Analysis
-
max time kernel
142s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
27-08-2024 20:49
Static task
static1
Behavioral task
behavioral1
Sample
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
Resource
win10v2004-20240802-en
General
-
Target
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
-
Size
813KB
-
MD5
03851cdd1e543a7f09c0e4ade384bfd4
-
SHA1
342860ec1d18ac3b2cccd35ca2794d1db7c71353
-
SHA256
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
-
SHA512
4b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38
-
SSDEEP
12288:R+KI630b+EJrbydbNKDcEi453oh1Nj0DYK636Zstz0pW5CDmyipL+1ea0mw:Rzkb+qHSbIZz5hW6Z2z0pW9+QFmw
Malware Config
Extracted
djvu
http://asvb.top/nddddhsspen6/get.php
-
extension
.pcqq
-
offline_id
3pNdLH1399769YerBBKCxHURRAqLhaXsGw3Fbkt1
-
payload_url
http://asvb.top/files/penelop/updatewin1.exe
http://asvb.top/files/penelop/updatewin2.exe
http://asvb.top/files/penelop/updatewin.exe
http://asvb.top/files/penelop/3.exe
http://asvb.top/files/penelop/4.exe
http://asvb.top/files/penelop/5.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TVrnNufMGq Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0296Sirj
Signatures
-
Detected Djvu ransomware 11 IoCs
Processes:
resource yara_rule behavioral2/memory/4436-2-0x0000000002270000-0x000000000238B000-memory.dmp family_djvu behavioral2/memory/2608-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2608-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2608-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2608-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2608-15-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2448-19-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2448-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/2448-20-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/548-31-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/548-39-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Executes dropped EXE 2 IoCs
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exepid process 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 548 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\21f52e9b-6be6-4b87-884f-b0b80987f108\\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe\" --AutoStart" 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 111 api.2ip.ua 20 api.2ip.ua 21 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exedescription pid process target process PID 4436 set thread context of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 set thread context of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 set thread context of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4404 2448 WerFault.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
System Location Discovery: System Language Discovery 1 TTPs 7 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exeicacls.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exepid process 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 548 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 548 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe -
Suspicious use of WriteProcessMemory 36 IoCs
Processes:
225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exedescription pid process target process PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 4436 wrote to memory of 2608 4436 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 2608 wrote to memory of 4300 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe icacls.exe PID 2608 wrote to memory of 4300 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe icacls.exe PID 2608 wrote to memory of 4300 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe icacls.exe PID 2608 wrote to memory of 3576 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 2608 wrote to memory of 3576 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 2608 wrote to memory of 3576 2608 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 3576 wrote to memory of 2448 3576 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe PID 1400 wrote to memory of 548 1400 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4300 -
C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3576 -
C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask4⤵
- System Location Discovery: System Language Discovery
PID:2448 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 5685⤵
- Program crash
PID:4404
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 24481⤵PID:2372
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4028,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:81⤵PID:232
-
C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exeC:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1400 -
C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exeC:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3B
MD58a80554c91d9fca8acb82f023de02f11
SHA15f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Filesize302B
MD5f905a5a284b48d1b1c856bb8f76e0e29
SHA130c8b864f90b1bc472be013eeaef2a1f3ca8eff0
SHA256064c73a4a76601b4e4da9ce814648097a151cb93d01e593244d7b9634972c5ec
SHA5129bc497fdef2f6322aa576c1a8cc2699d8983e0033d1bd6bfc04ad709c79e60f6ff8d4f2f5c61d3d9857f513b62019905e734b69c3226bfa3a52ab63ad676604f
-
C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
Filesize813KB
MD503851cdd1e543a7f09c0e4ade384bfd4
SHA1342860ec1d18ac3b2cccd35ca2794d1db7c71353
SHA256225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA5124b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38