Malware Analysis Report

2024-10-23 16:21

Sample ID 240828-z8yszayekq
Target 66ae9cc050ded_file0308.exe
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1

Threat Level: Known bad

The file 66ae9cc050ded_file0308.exe was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

System Location Discovery: System Language Discovery

Enumerates physical storage devices

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-28 21:23

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-28 21:23

Reported

2024-08-28 21:26

Platform

win7-20240708-en

Max time kernel

142s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-940600906-3464502421-4240639183-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a8da35b4-dfd8-4223-b2b2-5a5b0a343abc\\66ae9cc050ded_file0308.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1940 wrote to memory of 2764 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2764 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 2764 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 2764 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 2764 wrote to memory of 2804 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 2764 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2764 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2764 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2764 wrote to memory of 2720 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 2720 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\a8da35b4-dfd8-4223-b2b2-5a5b0a343abc" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 216.58.201.99:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
MX 201.110.232.60:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.80:80 crl.microsoft.com tcp

Files

memory/1940-0-0x0000000001BF0000-0x0000000001C82000-memory.dmp

memory/1940-1-0x0000000001BF0000-0x0000000001C82000-memory.dmp

memory/1940-5-0x0000000001C90000-0x0000000001DAB000-memory.dmp

memory/1940-7-0x0000000001BF0000-0x0000000001C82000-memory.dmp

memory/2764-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2764-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2764-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2764-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\a8da35b4-dfd8-4223-b2b2-5a5b0a343abc\66ae9cc050ded_file0308.exe

MD5 d7528cd33b73718b5949277420681f90
SHA1 61d97f8da20ff2995890ce5f2c8a2c9e6e51c078
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
SHA512 b3dab709e19a2a8bad92b259ea1739ad55564f6fe31e9f4e502b6280ae6c70cdf5a0f1fda208887da4bbcf9213986e2038abe6a09dc2940998df08d82e87d474

memory/2764-31-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2720-32-0x00000000002B0000-0x0000000000342000-memory.dmp

memory/2720-33-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/2720-37-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/2608-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-40-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 1ac2b5da0b72ece05ef62d6e8ef5242a
SHA1 50f781c32ef5edf1ad0f608ea0bae6164c56e2e2
SHA256 fcd1d28e564e80350a2c25869ff4fc7ae7278d49de72d790f8ef37dbabc51c65
SHA512 372572df336783febe1b3474382d04eb2dbb4c2d015c10d8e7159cda280e8200aad548000f5977ac6cfcd95f2a5ef9aed654ceeb7121effda33bff6fc51435c6

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 fe3261c29fcb1f166caaa3ee4abe54f4
SHA1 2e34a601df51740f8a6752f257b3ca6ba044ca17
SHA256 a0fb2cbc49725fa1795810a620019897fca4d89dc02011e482e3200b9093547b
SHA512 04bdeded342e17119f371f84e9f54059376229ea72f7e85ce54db8d1d58b71f19f7c708d156db0a61810114f585e87821290fb867eb2ab35480688e2b99624b0

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 009ea54be1854438350276b3338e0848
SHA1 783d8e4616d2d24e875a86af7e8d847df14db185
SHA256 a7c0be36b65f8ab2b1fbc3af12b3ae1ff992d300540a5dd146e1a0689e8082de
SHA512 e917668341e5d8d0dde98dee0bb57f5671f29057164b1d379d4e6c4a7ade43ce5a4768ddcece8569cba53c9b1a809dc37a2133702d98474311a218bfdde2940d

C:\Users\Admin\AppData\Local\Temp\Cab84AA.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2608-56-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-57-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-61-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-63-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2608-64-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1940-65-0x0000000001C90000-0x0000000001DAB000-memory.dmp

memory/2608-66-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-28 21:23

Reported

2024-08-28 21:26

Platform

win10v2004-20240802-en

Max time kernel

145s

Max time network

126s

Command Line

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\104fba20-92d9-414c-a5e4-0eb4965c0931\\66ae9cc050ded_file0308.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 4840 wrote to memory of 1460 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1460 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 1460 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 1460 wrote to memory of 740 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Windows\SysWOW64\icacls.exe
PID 1460 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1460 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 1460 wrote to memory of 428 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe
PID 428 wrote to memory of 1028 N/A C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

Processes

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\104fba20-92d9-414c-a5e4-0eb4965c0931" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe

"C:\Users\Admin\AppData\Local\Temp\66ae9cc050ded_file0308.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 150.171.27.10:443 g.bing.com tcp
US 8.8.8.8:53 217.106.137.52.in-addr.arpa udp
US 8.8.8.8:53 1.208.79.178.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
GB 216.58.201.99:80 c.pki.goog tcp
US 8.8.8.8:53 99.201.58.216.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
MX 201.110.232.60:80 cajgtus.com tcp
US 8.8.8.8:53 60.232.110.201.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 196.249.167.52.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 198.187.3.20.in-addr.arpa udp
US 8.8.8.8:53 147.142.123.92.in-addr.arpa udp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp
US 150.171.27.10:443 tse1.mm.bing.net tcp

Files

memory/4840-1-0x00000000020D0000-0x0000000002169000-memory.dmp

memory/4840-2-0x0000000002170000-0x000000000228B000-memory.dmp

memory/1460-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1460-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1460-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1460-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\104fba20-92d9-414c-a5e4-0eb4965c0931\66ae9cc050ded_file0308.exe

MD5 d7528cd33b73718b5949277420681f90
SHA1 61d97f8da20ff2995890ce5f2c8a2c9e6e51c078
SHA256 3b8d07693e296aee36e7607c71503d981396a21b367e169146afdd052cdcf4d1
SHA512 b3dab709e19a2a8bad92b259ea1739ad55564f6fe31e9f4e502b6280ae6c70cdf5a0f1fda208887da4bbcf9213986e2038abe6a09dc2940998df08d82e87d474

memory/1460-19-0x0000000000400000-0x0000000000537000-memory.dmp

memory/428-21-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/1028-23-0x0000000000400000-0x0000000000537000-memory.dmp

memory/428-25-0x0000000000400000-0x00000000004CA000-memory.dmp

memory/1028-24-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-26-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 90c9a980eae27b6fa3331953fe0f39ed
SHA1 4d52e70ab4faebadd6e843cef97a0407424d8082
SHA256 7502b51f62042aeafecdbe9d8566a04ae1a862fa3762017b9e595fc409362b78
SHA512 2bdcde04d62ba58a1cdcac23a90a69e1ece7d854c47696041ef5b9b9c79a3685a9c6c1c3ca2b5e0b518298f4f3479bc17a23e878f7f9e2c758a66d0f8c5d7ba3

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 e988ef96d46ab3e84fb127fdc22beeb8
SHA1 24fd41282457139ee6b7b3c06d587869fd2146ef
SHA256 e0cb5c14df8cf573ce5998451f780c8563900b5c016a6d0f691f8c12a2edc497
SHA512 62730b17bef90bc345b8c8908c825eee6423346b25cfff50731e47b6ce05ef551ebdf2f9821e780be97c38edd3e9df2908e89b7a54e467adea8648e70240a003

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

memory/1028-33-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-34-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-42-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-39-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1028-44-0x0000000000400000-0x0000000000537000-memory.dmp