Malware Analysis Report

2024-10-19 01:46

Sample ID 240809-k5d7tsyfpp
Target file.exe
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1

Threat Level: Known bad

The file file.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Checks computer location settings

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-09 09:10

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-09 09:10

Reported

2024-08-09 09:15

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

124s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f70f890c-c25c-4eaf-b2d2-b4dd0931ff39\\file.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 4168 set thread context of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 set thread context of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4168 wrote to memory of 932 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 932 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 932 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 932 wrote to memory of 3008 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 932 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 932 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 932 wrote to memory of 4592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 4592 wrote to memory of 3584 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f70f890c-c25c-4eaf-b2d2-b4dd0931ff39" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.179.131:80 c.pki.goog tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 131.179.250.142.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
IR 46.100.50.5:80 cajgtus.com tcp
US 8.8.8.8:53 5.50.100.46.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 206.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 183.59.114.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 52.111.229.48:443 tcp
US 8.8.8.8:53 43.229.111.52.in-addr.arpa udp

Files

memory/4168-1-0x00000000021A0000-0x0000000002237000-memory.dmp

memory/4168-2-0x0000000002240000-0x000000000235B000-memory.dmp

memory/932-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/932-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/932-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/932-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\f70f890c-c25c-4eaf-b2d2-b4dd0931ff39\file.exe

MD5 d7528cd33b73718b5949277420681f90
SHA1 61d97f8da20ff2995890ce5f2c8a2c9e6e51c078
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
SHA512 b3dab709e19a2a8bad92b259ea1739ad55564f6fe31e9f4e502b6280ae6c70cdf5a0f1fda208887da4bbcf9213986e2038abe6a09dc2940998df08d82e87d474

memory/932-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4592-19-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/3584-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4592-23-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/3584-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-22-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 e46c94a2a04b40ce158ab0fd2aaed80e
SHA1 3bfbba3ea07f70447ff7849ad6fa2ff3f825f588
SHA256 d7bbed451793dc7374de96451e221a60de5f3e4b3dd0cabfa0c26dbe7141b711
SHA512 8fa86c62f9ca10bde05c6c3af9a29e17502712e0efde892e45fbd4beac60db0126ac3a84385b48345fb5edeb1886c81e957e23f0811fd8f6f59ef8a9e7344286

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 9df454429b04b130bfa1b74f6565c8e4
SHA1 0d3ab58db37c483d6f0825e6a0f7acc1f09b9f61
SHA256 86966bb95740e3088920de8318e4a7d397e40649d1cbb0d14eea189a22e0960d
SHA512 5a0e939b090f4e4e8e4b39db2728ce172ee25cf6109e3dbc22b63e9d07ca25b612242edb8968dc38fb83742453bf025ed0d527a8930dc6773b8d82f888bff64e

memory/3584-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-38-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3584-40-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-09 09:10

Reported

2024-08-09 09:15

Platform

win7-20240704-en

Max time kernel

142s

Max time network

125s

Command Line

"C:\Users\Admin\AppData\Local\Temp\file.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3450744190-3404161390-554719085-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b5e8448e-e624-44cf-b925-5579c5544271\\file.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 2852 set thread context of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 set thread context of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\file.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\file.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2852 wrote to memory of 2832 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 2832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 2832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 2832 wrote to memory of 2592 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Windows\SysWOW64\icacls.exe
PID 2832 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2832 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2832 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2832 wrote to memory of 2204 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe
PID 2204 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\file.exe C:\Users\Admin\AppData\Local\Temp\file.exe

Processes

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\b5e8448e-e624-44cf-b925-5579c5544271" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\file.exe

"C:\Users\Admin\AppData\Local\Temp\file.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.179.131:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
MX 187.152.11.54:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.16.170.123:80 crl.microsoft.com tcp

Files

memory/2852-0-0x0000000000540000-0x00000000005D2000-memory.dmp

memory/2852-2-0x0000000001DB0000-0x0000000001ECB000-memory.dmp

memory/2852-1-0x0000000000540000-0x00000000005D2000-memory.dmp

memory/2832-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2832-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2832-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2832-8-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\b5e8448e-e624-44cf-b925-5579c5544271\file.exe

MD5 d7528cd33b73718b5949277420681f90
SHA1 61d97f8da20ff2995890ce5f2c8a2c9e6e51c078
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
SHA512 b3dab709e19a2a8bad92b259ea1739ad55564f6fe31e9f4e502b6280ae6c70cdf5a0f1fda208887da4bbcf9213986e2038abe6a09dc2940998df08d82e87d474

memory/2832-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2204-29-0x0000000000360000-0x00000000003F2000-memory.dmp

memory/2204-30-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/2632-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2204-36-0x0000000000400000-0x00000000004CA000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 8c05558018ba0b4b915aa212beab8b27
SHA1 4974fc8cb98edc20337118e9901e94a08a2329c4
SHA256 87e41a3ebb97930827f3419e19731d8eb3471c533ef02e1092ec080eb90dc53f
SHA512 1a0b8d70939bedeae76531da78f74e603fd7f90adf649e878619137a58e179821e1b2a237f2e06135136b93dd545796b91771f1f244f13ba290a838c515b8cd3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 c040a9a786656861d75dd00d58751cc2
SHA1 3528b8d0c7e45e704bc2c73fe77dfddffa8171d3
SHA256 b2a79efbf6e203d4a8c8a3f6f6fe0d8c8492a7616fee6be3f6153b698725b526
SHA512 fbb55ce7c5be966129d2598a60682570882eff29a12d678243228fc5ca3f9ddb0a63cbf6e38c7f35c4d9b0316d61afa4f500a984981fdfea517a4272192a7a9e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\Cab708E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 d7c83225a5725869dacbb81491a55b3d
SHA1 d0cacd13a29d5f83f4756083d6b16897b8831b43
SHA256 1a135d19ad46051c0de2d495d11ddeb2e1bda304b4a6cc5dd203dcfb5184ffdf
SHA512 5959a1ed7522cb47917d44fe482b1cb329293e1922aaaa25191148d24978e5d29d5e20bc4d6b1ef001ccaee42ebadc476642f16a8aa13c04841b7e4aef1bcfdc

memory/2632-51-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-50-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-56-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-59-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-58-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-60-0x0000000000400000-0x0000000000537000-memory.dmp