Malware Analysis Report

2024-10-19 01:46

Sample ID 240726-cbr8lasclh
Target 65ea6b27d5c0223105de8f753687f38e.bin
SHA256 34f65aae1fcbfe45b16c79bd2343a938e4bfa4ea6048ca4109d6de6a02d0473a
Tags
djvu aspackv2 discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

34f65aae1fcbfe45b16c79bd2343a938e4bfa4ea6048ca4109d6de6a02d0473a

Threat Level: Known bad

The file 65ea6b27d5c0223105de8f753687f38e.bin was found to be: Known bad.

Malicious Activity Summary

djvu aspackv2 discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Loads dropped DLL

ASPack v2.12-2.42

Executes dropped EXE

Checks computer location settings

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Drops file in Program Files directory

Unsigned PE

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-07-26 01:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-07-26 01:54

Reported

2024-07-26 01:57

Platform

win7-20240705-en

Max time kernel

146s

Max time network

135s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2172136094-3310281978-782691160-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\7851f1fb-3b9b-482d-8de4-dd1fe0a0b9dc\\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\FreeCell\FreeCell.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GRAPH.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jcmd.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.151\GoogleUpdateCore.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\DVD Maker\DVDMaker.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Multiplayer\Checkers\chkrzm.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\106.0.5249.119\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Chess\Chess.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSOUC.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Install\{82C9E0F7-90DB-4BC5-9338-612926653CF7}\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Purble Place\PurblePlace.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jvisualvm.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\appletviewer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jrunscript.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\wsgen.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MSPUB.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Windows Sidebar\sidebar.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\A3DUtility.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\excelcnv.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\misc.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\chrome_pwa_launcher.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\apt.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javah.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\serialver.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Windows Defender\MpCmdRun.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Windows Mail\WinMail.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\ONELEV.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Windows Journal\Journal.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\ktab.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\schemagen.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Minesweeper\MineSweeper.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\default-browser-agent.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\NAMECONTROLSERVER.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\rmic.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre7\bin\jp2launcher.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\private_browsing.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1904 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1904 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1904 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1904 wrote to memory of 2176 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1904 wrote to memory of 2776 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2776 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 2776 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 2776 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 2776 wrote to memory of 1476 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 2776 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2776 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2776 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2776 wrote to memory of 2692 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2176 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2176 wrote to memory of 2616 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2692 wrote to memory of 1412 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\7851f1fb-3b9b-482d-8de4-dd1fe0a0b9dc" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

cmd /c ""C:\Users\Admin\AppData\Local\Temp\22765ca9.bat" "

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp

Files

\Users\Admin\AppData\Local\Temp\sQDjAv.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/1904-1-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/1904-8-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/1904-7-0x00000000001B0000-0x00000000001B9000-memory.dmp

memory/2176-12-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

memory/1904-15-0x0000000001C30000-0x0000000001CC2000-memory.dmp

memory/1904-16-0x0000000001C30000-0x0000000001CC2000-memory.dmp

memory/1904-23-0x0000000002040000-0x000000000213D000-memory.dmp

memory/2776-17-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2776-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1904-24-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/2776-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1904-21-0x0000000001DB0000-0x0000000001ECB000-memory.dmp

memory/2776-19-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\J8I3CVQY\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\2B9037C7.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

C:\Users\Admin\AppData\Local\7851f1fb-3b9b-482d-8de4-dd1fe0a0b9dc\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

MD5 65ea6b27d5c0223105de8f753687f38e
SHA1 66cdf62d3b8b97582acf28fa97eff4bb68d80866
SHA256 dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0
SHA512 ff92e8a878b5f0200e4ba42b5a98fb88a4b4ddb03fe88116eeb4e9d8a0df2711f4edd7b3e7e4ae8c5d1c9ef0fcdd590e21fee0d0e32a42d110ca2cf46db90dc3

memory/2776-67-0x0000000003A00000-0x0000000003AFD000-memory.dmp

memory/2776-68-0x0000000003A10000-0x0000000003B0D000-memory.dmp

memory/2776-71-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2692-72-0x0000000000400000-0x00000000004FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\22765ca9.bat

MD5 cdb9f0c9a9cae240b0c3f441fdcba591
SHA1 7a5568759f708a533e30c3ebce6d3efc327c573f
SHA256 8e6c54352f4c80a05556292da45af3825f07350508a40f62157d3c83783ae2be
SHA512 d0f172b74d7fa6904fba637e69139ff65912f6181b3a8f331151895e10deb5130fd0eb5b54c7502a5e5ff47197771b7171a801386cd70d9cb09d8f68cb8cf390

memory/2176-89-0x0000000000CA0000-0x0000000000CA9000-memory.dmp

memory/2692-80-0x0000000000360000-0x00000000003F2000-memory.dmp

memory/2692-92-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/1412-93-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 0a60cb0aa63a1e80e14eafd7b0694949
SHA1 535e50fcd4778c8b59bfed2691be33ecb9ab8651
SHA256 ce0dd13ff1b813fc573bc49523064450635ec27f5eb37b22f373bc61ac79e97e
SHA512 9ccd18386ff0bcfd130c4e67a73eeeda1ae0fc972847d18a6570a0cb3e847400810e2bbd06ff0e408036ec3bcb1c6f984d8f6ad4b6ef6cdb6b59b73dde199def

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 c12399cb12f219f1da3654e98629169b
SHA1 8e1f4e955a2f6481be07797ab135d466206f6f5d
SHA256 0ed7ed3db70b8bb6b6a0d45152e69151a9b1cd43edb3c859c5cbb4f264cbf521
SHA512 7a6166208cfa4e90bec7229edb354466dfeb0771b90b34a053a5b943a43aa2034aafe70d31039fa54291383917cd66d7e73121d14e030b5659524197a5f07e68

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\Cab13FE.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1412-107-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-106-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-108-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-112-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-121-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-124-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-123-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1412-125-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-07-26 01:54

Reported

2024-07-26 01:57

Platform

win10v2004-20240709-en

Max time kernel

145s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

ASPack v2.12-2.42

aspackv2
Description Indicator Process Target
N/A N/A N/A N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-701583114-2636601053-947405450-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d75e7efb-4d5d-4995-856a-fa0a8293991c\\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\123.0.6312.106\chrome_installer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSOICONS.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\tnameserv.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\PPTICO.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Microsoft.Photos.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\arh.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Windows Photo Viewer\ImagingDevices.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Mozilla Firefox\firefox.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerElevatedAppServiceClient.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\3DViewer.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Cortana.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\ONENOTEM.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Common.DBConnection64.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\SPREADSHEETCOMPARE.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\pack200.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroTextExtractor.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\pi_brokers\32BitMAPIBroker.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.20875.0_x64__8wekyb3d8bbwe\Microsoft.WebMediaExtensions.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Client\AppVDllSurrogate64.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Windows Security\BrowserCore\BrowserCore.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\xjc.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_10.1906.55.0_x64__8wekyb3d8bbwe\Calculator.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHost.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\keytool.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\policytool.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\XboxApp.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleCrashHandler64.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.371\GoogleUpdate.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\rmid.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\kinit.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\VideoLAN\VLC\uninstall.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\SELFCERT.EXE C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\SQLDumper.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\PilotshubApp.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\unpack200.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\cmd.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1192 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1192 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1192 wrote to memory of 1684 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1192 wrote to memory of 700 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 700 wrote to memory of 5036 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Windows\SysWOW64\icacls.exe
PID 700 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 700 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 700 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 1684 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 1684 wrote to memory of 2352 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 2168 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 2168 wrote to memory of 4704 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe
PID 4704 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 4704 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 4704 wrote to memory of 4832 N/A C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe C:\Windows\SysWOW64\cmd.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe
PID 2168 wrote to memory of 2272 N/A C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

Processes

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\d75e7efb-4d5d-4995-856a-fa0a8293991c" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\4e337564.bat" "

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

C:\Windows\SysWOW64\cmd.exe

C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\474534d4.bat" "

C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

"C:\Users\Admin\AppData\Local\Temp\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 ddos.dnsnb8.net udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 105.84.221.44.in-addr.arpa udp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 c.pki.goog udp
GB 172.217.169.3:80 c.pki.goog tcp
US 44.221.84.105:799 ddos.dnsnb8.net tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 3.169.217.172.in-addr.arpa udp
US 8.8.8.8:53 68.32.126.40.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 zerit.top udp
US 8.8.8.8:53 fuyt.org udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp
DE 92.246.89.93:80 fuyt.org tcp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp

Files

memory/1192-0-0x0000000000400000-0x00000000004FD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\sQDjAv.exe

MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3

memory/1684-5-0x0000000000A90000-0x0000000000A99000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\AF6HG05X\k2[1].rar

MD5 d3b07384d113edec49eaa6238ad5ff00
SHA1 f1d2d2f924e986ac86fdf7b36c94bcdf32beec15
SHA256 b5bb9d8014a0f9b1d61e21e796d78dccdf1352f23cd32812f4850b878ae4944c
SHA512 0cf9180a764aba863a67b6d72f0918bc131c6772642cb2dce5a34f0a702f9470ddc2bf125c12198b1995c233c34b4afd346c54a2334c350a948a51b6e8b4e6b6

C:\Users\Admin\AppData\Local\Temp\3469445B.exe

MD5 20879c987e2f9a916e578386d499f629
SHA1 c7b33ddcc42361fdb847036fc07e880b81935d5d
SHA256 9f2981a7cc4d40a2a409dc895de64253acd819d7c0011c8e80b86fe899464e31
SHA512 bcdde1625364dd6dd143b45bdcec8d59cf8982aff33790d390b839f3869e0e815684568b14b555a596d616252aeeaa98dac2e6e551c9095ea11a575ff25ff84f

memory/1192-22-0x0000000002280000-0x000000000231B000-memory.dmp

memory/1192-24-0x0000000002400000-0x000000000251B000-memory.dmp

memory/700-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/700-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1192-27-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/700-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/700-23-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\d75e7efb-4d5d-4995-856a-fa0a8293991c\dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0.exe

MD5 65ea6b27d5c0223105de8f753687f38e
SHA1 66cdf62d3b8b97582acf28fa97eff4bb68d80866
SHA256 dcee34741b1210576a620d3e22d5945f1aea34f8d9940a0b9d098c7ebe0bd1d0
SHA512 ff92e8a878b5f0200e4ba42b5a98fb88a4b4ddb03fe88116eeb4e9d8a0df2711f4edd7b3e7e4ae8c5d1c9ef0fcdd590e21fee0d0e32a42d110ca2cf46db90dc3

memory/1684-63-0x0000000000A90000-0x0000000000A99000-memory.dmp

memory/700-66-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2168-69-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/4704-72-0x0000000001000000-0x0000000001009000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\4e337564.bat

MD5 8c5630e06d9281fb54c5f4453e04304f
SHA1 7a9e600c89a46ff1647e359bb33924e7b38efed1
SHA256 852acdbf26ac7ab06b3a579cc2a12b85834cb8529867a18d5bbf07902c8c7330
SHA512 187062550d7392f6f985129d08b64fa9d00ca5c77d72e3f23433711f6cf56c1239c7eae48ad38bf9f3ea1775fbd195e50f879d1fa5d00a0f7882b1bda5639d95

C:\Users\Admin\AppData\Local\Temp\474534d4.bat

MD5 e477c0517b1a30f7782b215dad9f53dc
SHA1 ac554a625f19a085105160832e5eb3cc5b1ee9cb
SHA256 8586ccc4840217992fce1d020dd67cb1abfa1fd587e784a5028b9231dff90b64
SHA512 20a6a01ac725b01fcec83448d2bccf94cb5ef7049a467801bb0f8b2f9edf8041c251d4bb810773e130152b3a1a37f338242174fea57424491a9f0c236f110312

memory/2168-82-0x0000000000400000-0x00000000004FD000-memory.dmp

memory/2272-81-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 c6cab5d72ad334e805eaafdebf08b0ef
SHA1 629e083f778af4af5c2af69125c757554525e5ff
SHA256 aac9de5965e7beb4398ae99d2d6bd191c79437cd21f14d9306b8314d80e6daf1
SHA512 1084facacea96dfb10e60fa4869e60bff932922ded44f1fe6c0c5bf1b651bd8a6fedcbb9ee738432720f189cde43029a6743af9e0338a0a6a9d16e5d6309c77b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 1336e7f56aaa205d19726380d7a1a8a4
SHA1 440535d9d75c53a697726d774b2a603e8a731bc0
SHA256 3174243f1c6fa001b5cfe02dbc0baacb36e0cf6e4b9d9fe982fd49e8eef8d625
SHA512 9656ce18755cd13da8a41043ca1d4f8a9b2d26a51169711e445fdab1ed796f39c23e21cd80e09d217b46e41c69c481daad4ce5d0d6ce5e67cbf7f972e23e199c

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

memory/2272-88-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-89-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-93-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-102-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-105-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-104-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-106-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2272-107-0x0000000000400000-0x0000000000537000-memory.dmp