Malware Analysis Report

2024-10-23 16:21

Sample ID 240827-zmfp9ssgjr
Target 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5

Threat Level: Known bad

The file 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Program crash

Unsigned PE

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 20:49

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 20:49

Reported

2024-08-27 20:53

Platform

win7-20240705-en

Max time kernel

143s

Max time network

144s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1385883288-3042840365-2734249351-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\37b74952-4979-4cf6-88d7-10a0b1915679\\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F216B2802DECF17863249E35D1B89E8A1350953\Blob = 0f0000000100000020000000a707ed22d6bdb54352acbfeabb91d639de6a4d488ec3de2f0ca44e0089126b9f0300000001000000140000007f216b2802decf17863249e35d1b89e8a13509532000000001000000f9020000308202f5308201dda0030201020210065884d4ee2b906780a039c79b5ec47c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303733303035303030305a170d3239303732393035303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8c774dfe0cefc0ad685694a86245d74899aa394e24843b15dc1f37022f8c4704cc41a98ec7a40349fa9034a24ffe9f60753adc2bad9058f2cb20aff061566af5dd5ffbcbbd2e094d122bfdb2fc9ab5bee3baefa1301a11551dd81f166561b5a7befe29ea316e13e89f9dea4794bcb013dc513bcd69f9f91924973ba5bfa53e7e9aa549dbe82b82ab1769f3d044223ef4e87690f4f45a4a7bf9348cd4c5438d57c88e082c4b868f1704b7ef1b2a87a2319b6b42da929209a34c69940817d60b51fc0725fea480be5f2124814c0ca9a137d00f11f43d2a7b5d51fbafff6b7611f3a87af90e38f296a67fbe30307453187a7db65846a462cbaed878cddee8b729d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414aa0f505d48b2981c564e5f9f7ce4476fa0a20803300d06092a864886f70d01010b0500038201010047db14c1e40aa0b1d73d2aabed5fa72eebd20b95a5522c6c75df86074e1b6c5fd9e150222f875c89664a769ac6aebe4abebd69db9a9c07be4abfcb3bc11418f88cb7a05de356682aa2fc70331d82acb6ec7a1557e469918336332622541275ebc9eeb7c58ecc5555d0d6fb9f80498b25cc91d5ac58eda1d7a8a34a5eb5f0d6347ec19b491f46c526ad061054dd3698b16fdc76bee725899f55d7fecd62887014716ad0e77f26504bd63ee08b21f61043c77438b6739a424b78e2bad6ce1fbf225d0b5bc02e06c5287b529186eb238c4e3acf10fd7293af0a07e06804de2c3c73ba43d96fc119cdbcec1a3220523175932a943c6ffc75c9222211e8ae188e621e C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F216B2802DECF17863249E35D1B89E8A1350953\Blob = 140000000100000014000000aa0f505d48b2981c564e5f9f7ce4476fa0a208030300000001000000140000007f216b2802decf17863249e35d1b89e8a13509530f0000000100000020000000a707ed22d6bdb54352acbfeabb91d639de6a4d488ec3de2f0ca44e0089126b9f2000000001000000f9020000308202f5308201dda0030201020210065884d4ee2b906780a039c79b5ec47c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303733303035303030305a170d3239303732393035303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8c774dfe0cefc0ad685694a86245d74899aa394e24843b15dc1f37022f8c4704cc41a98ec7a40349fa9034a24ffe9f60753adc2bad9058f2cb20aff061566af5dd5ffbcbbd2e094d122bfdb2fc9ab5bee3baefa1301a11551dd81f166561b5a7befe29ea316e13e89f9dea4794bcb013dc513bcd69f9f91924973ba5bfa53e7e9aa549dbe82b82ab1769f3d044223ef4e87690f4f45a4a7bf9348cd4c5438d57c88e082c4b868f1704b7ef1b2a87a2319b6b42da929209a34c69940817d60b51fc0725fea480be5f2124814c0ca9a137d00f11f43d2a7b5d51fbafff6b7611f3a87af90e38f296a67fbe30307453187a7db65846a462cbaed878cddee8b729d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414aa0f505d48b2981c564e5f9f7ce4476fa0a20803300d06092a864886f70d01010b0500038201010047db14c1e40aa0b1d73d2aabed5fa72eebd20b95a5522c6c75df86074e1b6c5fd9e150222f875c89664a769ac6aebe4abebd69db9a9c07be4abfcb3bc11418f88cb7a05de356682aa2fc70331d82acb6ec7a1557e469918336332622541275ebc9eeb7c58ecc5555d0d6fb9f80498b25cc91d5ac58eda1d7a8a34a5eb5f0d6347ec19b491f46c526ad061054dd3698b16fdc76bee725899f55d7fecd62887014716ad0e77f26504bd63ee08b21f61043c77438b6739a424b78e2bad6ce1fbf225d0b5bc02e06c5287b529186eb238c4e3acf10fd7293af0a07e06804de2c3c73ba43d96fc119cdbcec1a3220523175932a943c6ffc75c9222211e8ae188e621e C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F216B2802DECF17863249E35D1B89E8A1350953\Blob = 0400000001000000100000004163794db79085b8b5f29d332591743d0f0000000100000020000000a707ed22d6bdb54352acbfeabb91d639de6a4d488ec3de2f0ca44e0089126b9f0300000001000000140000007f216b2802decf17863249e35d1b89e8a1350953140000000100000014000000aa0f505d48b2981c564e5f9f7ce4476fa0a208032000000001000000f9020000308202f5308201dda0030201020210065884d4ee2b906780a039c79b5ec47c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303733303035303030305a170d3239303732393035303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8c774dfe0cefc0ad685694a86245d74899aa394e24843b15dc1f37022f8c4704cc41a98ec7a40349fa9034a24ffe9f60753adc2bad9058f2cb20aff061566af5dd5ffbcbbd2e094d122bfdb2fc9ab5bee3baefa1301a11551dd81f166561b5a7befe29ea316e13e89f9dea4794bcb013dc513bcd69f9f91924973ba5bfa53e7e9aa549dbe82b82ab1769f3d044223ef4e87690f4f45a4a7bf9348cd4c5438d57c88e082c4b868f1704b7ef1b2a87a2319b6b42da929209a34c69940817d60b51fc0725fea480be5f2124814c0ca9a137d00f11f43d2a7b5d51fbafff6b7611f3a87af90e38f296a67fbe30307453187a7db65846a462cbaed878cddee8b729d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414aa0f505d48b2981c564e5f9f7ce4476fa0a20803300d06092a864886f70d01010b0500038201010047db14c1e40aa0b1d73d2aabed5fa72eebd20b95a5522c6c75df86074e1b6c5fd9e150222f875c89664a769ac6aebe4abebd69db9a9c07be4abfcb3bc11418f88cb7a05de356682aa2fc70331d82acb6ec7a1557e469918336332622541275ebc9eeb7c58ecc5555d0d6fb9f80498b25cc91d5ac58eda1d7a8a34a5eb5f0d6347ec19b491f46c526ad061054dd3698b16fdc76bee725899f55d7fecd62887014716ad0e77f26504bd63ee08b21f61043c77438b6739a424b78e2bad6ce1fbf225d0b5bc02e06c5287b529186eb238c4e3acf10fd7293af0a07e06804de2c3c73ba43d96fc119cdbcec1a3220523175932a943c6ffc75c9222211e8ae188e621e C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F216B2802DECF17863249E35D1B89E8A1350953\Blob = 1900000001000000100000006ec84ba57b4711e5d983345933d164ed140000000100000014000000aa0f505d48b2981c564e5f9f7ce4476fa0a208030300000001000000140000007f216b2802decf17863249e35d1b89e8a13509530f0000000100000020000000a707ed22d6bdb54352acbfeabb91d639de6a4d488ec3de2f0ca44e0089126b9f0400000001000000100000004163794db79085b8b5f29d332591743d2000000001000000f9020000308202f5308201dda0030201020210065884d4ee2b906780a039c79b5ec47c300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303733303035303030305a170d3239303732393035303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100b8c774dfe0cefc0ad685694a86245d74899aa394e24843b15dc1f37022f8c4704cc41a98ec7a40349fa9034a24ffe9f60753adc2bad9058f2cb20aff061566af5dd5ffbcbbd2e094d122bfdb2fc9ab5bee3baefa1301a11551dd81f166561b5a7befe29ea316e13e89f9dea4794bcb013dc513bcd69f9f91924973ba5bfa53e7e9aa549dbe82b82ab1769f3d044223ef4e87690f4f45a4a7bf9348cd4c5438d57c88e082c4b868f1704b7ef1b2a87a2319b6b42da929209a34c69940817d60b51fc0725fea480be5f2124814c0ca9a137d00f11f43d2a7b5d51fbafff6b7611f3a87af90e38f296a67fbe30307453187a7db65846a462cbaed878cddee8b729d0203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e04160414aa0f505d48b2981c564e5f9f7ce4476fa0a20803300d06092a864886f70d01010b0500038201010047db14c1e40aa0b1d73d2aabed5fa72eebd20b95a5522c6c75df86074e1b6c5fd9e150222f875c89664a769ac6aebe4abebd69db9a9c07be4abfcb3bc11418f88cb7a05de356682aa2fc70331d82acb6ec7a1557e469918336332622541275ebc9eeb7c58ecc5555d0d6fb9f80498b25cc91d5ac58eda1d7a8a34a5eb5f0d6347ec19b491f46c526ad061054dd3698b16fdc76bee725899f55d7fecd62887014716ad0e77f26504bd63ee08b21f61043c77438b6739a424b78e2bad6ce1fbf225d0b5bc02e06c5287b529186eb238c4e3acf10fd7293af0a07e06804de2c3c73ba43d96fc119cdbcec1a3220523175932a943c6ffc75c9222211e8ae188e621e C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\7F216B2802DECF17863249E35D1B89E8A1350953 C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2736 wrote to memory of 2808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2808 wrote to memory of 2780 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2808 wrote to memory of 2796 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2796 wrote to memory of 1808 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1484 wrote to memory of 2208 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1484 wrote to memory of 2208 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1484 wrote to memory of 2208 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1484 wrote to memory of 2208 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2208 wrote to memory of 2564 N/A C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\system32\taskeng.exe

taskeng.exe {657ED2C7-996C-4591-B858-6D319B0827B9} S-1-5-21-1385883288-3042840365-2734249351-1000:RPXOCQRF\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
N/A 100.115.238.188:443 api.2ip.ua tcp
N/A 100.115.238.188:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
N/A 100.66.62.91:80 asvb.top tcp
N/A 100.66.62.91:80 asvb.top tcp
N/A 100.66.62.91:80 asvb.top tcp
N/A 100.66.62.91:80 asvb.top tcp
N/A 100.66.62.91:80 asvb.top tcp
N/A 100.66.62.91:80 asvb.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
N/A 100.106.206.119:80 crl.microsoft.com tcp
N/A 100.115.238.188:443 api.2ip.ua tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

memory/2736-0-0x0000000000290000-0x0000000000322000-memory.dmp

memory/2736-1-0x0000000000290000-0x0000000000322000-memory.dmp

memory/2736-2-0x0000000001D40000-0x0000000001E5B000-memory.dmp

memory/2808-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2808-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2736-7-0x0000000000290000-0x0000000000322000-memory.dmp

memory/2808-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2808-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\37b74952-4979-4cf6-88d7-10a0b1915679\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

MD5 03851cdd1e543a7f09c0e4ade384bfd4
SHA1 342860ec1d18ac3b2cccd35ca2794d1db7c71353
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA512 4b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38

memory/2808-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2796-26-0x0000000000550000-0x00000000005E2000-memory.dmp

memory/2796-27-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/2796-31-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/1808-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-34-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 2b790979abbd6d342dbe94185b488e7f
SHA1 20c7c86f0dfa404b9c564e0ceecdd7e5ba863b6b
SHA256 19c031967ab7258bf6cd11767af0586048d46834bbd31b1a0bbb3b4576ddf20f
SHA512 b270ad7c4a6d6536431d73e9a4b8109b4c593a32e40a36436c91361286e13fe65a0531bb1850a03881cc8ef8291256f39167ff64b7f47efe8b2ad6d52c8afc9b

C:\Users\Admin\AppData\Local\Temp\Cab8B5E.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/1808-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-46-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\M7GT0RRO\get[1].php

MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a

memory/1808-64-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\bowsakkdestx.txt

MD5 c443b04d0fc26b0a5a4573a78e0082a1
SHA1 3c957535345645dce7190b85eb10b39da96b2518
SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3

memory/1808-75-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-76-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-79-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-78-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1808-80-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2208-96-0x00000000004E0000-0x0000000000572000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\TarAEE6.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2564-110-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 20:49

Reported

2024-08-27 20:53

Platform

win10v2004-20240802-en

Max time kernel

142s

Max time network

143s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\21f52e9b-6be6-4b87-884f-b0b80987f108\\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 4436 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2608 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2608 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2608 wrote to memory of 4300 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2608 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2608 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2608 wrote to memory of 3576 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3576 wrote to memory of 2448 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1400 wrote to memory of 548 N/A C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 2448 -ip 2448

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 2448 -s 568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe

"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4028,i,8231329449558834090,4540802069600791165,262144 --variations-seed-version --mojo-platform-channel-handle=4464 /prefetch:8

C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 241.179.69.100.in-addr.arpa udp
US 8.8.8.8:53 71.105.115.100.in-addr.arpa udp
US 8.8.8.8:53 126.151.117.100.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
N/A 100.69.13.193:443 g.bing.com tcp
N/A 100.69.13.193:443 g.bing.com tcp
N/A 100.69.13.193:443 g.bing.com tcp
US 8.8.8.8:53 api.2ip.ua udp
N/A 100.71.155.187:443 api.2ip.ua tcp
US 8.8.8.8:53 193.13.69.100.in-addr.arpa udp
US 8.8.8.8:53 187.155.71.100.in-addr.arpa udp
US 8.8.8.8:53 58.0.88.100.in-addr.arpa udp
US 8.8.8.8:53 57.133.74.100.in-addr.arpa udp
US 8.8.8.8:53 51.192.98.100.in-addr.arpa udp
US 8.8.8.8:53 198.181.84.100.in-addr.arpa udp
US 8.8.8.8:53 156.203.65.100.in-addr.arpa udp
US 8.8.8.8:53 168.159.89.100.in-addr.arpa udp
N/A 100.71.155.187:443 api.2ip.ua tcp

Files

memory/4436-1-0x00000000020E0000-0x0000000002179000-memory.dmp

memory/4436-2-0x0000000002270000-0x000000000238B000-memory.dmp

memory/2608-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\21f52e9b-6be6-4b87-884f-b0b80987f108\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

MD5 03851cdd1e543a7f09c0e4ade384bfd4
SHA1 342860ec1d18ac3b2cccd35ca2794d1db7c71353
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA512 4b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38

memory/2608-15-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3576-17-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/2448-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2448-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3576-23-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/2448-20-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1400-28-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/548-31-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 f905a5a284b48d1b1c856bb8f76e0e29
SHA1 30c8b864f90b1bc472be013eeaef2a1f3ca8eff0
SHA256 064c73a4a76601b4e4da9ce814648097a151cb93d01e593244d7b9634972c5ec
SHA512 9bc497fdef2f6322aa576c1a8cc2699d8983e0033d1bd6bfc04ad709c79e60f6ff8d4f2f5c61d3d9857f513b62019905e734b69c3226bfa3a52ab63ad676604f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a

memory/1400-38-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/548-39-0x0000000000400000-0x0000000000537000-memory.dmp