Malware Analysis Report

2024-10-23 16:21

Sample ID 240827-df5vxsyhra
Target b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9

Threat Level: Known bad

The file b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 02:58

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 02:58

Reported

2024-08-27 03:00

Platform

win7-20240704-en

Max time kernel

149s

Max time network

156s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\732fa06b-9e6b-47e7-b41b-0547ab52e90d\\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1668 wrote to memory of 2140 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2140 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2140 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2140 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2140 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2140 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2140 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2140 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2140 wrote to memory of 2836 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2836 wrote to memory of 2724 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3028 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3028 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3028 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3028 wrote to memory of 1028 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\system32\taskeng.exe

taskeng.exe {D12ED43E-0681-4F15-A1AF-DFF0B469AE15} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp

Files

memory/1668-0-0x00000000007C0000-0x0000000000851000-memory.dmp

memory/1668-1-0x00000000007C0000-0x0000000000851000-memory.dmp

memory/1668-2-0x0000000001E40000-0x0000000001F5B000-memory.dmp

memory/2140-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2140-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2140-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1668-7-0x00000000007C0000-0x0000000000851000-memory.dmp

memory/2140-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\732fa06b-9e6b-47e7-b41b-0547ab52e90d\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

MD5 04e42207db45792cae0f6d3fd83f0680
SHA1 cb17f3a1bb57541204afd27313b390e5ead5096c
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
SHA512 b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

memory/2140-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2836-32-0x0000000000740000-0x00000000007D1000-memory.dmp

memory/2836-33-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2724-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2724-40-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2836-38-0x0000000000400000-0x00000000004D9000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 33f20ee9eb7901e3e9998270ebe86f16
SHA1 a64eb552689a01b452c0fbfa75c582f0a139bdec
SHA256 decfaa55053416bf329c58327b9a5dcccbcde7b8b9eddfbab0cb90b2701c9eb6
SHA512 3d23cf1b9d78a983536c62a95686f8b5bca776f4fbb604cc641569b5b4bb5cace991474b85942cc4be4a874f0ae285917a28cae6c5dd3fa134edd6244839bb46

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 402008415b52f8e1219c87eefdeee532
SHA1 a6ef1b6b1de19a282704e82ecac5ec95d7c095ec
SHA256 df1a8b450e4643603eaadd9349d83f0032d3b9b05aa957bb9c5d8f75a1cde2e7
SHA512 9dbc55d3de6a6b4a009cc9d387f3a76b3de70ffd923097fe870c7ca874c9b2bb2aa33a5018618437ed1c1a641923da973acb2c2ea7ad24771c10a83b7f94c4c7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 7c4ca8ad51ea19466884d0500c673ed1
SHA1 a7a4b8c662002e82386de21a39f76ff5005283d5
SHA256 cfef2d6c7011d453dacb2570183dfdf3c389258fb4dde2dd2e0a08ce2d52ff4b
SHA512 522528ea21da0c52eaa1fe3def2ad14d01ed794a1b104f171cd10bc90b633fd7b24c898dec89f505eb440ceeedcb192e8b5c025948d2dface32860604e6211d2

C:\Users\Admin\AppData\Local\Temp\CabB7EA.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2724-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2724-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2724-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-69-0x0000000000220000-0x00000000002B1000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 02:58

Reported

2024-08-27 03:00

Platform

win10v2004-20240802-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\28802b60-6706-49f7-9f50-a928027b80da\\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2616 wrote to memory of 2024 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2024 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2024 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2024 wrote to memory of 3296 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2024 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2024 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2024 wrote to memory of 4972 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4972 wrote to memory of 4668 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3428 wrote to memory of 3544 N/A C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 103.169.127.40.in-addr.arpa udp
US 8.8.8.8:53 56.126.166.20.in-addr.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 81.144.22.2.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 29.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 104.21.65.24:443 api.2ip.ua tcp

Files

memory/2616-1-0x0000000002160000-0x00000000021FC000-memory.dmp

memory/2616-2-0x00000000022F0000-0x000000000240B000-memory.dmp

memory/2024-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2024-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2024-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2024-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\28802b60-6706-49f7-9f50-a928027b80da\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

MD5 04e42207db45792cae0f6d3fd83f0680
SHA1 cb17f3a1bb57541204afd27313b390e5ead5096c
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
SHA512 b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

memory/2024-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4972-21-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/4668-23-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4668-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4972-26-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/4668-25-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 3b361c8bd01f16c2551c229e7f3e6760
SHA1 7e4b09c280c3138f62a536f7af74c3f4bc7dca20
SHA256 43a976e473383b3f1cad6b93075eb8cb1f5a5f00e1c23810af03442a8aa8eafb
SHA512 4ecce0588cdecd988a76e16f4e52c392b65ac96ebdb5bf56ff3402202956021a46378f6e584fa22b35cd4054b868c519d88988b0a9f8ddbd2452a5abcca360e9

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 667d74821edd1bc7e10f9d82a06bfc3e
SHA1 18047462c1aac3e70a92f0bef1d397997fb1bfa2
SHA256 3089b98b412660c00a298e32330a8d213bc45349327cbe13a0bc1d10dd953245
SHA512 46122c4608cea47c290b0f3de30c479dda6ab6e6365f2c6748512f7e0746bfef193420d9eb6e94e3842af514be95b4788148709c1bcbe85ebc641923c333f52e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

memory/4668-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4668-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4668-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3544-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3544-53-0x0000000000400000-0x0000000000537000-memory.dmp