bdaejec | 02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 10:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Size 797KB
Sample260809-mnp9waaa87
SHA256 02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457
MD5 135fa780592dbc9a794897d3afa33617
SHA1 94f87dd8f65d376048cdf87e3ea5b392acdbe4b7
SHA512 584b283c51846a122457b03cf981e0241a41cb1da7c86f56fa83ae81483a7415efd7c40434fc310358448860bdf991cc1a7839e64431f957be42d0ee29d0daf2
SSDEEP 12288:z+gg5In1ab4il+xSp+sqKXOo7RqBeUdvWz67OrkRxqkJ2R6Te5HoZ6x:qgg5e1q4il+xA+sn+TB7WRkJ2pdoZ
TLSH
T19C0512617A50E0B3C46B25B0A459CAA1AD6FB8325737810B3BA1073E0F513D5E97BB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

aspackv2 backdoor discovery execution bdaejec djvu persistence ransomware

Malware Config

Extracted

Family

djvu

http://fuyt.org/fhsgtsspen6/get.php

Attributes

extension
.bpqd
offline_id
y6oQcfhmSRc7ZQ1q8yjLE3LhY8kK7FHg6LLlEht1
payload_url
http://zerit.top/dl/build2.exe

http://fuyt.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-zHDj26n4NW Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0418Jsfkjn

rsa_pubkey.plain

Extracted

Family

bdaejec

ddos.dnsnb8.net

Signatures

Family: Bdaejec
Bdaejec is a backdoor written in C++.
backdoor bdaejec
Family: Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Detected Djvu ransomware 19 IoCs

resource	yara_rule
behavioral1/memory/1980-9-0x0000000002210000-0x000000000232B000-memory.dmp	family_djvu
behavioral1/memory/4660-10-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4660-12-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4660-14-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4660-11-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4660-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4996-41-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4996-52-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-55-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-64-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-65-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-70-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-72-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-73-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-74-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1036-76-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Detects Bdaejec Backdoor. 1 IoCs

Bdaejec is backdoor written in C++.

resource	yara_rule
behavioral1/memory/3360-15-0x00000000004C0000-0x00000000004C9000-memory.dmp	family_bdaejec_backdoor

ASPack v2.12-2.42 1 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x001a0000000242f7-3.dat	aspack_v212_v242

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key value queried	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\Control Panel\International\Geo\Nation	cXHjoH.exe

Executes dropped EXE 3 IoCs

pid	Process
3360	cXHjoH.exe
2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
4996	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4876	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d66df036-081a-4571-9a87-82c7d150db5d\\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe\" --AutoStart"	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
5	api.2ip.ua
39	api.2ip.ua
40	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 760 set thread context of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 2352 set thread context of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmic.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxIdentityProvider_12.50.6001.0_x64__8wekyb3d8bbwe\XboxIdp.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javaw.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\codecpacks.webp.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\wsgen.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\orbd.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\policytool.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\rmid.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Windows Mail\wab.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\codecpacks.heif.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_11811.1001.18.0_x64__8wekyb3d8bbwe\StoreExperienceHost.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\codecpacks.VP9.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\java.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WINWORD.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\chrmstp.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\xjc.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\jabswitch.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\javacpl.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\kinit.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\GetHelp.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Wallet_2.4.18324.0_x64__8wekyb3d8bbwe\Microsoft.Wallet.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\POWERPNT.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\DW\DWTRIG20.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\onenoteim.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.549981C3F5F10_1.1911.21713.0_x64__8wekyb3d8bbwe\Win32Bridge.Server.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\View3D.ResourceResolver.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Xbox.TCUI_1.23.28002.0_x64__8wekyb3d8bbwe\TCUI-App.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\ktab.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\policytool.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\AppSharingHookController.exe	cXHjoH.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc-cache-gen.exe	cXHjoH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroBroker.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\MSOHTMED.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\maintenanceservice_installer.exe	cXHjoH.exe
File opened for modification	C:\Program Files\7-Zip\7zG.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javapackager.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\bin\ssvagent.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\NAMECONTROLSERVER.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\javaw.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\rmiregistry.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\java-rmi.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\OSPPREARM.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\FLTLDR.EXE	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\fmui\fmui.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\msoadfsb.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\protocolhandler.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Mozilla Firefox\plugin-container.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstallerPythonRedirector.exe	cXHjoH.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\wow_helper.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBridge\SkypeBridge.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\chrome_proxy.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jre-1.8\bin\servertool.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppInstaller.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Mashup.Container.NetFX45.exe	cXHjoH.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\vlc.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.19071.19011.0_x64__8wekyb3d8bbwe\Video.UI.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Google\Chrome\Application\140.0.7339.81\os_update_handler.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.4.8204.0_x64__8wekyb3d8bbwe\Solitaire.exe	cXHjoH.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe	cXHjoH.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.SkypeApp_14.53.77.0_x64__kzf8qxf38zg5c\SkypeBackgroundHost.exe	cXHjoH.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 1 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3760	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 9 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cXHjoH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4660	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
4660	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
4996	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
4996	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
1036	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
1036	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 1980 wrote to memory of 3360	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	86
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 1980 wrote to memory of 4660	1980	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	87
PID 4660 wrote to memory of 4876	4660	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	97
PID 4660 wrote to memory of 760	4660	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	98
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 760 wrote to memory of 1036	760	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	102
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 2352 wrote to memory of 4996	2352	02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe	103
PID 3360 wrote to memory of 3760	3360	cXHjoH.exe	105

C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
"C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980
- C:\Users\Admin\AppData\Local\Temp\cXHjoH.exe
  C:\Users\Admin\AppData\Local\Temp\cXHjoH.exe
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3360
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\7ceb0910.bat" "
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3760
- C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
  "C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4660
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    - System Location Discovery: System Language Discovery
    PID:4876
- - C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
    "C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:760
  - - C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
      "C:\Users\Admin\AppData\Local\Temp\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious behavior: EnumeratesProcesses
      PID:1036

C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
  C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

70825F0EABF2526E540CA0F7C268D189

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\70825F0EABF2526E540CA0F7C268D189
Size 308B
SHA256 014cd77af7abbeaaaeb6c2b45eef2081713ca4a1b6fe5039939e7e2d84bf60e3
MD5 9c5693b0aa88551812dfa3b332361b52
SHA1 e79a302339569b4c7abb80e7e6fda1453ff19568
SHA512 215ec0c2308d60438eda784c81a168a749d4adf5482e715cf4116f4c559195f7e3430fcb9b769551c83f3e1b194870c5a290e9ee64837a89434a06a57fc76379
TLSH
T147E07248AA7F279217F0E104F890CC675CFCE0A2179EB0808B50C72504D3A44EC422CE
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

70825F0EABF2526E540CA0F7C268D189

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\70825F0EABF2526E540CA0F7C268D189
Size 192B
SHA256 da2e08c9842c705a2844f2011d50c86ed40b2072f8fa25338b66a17d4d3213dc
MD5 26264be07b8bd0f9141f7635414c48cf
SHA1 5fe3f432b845abf60d8025dc9f70654e4309c81b
SHA512 93efb65966c06d8e94a676002dcd1d9754b1e3865c649bdbdc1569443cd03156c69c8189ed089474d3610646d4209b1570f046bbe267b11d7eff6f92321fa741
TLSH
T1FBC08C2032301616E1982A7E59A5B7025BB9B22AC202C78E2B700748BB4D9214C61E04
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 5912901c46b0e5e10eef65d535f0d8e8bea8457543716866c3250d051836a958
MD5 eee7e5f575ed2b314096bf40cfe5ce27
SHA1 e13135f2b88c168c2111591890e580ec75ab7ea8
SHA512 3a5ba70fbe51a06b6855caff58cbb358a81f62764d7cfe9ef75ade151dd57277b56abbe71e0ef8e90c17c406aa590c93e7551984ba7383c06befb64de25a0f83
TLSH
T157C08C0437B10155F1304D7F0A5293014BBAE1018D4183040F302218811DA0248A0D02
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 bd013de0f5fb128ee2675f2c150be6a79fc133b249ba7ba0cd640b0939900610
MD5 df161c18e7b5a5528a3bb8a0ffe266df
SHA1 64a631bb0aa18a82c45c224848f2823ec4c820c8
SHA512 eb70206d84a78e1b48117fd7258d923a2feec4f1812937b64eb400a8c1b957e21bbc67c39c076fa8499e520b6a369ef21fba4696dbb914f2f840a929eb4d1cf5
TLSH
T104C09214B3B98B1AF10E613E7DE61A041BBA920AF6CAC3044BB812388928A404CB2D09
MD5 SHA1 SHA512 TLSH

Submit Download

7ceb0910.bat

Path C:\Users\Admin\AppData\Local\Temp\7ceb0910.bat
Size 187B
SHA256 878777d127cba35ea2b49503591bd2394265627a89a88095798caac5eb3f8805
MD5 9b63d5d1a8a3c0e34f18daec5ede1dc4
SHA1 ecd222bd2f67a08b39f853a5b06985e7396896d7
SHA512 77c753f773300068375d25c5641e3a0e0bae60383f2b63e132d9ccf12db78cb10d325c1d47cca8713f3b77aa0f29bc7e6e8eec5f1b954cf1bd10dc7397d36fff
TLSH
T17AC01201C286CB5D5465901717F1615CC0650CDD3BA92B214F20845C71D6D2EB5D7742
MD5 SHA1 SHA512 TLSH

Submit Download

cXHjoH.exe

Path C:\Users\Admin\AppData\Local\Temp\cXHjoH.exe
Size 15KB
SHA256 4485df22c627fa0bb899d79aa6ff29bc5be1dbc3caa2b7a490809338d54b7794
MD5 f7d21de5c4e81341eccd280c11ddcc9a
SHA1 d4e9ef10d7685d491583c6fa93ae5d9105d815bd
SHA512 e4553b86b083996038bacfb979ad0b86f578f95185d8efac34a77f6cc73e491d4f70e1449bbc9eb1d62f430800c1574101b270e1cb0eeed43a83049a79b636a3
SSDEEP 384:IXZQaD7U8iu4YsAa7ZA0UvH2lsRv21yW7GbAxur6+Y9PffPz:gQGPL4vzZq2o9W7GsxBbPr
TLSH
T1A462BFB34FC098FFC4CD353341853687CB7B4670DABA617F826288372895E19AC55495
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe

Path C:\Users\Admin\AppData\Local\d66df036-081a-4571-9a87-82c7d150db5d\02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457.exe
Size 797KB
SHA256 02f9c72d0b1cc241e46cd2b65e8ec63a233dead29e44c739a5bb3860a654d457
MD5 135fa780592dbc9a794897d3afa33617
SHA1 94f87dd8f65d376048cdf87e3ea5b392acdbe4b7
SHA512 584b283c51846a122457b03cf981e0241a41cb1da7c86f56fa83ae81483a7415efd7c40434fc310358448860bdf991cc1a7839e64431f957be42d0ee29d0daf2
SSDEEP 12288:z+gg5In1ab4il+xSp+sqKXOo7RqBeUdvWz67OrkRxqkJ2R6Te5HoZ6x:qgg5e1q4il+xA+sn+TB7WRkJ2pdoZ
TLSH
T19C0512617A50E0B3C46B25B0A459CAA1AD6FB8325737810B3BA1073E0F513D5E97BB4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/760-28-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/760-38-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/760-33-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/1036-35-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-72-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-64-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-63-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-37-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-70-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-65-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-76-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-73-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-74-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1036-55-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1980-13-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/1980-0-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/1980-9-0x0000000002210000-0x000000000232B000-memory.dmp

Download

memory/1980-8-0x0000000002170000-0x000000000220C000-memory.dmp

Download

memory/2352-42-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/2352-31-0x0000000000400000-0x00000000004F9000-memory.dmp

Download

memory/3360-4-0x00000000004C0000-0x00000000004C9000-memory.dmp

Download

memory/3360-15-0x00000000004C0000-0x00000000004C9000-memory.dmp

Download

memory/4660-12-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4660-10-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4660-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4660-14-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4660-11-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4996-52-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4996-41-0x0000000000400000-0x0000000000537000-memory.dmp

Download