236-88-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2236-87-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 a6413a79d364a6086cf8320116c9bbda
SHA1 246f167070adf641c9f3b812a228d2ba01409997
SHA256 8d65315fbb514872f5d56d130b3d915187b64946c0114e4349a376b397712b59
SHA512 8311183bf4f09905253a7ef51b26e4224f3e8dd5da9189e081be480939dae142d4ab4af944930c5c7e47473fe56af0b0adcc05a048e2a77cb717825f46d367eb

memory/2704-103-0x00000000009D0000-0x00000000009D9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\41b81ab3.bat

MD5 965e766b6871c9c57dab519615d67367
SHA1 00fbe5cdce7111f4747c2d01014c5835d3fd9c55
SHA256 6e1366d59804b3a47285b525e58ffe13327754a1675cf1c81e4f6edbb843d7da
SHA512 b90b8f3895fca91c40da94b4f805bf43d9735e90948183430fe1815d6a702f3a367b78f305ae899bea084d15ad9c3038862bd758661fdef4e396d47543a59d12

memory/2236-105-0x0000000000400000-0x0000000000537000-memory.dmp

memory/344-106-0x0000000001E00000-0x0000000001F1B000-memory.dmp

memory/2744-107-0x0000000003A50000-0x0000000003B52000-memory.dmp

memory/2236-111-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2236-123-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2236-122-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2236-120-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2236-124-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-25 17:26

Reported

2024-07-25 17:29

Platform

win10v2004-20240709-en

Max time kernel

1s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\6e2b7937-2ac4-42d6-95da-7f0fc6cdcc55\\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jre-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\misc.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\EQUATION\eqnedt32.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\Wordconv.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DW20.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SkypeSrv\SKYPESERVER.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX40.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\uninstall\helper.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\IEContentService.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\minidump-analyzer.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoasb.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteshare.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\crashreporter.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\WhatsNew.Store.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\servertool.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_3.6.73.0_x64__8wekyb3d8bbwe\Microsoft.Notes.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.106\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeApp.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\7-Zip\7zG.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Integrator.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Integration\Addons\OneDriveSetup.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jstatd.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\filecompare.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4532 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 4532 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 4532 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4532 wrote to memory of 4984 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe
PID 4984 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 4984 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe
PID 4984 wrote to memory of 2896 N/A C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe C:\Windows\SysWOW64\icacls.exe

Processes

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\6e2b7937-2ac4-42d6-95da-7f0fc6cdcc55" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

"C:\Users\Admin\AppData\Local\Temp\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\438119a0.bat" "

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 c.pki.goog udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 134.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 228.249.119.40.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 208.143.182.52.in-addr.arpa udp

Files

memory/4532-1-0x0000000000400000-0x0000000000502000-memory.dmp

memory/1108-5-0x00000000004C0000-0x00000000004C9000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\XrmUTb.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/4532-7-0x00000000021F0000-0x0000000002282000-memory.dmp

memory/4984-12-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4984-11-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4984-13-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4532-9-0x0000000002290000-0x00000000023AB000-memory.dmp

memory/4984-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4532-10-0x0000000000400000-0x0000000000502000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MDMHN06X\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\687757E3.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\6e2b7937-2ac4-42d6-95da-7f0fc6cdcc55\232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b.exe

MD5 20741efb92edd220de77c9e7e59b6c29
SHA1 61091ff70842a709c0283253be9b0e473bfa1054
SHA256 232d25948db02a80f05a71382a8fda0000fb08df82778f30322d5844ce7d167b
SHA512 fb66a40b9e65c73f525dcf4ca9c8a3eb3411aa4bee584fc6138ab4a8fba88cdc9cfeec26fe6c3dc38d18d6a8a8af550471d1bb6ef087433124c3898fb4b8f691

memory/4984-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2212-47-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2296-67-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2212-68-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2296-65-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-64-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1108-77-0x00000000004C0000-0x00000000004C9000-memory.dmp

memory/2296-80-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\438119a0.bat

MD5 e2281774993476c583a6e1cad5c87a32
SHA1 b4d8d72b9824b01f2f2bbde6965c48f13a4bef89
SHA256 47427dd942498b91b6423f216fe871f54597d14d9d95492793e95434442577bf
SHA512 881e7055989f7fd053388acbf68ffa992ce296365d1e4c85e4b206c7b866516ab6804c4923a7fb3170efaa2fd334f8e8b57ef6cdeedb1c279d41eb37a91fffb3

memory/2296-78-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 57b094ba1f2b91396295a76f7fb51df7
SHA1 86aad62ae8a1a17aede45794a00512deb2f38d87
SHA256 d2657654fb1355bef54d6ae5eba0b99f8dde0b61d85975e375d48f1d49c10fab
SHA512 27338fb31ccf8d0a29145cad0ed32688af43efe3fc077268b432f1a4ec33ab640ef161b0c77ade2861bac5710d30946ab38e75d68130d11f2737b87b5036fb26

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 901f823d20a5de405c095fb4acd9d213
SHA1 142339411c31e26ed4d838257657920fd277ed49
SHA256 12da885ab2c37a8110368e6946a5f45264d391a195941a397474fb2db9e7c058
SHA512 28c09174aebfab7860a90f532355fe5175c9ccf8da0e9c4cceceff687ffaa1438ba66485fd2a525e5114564a7b9996962e651a8e1bee15cad018ad073c08dad2

memory/2212-62-0x0000000000400000-0x0000000000502000-memory.dmp

memory/2296-81-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-85-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-94-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-96-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-97-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-98-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2296-99-0x0000000000400000-0x0000000000537000-memory.dmp