Malware Analysis Report

2024-10-23 16:21

Sample ID 240827-v5a6aatfnq
Target b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9

Threat Level: Known bad

The file b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Checks computer location settings

Modifies file permissions

Executes dropped EXE

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 17:33

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 17:33

Reported

2024-08-27 17:36

Platform

win7-20240704-en

Max time kernel

148s

Max time network

154s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\9860e1b0-610b-428a-9e6e-a8e637093a09\\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 560 wrote to memory of 2408 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2408 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2408 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2408 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2408 wrote to memory of 3040 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2408 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2408 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2408 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2408 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2720 wrote to memory of 2744 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1792 wrote to memory of 1172 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1792 wrote to memory of 1172 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1792 wrote to memory of 1172 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 1792 wrote to memory of 1172 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\system32\taskeng.exe

taskeng.exe {7394545F-4C24-40C9-A475-F3A24ED99231} S-1-5-21-2212144002-1172735686-1556890956-1000:MVFYZPLM\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 92.123.142.59:80 crl.microsoft.com tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp

Files

memory/560-0-0x00000000002A0000-0x0000000000331000-memory.dmp

memory/560-1-0x00000000002A0000-0x0000000000331000-memory.dmp

memory/2408-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/560-6-0x00000000002A0000-0x0000000000331000-memory.dmp

memory/2408-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/560-2-0x0000000001D70000-0x0000000001E8B000-memory.dmp

memory/2408-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2408-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\9860e1b0-610b-428a-9e6e-a8e637093a09\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

MD5 04e42207db45792cae0f6d3fd83f0680
SHA1 cb17f3a1bb57541204afd27313b390e5ead5096c
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
SHA512 b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

memory/2408-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2720-30-0x0000000000330000-0x00000000003C1000-memory.dmp

memory/2720-31-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2720-35-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2744-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-38-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 f0f855af2dd4242164817a2f9f0feed8
SHA1 ce91d9d8a9f888c57f0a68109797b1738865329f
SHA256 74e1a85ccb72d1ee7257f3f4352ee7287d658bfa765709ca2f8300e5cbf18610
SHA512 ecd07a822ca498cf0a7ba11de15805233a2c8fb849efeeecabd9f0dc38d5ae84710737e674b343cfdbd366f53e3aa1d03643be95385085a702346ad0a404aae8

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 05d532a2794c7d66c633d09ad9a2f77b
SHA1 796772116e716e5b5844d6bc1fac011fbba6e86e
SHA256 d96c6badc889c1759f32f57aae3dfd4893beda1ddc59630b7742b2a9c5a5443c
SHA512 3945e10a150ef601ea67751648ef892c65e3cc4583a650eabaf639ac0351b2946c40c6e2c87e096abf7e32d1bd773fe84d3bbe7dd1f9bdc54ee0d762148a98f0

C:\Users\Admin\AppData\Local\Temp\Cab3F13.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 21ce0423b8e07a2eddb25300ae1b203c
SHA1 f24346e1ce531f0a7019d979fea7cdcb7b6504a2
SHA256 8968ccfb403a392985355396c115df333249d5c6a0c792473857367c9349e125
SHA512 207b4c815d369a061cef91b6d212199f0586d6741c9128c91eb75081ac8dda7df2dd2e3d9bf38db7a71801a6c05f3f8ae785c4168c59d8ea7f7bfdb77d1eb175

memory/2744-51-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2744-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1172-67-0x0000000001CA0000-0x0000000001D31000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 17:33

Reported

2024-08-27 17:36

Platform

win10v2004-20240802-en

Max time kernel

144s

Max time network

149s

Command Line

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2718105630-359604950-2820636825-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4524 wrote to memory of 2072 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2072 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2072 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2072 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Windows\SysWOW64\icacls.exe
PID 2072 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2072 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 2072 wrote to memory of 4268 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 4268 wrote to memory of 2056 N/A C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe
PID 3932 wrote to memory of 3284 N/A C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

Processes

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

"C:\Users\Admin\AppData\Local\Temp\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 209.205.72.20.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 22.177.190.20.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 8.8.8.8:53 api.2ip.ua udp
US 150.171.27.10:443 g.bing.com tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 205.47.74.20.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 24.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 8.8.8.8:53 43.58.199.20.in-addr.arpa udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 73.144.22.2.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 52.111.227.13:443 tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
DE 92.246.89.93:80 asvb.top tcp
US 172.67.139.220:443 api.2ip.ua tcp

Files

memory/4524-1-0x0000000002240000-0x00000000022D6000-memory.dmp

memory/4524-2-0x00000000022E0000-0x00000000023FB000-memory.dmp

memory/2072-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2072-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2072-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2072-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\e1e21ddf-6ee3-4fd1-960d-ec52e2a3d3f8\b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9.exe

MD5 04e42207db45792cae0f6d3fd83f0680
SHA1 cb17f3a1bb57541204afd27313b390e5ead5096c
SHA256 b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9
SHA512 b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

memory/2072-17-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4268-19-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2056-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4268-23-0x0000000000400000-0x00000000004D9000-memory.dmp

memory/2056-24-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 3b7893626b2eca74d82e6b005ace1442
SHA1 46a379cd294cb496455773690b4103b6e6baed0a
SHA256 3dc52125106f445b15e3df9bffc3bb5bf0b11d0d6a73cecfadb16f5a4ac343fe
SHA512 ed823ca9cbc6ee0ff7be3a30d9782dab3b1d80b26b461fd6cb628378fadf38d276d33664e031688c9ff8a1af8b7a29b7415ae3373cac3ec2e7b5cf593b6f66b3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 042151048b3e3c58a55d350dfec6880b
SHA1 057ef12e681aa2072020ddbb8ecfeda9fd117a68
SHA256 1b11a21057ec569c01f82779a7fc339db75e22e88e503afe363fdbc55a46799a
SHA512 904a0a768e743b583aacdb16574782ea77687e9c07d22e47d769c53b108da86f9c1fa231c77257ae2e7fa26fa3a8ddbc3e19188de1adefbcf2e23960c3aef988

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

memory/2056-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-30-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2056-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3284-48-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3284-49-0x0000000000400000-0x0000000000537000-memory.dmp