Malware Analysis Report

2024-10-23 16:20

Sample ID 240818-nlabba1gqh
Target d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a

Threat Level: Known bad

The file d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Program crash

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 11:28

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 11:28

Reported

2024-08-18 11:31

Platform

win10v2004-20240802-en

Max time kernel

93s

Max time network

127s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8f042b53-4aae-4052-badc-4a68bf514295\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4904 wrote to memory of 4924 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4924 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4924 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4924 wrote to memory of 2472 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4924 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4924 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4924 wrote to memory of 756 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 756 wrote to memory of 5000 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\8f042b53-4aae-4052-badc-4a68bf514295" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 5000 -ip 5000

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 5000 -s 572

Network

Country Destination Domain Proto
US 8.8.8.8:53 13.86.106.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
FR 216.58.214.67:80 c.pki.goog tcp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 8.8.8.8:53 50.23.12.20.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 192.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 150.171.28.10:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 10.28.171.150.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
US 52.111.227.13:443 tcp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp

Files

memory/4904-1-0x0000000002130000-0x00000000021D1000-memory.dmp

memory/4904-2-0x00000000021E0000-0x00000000022FB000-memory.dmp

memory/4924-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4924-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4924-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4924-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\8f042b53-4aae-4052-badc-4a68bf514295\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/4924-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/756-21-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/756-27-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/5000-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5000-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/5000-23-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 11:28

Reported

2024-08-18 11:31

Platform

win11-20240802-en

Max time kernel

146s

Max time network

152s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1d160eb1-5e19-4535-bbb5-e5838eb6fa6f\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4976 wrote to memory of 2468 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2468 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2468 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2468 wrote to memory of 4900 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2468 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2468 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2468 wrote to memory of 4672 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4672 wrote to memory of 3552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1d160eb1-5e19-4535-bbb5-e5838eb6fa6f" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3552 -ip 3552

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 3552 -s 604

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.67:80 c.pki.goog tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp

Files

memory/4976-1-0x0000000002340000-0x00000000023DD000-memory.dmp

memory/4976-2-0x00000000024F0000-0x000000000260B000-memory.dmp

memory/2468-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2468-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2468-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2468-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\1d160eb1-5e19-4535-bbb5-e5838eb6fa6f\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/2468-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4672-23-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/3552-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3552-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4672-29-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/3552-26-0x0000000000400000-0x0000000000537000-memory.dmp