Malware Analysis Report

2024-10-23 16:20

Sample ID 240818-nsbgysvemq
Target d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a

Threat Level: Known bad

The file d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-18 11:39

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-18 11:39

Reported

2024-08-18 11:41

Platform

win7-20240704-en

Max time kernel

147s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\80112177-c568-474a-9c22-aef05ba707e6\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2324 wrote to memory of 2228 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2228 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2228 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2228 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2228 wrote to memory of 2840 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 2228 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2228 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2228 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2228 wrote to memory of 2536 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2536 wrote to memory of 2524 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\80112177-c568-474a-9c22-aef05ba707e6" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.67:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
CO 181.129.118.140:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.16.170.49:80 crl.microsoft.com tcp

Files

memory/2324-0-0x0000000000320000-0x00000000003B1000-memory.dmp

memory/2324-1-0x0000000000320000-0x00000000003B1000-memory.dmp

memory/2228-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2324-6-0x0000000001E30000-0x0000000001F4B000-memory.dmp

memory/2228-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2228-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2228-8-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\80112177-c568-474a-9c22-aef05ba707e6\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/2228-26-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2536-28-0x00000000004E0000-0x0000000000571000-memory.dmp

memory/2536-29-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/2524-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2536-34-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/2524-36-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 cfb6d452647936ecc0c8078d7083212c
SHA1 ba15ca46f54ad7197c39a3ebc79ead6b7ce7713f
SHA256 ea530c745e26b2c0b10c94c9c60d1ea2eb0658da614ae94ebe826340336f293b
SHA512 5bfbd4ba2ebefcf00b0230559da550ce187dcb5e7443a024f811fdca464eb80ea85265fb33e6c4f4fb174c167d4107abcceb4e49aa801ba8ddec65484d1c4f23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 501a49098bb8eae733ee59384a8f781e
SHA1 fda8db22ec3acce3caf89874cade8167c931463a
SHA256 334d5df65f18e20a4f4a064bbd7e4deeaf1f7bb566e559b62177f502db26e46d
SHA512 3be85a99cd5bb276477868ed2ee7550fbcd6295fafdc1c4f9c953d3897b047f99c091535387d2faefacffdcae65d9fe8b385f83041dbbab220cc2f7f785641ea

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\Cab23B6.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2524-51-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-50-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-56-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-59-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-58-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2524-60-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-18 11:39

Reported

2024-08-18 11:41

Platform

win10v2004-20240802-en

Max time kernel

145s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\65dbe763-efdd-4aa0-a948-a32b5eecebb8\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4792 wrote to memory of 4464 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4464 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4464 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4464 wrote to memory of 1396 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 4464 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4464 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4464 wrote to memory of 4784 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4784 wrote to memory of 552 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\65dbe763-efdd-4aa0-a948-a32b5eecebb8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 45.19.74.20.in-addr.arpa udp
US 8.8.8.8:53 73.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.67:80 c.pki.goog tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 67.214.58.216.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
IR 151.233.51.166:80 cajgtus.com tcp
US 8.8.8.8:53 166.51.233.151.in-addr.arpa udp
US 8.8.8.8:53 154.239.44.20.in-addr.arpa udp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 57.169.31.20.in-addr.arpa udp
US 8.8.8.8:53 30.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4792-1-0x0000000002140000-0x00000000021D6000-memory.dmp

memory/4792-2-0x00000000021E0000-0x00000000022FB000-memory.dmp

memory/4464-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4464-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\65dbe763-efdd-4aa0-a948-a32b5eecebb8\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/4464-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4784-21-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/552-23-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4784-26-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/552-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 e5fe23b14f8daaf9a8567ee6d9a07082
SHA1 51d3fe2af82855cab6c5e47e75dc5e40365eb528
SHA256 d214a759eecd60d04796ea8bd95ad256ea864ac04cbf52823f0d3dde0228dbb0
SHA512 dbdf09145a46dbe534f56bb14441d8284deb2a0e5aa6f3a481d05f72478d603656b057822a65e9f98d764fc614dbc61dc03adf6cf3b3757a277ad90550fa6787

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 d607b324aa82a440eca874e3c2965853
SHA1 7d1283686b89b53ebe2cad19b8fffe1386b3300a
SHA256 704e3b50a825a13fc4ccd118f148961566582c8769a087fb2b976874769544c3
SHA512 61c7b5221d21fccd9030d2e4464592ea1156b8d13d8b222f3e760a11224a012a09773b3b32ad65f9660be1cb09200638ec2844fc093f2068155f659e761b66db

memory/552-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-42-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/552-44-0x0000000000400000-0x0000000000537000-memory.dmp