Malware Analysis Report

2024-10-23 16:21

Sample ID 240827-zp92wsshmm
Target 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5

Threat Level: Known bad

The file 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Checks computer location settings

Executes dropped EXE

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

Program crash

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-27 20:54

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-27 20:54

Reported

2024-08-27 20:57

Platform

win10v2004-20240802-en

Max time kernel

147s

Max time network

148s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\1fbca677-15b4-4d96-8037-15b726555c00\\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1472 wrote to memory of 1444 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1444 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 1444 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 1444 wrote to memory of 2376 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 1444 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1444 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1444 wrote to memory of 1960 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 1960 wrote to memory of 4212 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 3068 wrote to memory of 4088 N/A C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 4212 -ip 4212

C:\Windows\SysWOW64\WerFault.exe

C:\Windows\SysWOW64\WerFault.exe -u -p 4212 -s 576

C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 56.20.89.100.in-addr.arpa udp
US 8.8.8.8:53 116.16.105.100.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
N/A 100.101.96.156:443 api.2ip.ua tcp
US 8.8.8.8:53 195.148.82.100.in-addr.arpa udp
US 8.8.8.8:53 96.7.76.100.in-addr.arpa udp
US 8.8.8.8:53 156.96.101.100.in-addr.arpa udp
US 8.8.8.8:53 141.109.118.100.in-addr.arpa udp
US 8.8.8.8:53 115.95.88.100.in-addr.arpa udp
US 8.8.8.8:53 212.207.72.100.in-addr.arpa udp
N/A 100.101.96.156:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
N/A 100.108.23.168:80 asvb.top tcp
US 8.8.8.8:53 168.23.108.100.in-addr.arpa udp
N/A 100.108.23.168:80 asvb.top tcp

Files

memory/1472-1-0x00000000022B0000-0x000000000234A000-memory.dmp

memory/1472-2-0x0000000002380000-0x000000000249B000-memory.dmp

memory/1444-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1444-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1444-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1444-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\1fbca677-15b4-4d96-8037-15b726555c00\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

MD5 03851cdd1e543a7f09c0e4ade384bfd4
SHA1 342860ec1d18ac3b2cccd35ca2794d1db7c71353
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA512 4b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38

memory/1444-15-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1960-17-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/1960-23-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/4212-22-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4212-20-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4212-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3068-28-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/3068-31-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/4088-32-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 5b045add04923ff48febe55c8e372772
SHA1 919ec08e539f4611cae0dd7bd78d338f08508fe7
SHA256 6e827245c328cd41cf5d3ebe040e551da3dfec3b7f1f253cbe5f7edc9e3eebc1
SHA512 631ecc824e926d56962f2fe401390b1adbfa339dbae4ade2b4b8cb6bef62e5d00796892ca9b0e7ddb79864bf3c52eb6a0e44917596df8e2c5dead627d260684f

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157

MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a

memory/4088-39-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-27 20:54

Reported

2024-08-27 20:57

Platform

win7-20240704-en

Max time kernel

146s

Max time network

147s

Command Line

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06DD8E1A3A114F22E5F86E60C7A11A45F03985DC\Blob = 190000000100000010000000473845a003022efd16f3b8a36ba751961400000001000000140000001fe54b926b75ae9ef0f973d61166fdc9999cf0ea03000000010000001400000006dd8e1a3a114f22e5f86e60c7a11a45f03985dc0f0000000100000020000000a234e7e0daaae824c4b1557e32b325062303f68597b2d72fece4cee4b24cf4890400000001000000100000006f748432af934053377acbedecafe4402000000001000000f9020000308202f5308201dda00302010202104a31dfa8a1a85e104ebef0b98048ede2300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303731383134303030305a170d3239303731373134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a04f8185bc9a542614d79044f46556927f67402787c01e5b70156054211ff39a86e14bb4ce382cea9a3cafa38151e3a28a6bc1c86230c0baa295e84eb8adea85569c663602eadd79d0c1001fe3e631b33cdf6ede40d39d959c36e0db8e31e834e701f3ad23216e3f1be8a211553c7f464782d0716612a437c86af62e763d9e16858349647c6907f67517001e5bac835bec785b19408e0486cc0d8afbb6c1b2ddfb70fa124b860b266b40c91f84e2e62ff01be5c5cb5c409c3bce5d89e019116d0db2105f34adefc60e539329248d070cd1aaae3b02cce4ae536c06222d9d9b04ee7e99779ecff930f81cc39ae3307f27b0fe21af4ac95cfd161b0780737aa9390203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141fe54b926b75ae9ef0f973d61166fdc9999cf0ea300d06092a864886f70d01010b050003820101005c6b19309633101074edd9e0e33dca90a647359f05cb21232ab96847edd8f30db0aa92a971d8354b1619c4d4a0b531c76636d943536aee51fcb5c7a3c9e9478831b2dec9c84781d03d5f28902209b8c6f311b7eb68d3dcd1ba86d71a6fa9d8218e487181e03e73b1c54ecec7af9d71371a04a955caca2c3e4133c646aebedb388f8806618b700eb30f4abd4329689a3e8bf0c83ec10e9ef4fe23912c3e49d7c4b4f914dcd2430a53c820819848fa85ce264656a6e20ee8dfbd9bff64ee493b2a54189ebeab456439185f9a80cdd9b2d48e77e07d9e7c9573cfeaf1b783709a26cd1eb346858d1b6157af3f5d77d20e4df0fdac4232ee6f236489cc28e7c9d7e1 C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06DD8E1A3A114F22E5F86E60C7A11A45F03985DC C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06DD8E1A3A114F22E5F86E60C7A11A45F03985DC\Blob = 0f0000000100000020000000a234e7e0daaae824c4b1557e32b325062303f68597b2d72fece4cee4b24cf48903000000010000001400000006dd8e1a3a114f22e5f86e60c7a11a45f03985dc2000000001000000f9020000308202f5308201dda00302010202104a31dfa8a1a85e104ebef0b98048ede2300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303731383134303030305a170d3239303731373134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a04f8185bc9a542614d79044f46556927f67402787c01e5b70156054211ff39a86e14bb4ce382cea9a3cafa38151e3a28a6bc1c86230c0baa295e84eb8adea85569c663602eadd79d0c1001fe3e631b33cdf6ede40d39d959c36e0db8e31e834e701f3ad23216e3f1be8a211553c7f464782d0716612a437c86af62e763d9e16858349647c6907f67517001e5bac835bec785b19408e0486cc0d8afbb6c1b2ddfb70fa124b860b266b40c91f84e2e62ff01be5c5cb5c409c3bce5d89e019116d0db2105f34adefc60e539329248d070cd1aaae3b02cce4ae536c06222d9d9b04ee7e99779ecff930f81cc39ae3307f27b0fe21af4ac95cfd161b0780737aa9390203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141fe54b926b75ae9ef0f973d61166fdc9999cf0ea300d06092a864886f70d01010b050003820101005c6b19309633101074edd9e0e33dca90a647359f05cb21232ab96847edd8f30db0aa92a971d8354b1619c4d4a0b531c76636d943536aee51fcb5c7a3c9e9478831b2dec9c84781d03d5f28902209b8c6f311b7eb68d3dcd1ba86d71a6fa9d8218e487181e03e73b1c54ecec7af9d71371a04a955caca2c3e4133c646aebedb388f8806618b700eb30f4abd4329689a3e8bf0c83ec10e9ef4fe23912c3e49d7c4b4f914dcd2430a53c820819848fa85ce264656a6e20ee8dfbd9bff64ee493b2a54189ebeab456439185f9a80cdd9b2d48e77e07d9e7c9573cfeaf1b783709a26cd1eb346858d1b6157af3f5d77d20e4df0fdac4232ee6f236489cc28e7c9d7e1 C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06DD8E1A3A114F22E5F86E60C7A11A45F03985DC\Blob = 1400000001000000140000001fe54b926b75ae9ef0f973d61166fdc9999cf0ea03000000010000001400000006dd8e1a3a114f22e5f86e60c7a11a45f03985dc0f0000000100000020000000a234e7e0daaae824c4b1557e32b325062303f68597b2d72fece4cee4b24cf4892000000001000000f9020000308202f5308201dda00302010202104a31dfa8a1a85e104ebef0b98048ede2300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303731383134303030305a170d3239303731373134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a04f8185bc9a542614d79044f46556927f67402787c01e5b70156054211ff39a86e14bb4ce382cea9a3cafa38151e3a28a6bc1c86230c0baa295e84eb8adea85569c663602eadd79d0c1001fe3e631b33cdf6ede40d39d959c36e0db8e31e834e701f3ad23216e3f1be8a211553c7f464782d0716612a437c86af62e763d9e16858349647c6907f67517001e5bac835bec785b19408e0486cc0d8afbb6c1b2ddfb70fa124b860b266b40c91f84e2e62ff01be5c5cb5c409c3bce5d89e019116d0db2105f34adefc60e539329248d070cd1aaae3b02cce4ae536c06222d9d9b04ee7e99779ecff930f81cc39ae3307f27b0fe21af4ac95cfd161b0780737aa9390203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141fe54b926b75ae9ef0f973d61166fdc9999cf0ea300d06092a864886f70d01010b050003820101005c6b19309633101074edd9e0e33dca90a647359f05cb21232ab96847edd8f30db0aa92a971d8354b1619c4d4a0b531c76636d943536aee51fcb5c7a3c9e9478831b2dec9c84781d03d5f28902209b8c6f311b7eb68d3dcd1ba86d71a6fa9d8218e487181e03e73b1c54ecec7af9d71371a04a955caca2c3e4133c646aebedb388f8806618b700eb30f4abd4329689a3e8bf0c83ec10e9ef4fe23912c3e49d7c4b4f914dcd2430a53c820819848fa85ce264656a6e20ee8dfbd9bff64ee493b2a54189ebeab456439185f9a80cdd9b2d48e77e07d9e7c9573cfeaf1b783709a26cd1eb346858d1b6157af3f5d77d20e4df0fdac4232ee6f236489cc28e7c9d7e1 C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\ROOT\Certificates\06DD8E1A3A114F22E5F86E60C7A11A45F03985DC\Blob = 0400000001000000100000006f748432af934053377acbedecafe4400f0000000100000020000000a234e7e0daaae824c4b1557e32b325062303f68597b2d72fece4cee4b24cf48903000000010000001400000006dd8e1a3a114f22e5f86e60c7a11a45f03985dc1400000001000000140000001fe54b926b75ae9ef0f973d61166fdc9999cf0ea2000000001000000f9020000308202f5308201dda00302010202104a31dfa8a1a85e104ebef0b98048ede2300d06092a864886f70d01010b050030133111300f06035504031308436c6f75644e6574301e170d3234303731383134303030305a170d3239303731373134303030305a30133111300f06035504031308436c6f75644e657430820122300d06092a864886f70d01010105000382010f003082010a0282010100a04f8185bc9a542614d79044f46556927f67402787c01e5b70156054211ff39a86e14bb4ce382cea9a3cafa38151e3a28a6bc1c86230c0baa295e84eb8adea85569c663602eadd79d0c1001fe3e631b33cdf6ede40d39d959c36e0db8e31e834e701f3ad23216e3f1be8a211553c7f464782d0716612a437c86af62e763d9e16858349647c6907f67517001e5bac835bec785b19408e0486cc0d8afbb6c1b2ddfb70fa124b860b266b40c91f84e2e62ff01be5c5cb5c409c3bce5d89e019116d0db2105f34adefc60e539329248d070cd1aaae3b02cce4ae536c06222d9d9b04ee7e99779ecff930f81cc39ae3307f27b0fe21af4ac95cfd161b0780737aa9390203010001a3453043300e0603551d0f0101ff04040302010630120603551d130101ff040830060101ff020101301d0603551d0e041604141fe54b926b75ae9ef0f973d61166fdc9999cf0ea300d06092a864886f70d01010b050003820101005c6b19309633101074edd9e0e33dca90a647359f05cb21232ab96847edd8f30db0aa92a971d8354b1619c4d4a0b531c76636d943536aee51fcb5c7a3c9e9478831b2dec9c84781d03d5f28902209b8c6f311b7eb68d3dcd1ba86d71a6fa9d8218e487181e03e73b1c54ecec7af9d71371a04a955caca2c3e4133c646aebedb388f8806618b700eb30f4abd4329689a3e8bf0c83ec10e9ef4fe23912c3e49d7c4b4f914dcd2430a53c820819848fa85ce264656a6e20ee8dfbd9bff64ee493b2a54189ebeab456439185f9a80cdd9b2d48e77e07d9e7c9573cfeaf1b783709a26cd1eb346858d1b6157af3f5d77d20e4df0fdac4232ee6f236489cc28e7c9d7e1 C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2320 wrote to memory of 2316 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2316 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2316 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2316 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2316 wrote to memory of 2920 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Windows\SysWOW64\icacls.exe
PID 2316 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2316 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2316 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2316 wrote to memory of 2908 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2908 wrote to memory of 2632 N/A C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2540 wrote to memory of 2508 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2540 wrote to memory of 2508 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2540 wrote to memory of 2508 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2540 wrote to memory of 2508 N/A C:\Windows\system32\taskeng.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe
PID 2508 wrote to memory of 2544 N/A C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

Processes

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

"C:\Users\Admin\AppData\Local\Temp\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe" --Admin IsNotAutoStart IsNotTask

C:\Windows\system32\taskeng.exe

taskeng.exe {145B9876-3536-40B4-8557-FEA7B9E8A63B} S-1-5-21-3434294380-2554721341-1919518612-1000:ELZYPTFV\Admin:Interactive:[1]

C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe --Task

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
N/A 100.91.162.91:443 api.2ip.ua tcp
N/A 100.91.162.91:443 api.2ip.ua tcp
US 8.8.8.8:53 asvb.top udp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
N/A 100.91.213.206:80 asvb.top tcp
US 8.8.8.8:53 crl.microsoft.com udp
N/A 100.91.148.46:80 crl.microsoft.com tcp
N/A 100.91.162.91:443 api.2ip.ua tcp
US 8.8.8.8:53 www.microsoft.com udp

Files

memory/2320-0-0x00000000002B0000-0x0000000000342000-memory.dmp

memory/2320-1-0x00000000002B0000-0x0000000000342000-memory.dmp

memory/2320-2-0x0000000001D80000-0x0000000001E9B000-memory.dmp

memory/2316-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2316-9-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2320-8-0x00000000002B0000-0x0000000000342000-memory.dmp

memory/2316-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2316-7-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\151b2b02-b4da-4fd9-b79c-cba6a974c2dc\225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5.exe

MD5 03851cdd1e543a7f09c0e4ade384bfd4
SHA1 342860ec1d18ac3b2cccd35ca2794d1db7c71353
SHA256 225e8043b4cbb1f5e64f800dce016c8dffe803bae5c596eb62bfe2cb5dac2de5
SHA512 4b6ed235558eeeffac123b707d5d9cb1af448c83162e75051459f8f9eb85cfdb9df903460faf22279df5497efab9c747fa8f1588f38312a7a364a363a3e91b38

memory/2316-23-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2908-24-0x0000000000250000-0x00000000002E2000-memory.dmp

memory/2908-25-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/2632-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2908-30-0x0000000000400000-0x00000000004DD000-memory.dmp

memory/2632-32-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\CabE234.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2632-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-42-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\84EXSCRK\updatewin1[1].exe

MD5 8a80554c91d9fca8acb82f023de02f11
SHA1 5f36b2ea290645ee34d943220a14b54ee5ea5be5
SHA256 ca3d163bab055381827226140568f3bef7eaac187cebd76878e0b63e9e442356
SHA512 ca4b6defb8adcc010050bc8b1bb8f8092c4928b8a0fba32146abcfb256e4d91672f88ca2cdf6210e754e5b8ac5e23fb023806ccd749ac8b701f79a691f03c87a

memory/2632-66-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\bowsakkdestx.txt

MD5 c443b04d0fc26b0a5a4573a78e0082a1
SHA1 3c957535345645dce7190b85eb10b39da96b2518
SHA256 e3566b3a06430868d71e9287dfd6c6c520a3da027aabea01951d407ee131dc2f
SHA512 7bbf6dac485c9e59d02edabc91ff5b15bc1319cef6905c0077ee16e3b1f572b61bff85f2400bc0f5b4aeab0260bd5d68787d72c7a688d79192952f7957a44de3

memory/2632-90-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-91-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-87-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-92-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2632-100-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2508-115-0x0000000000550000-0x00000000005E2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Tar501.tmp

MD5 4ea6026cf93ec6338144661bf1202cd1
SHA1 a1dec9044f750ad887935a01430bf49322fbdcb7
SHA256 8efbc21559ef8b1bcf526800d8070baad42474ce7198e26fa771dbb41a76b1d8
SHA512 6c7e0980e39aacf4c3689802353f464a08cd17753bd210ee997e5f2a455deb4f287a9ef74d84579dbde49bc96213cd2b8b247723919c412ea980aa6e6bfe218b

memory/2544-132-0x0000000000400000-0x0000000000537000-memory.dmp