Play interactive tour

Edit tour

Windows Analysis Report ZZGJ1bZClw.exe

Overview

General Information

Sample Name:	ZZGJ1bZClw.exe
Analysis ID:	490787
MD5:	dc42dd95ce4017c9984f759a77788bec
SHA1:	f4d4796f4d49138a4cafa8a86a47db14ae322dbc
SHA256:	f5928b4b67f399e11ece2de04588730b5891105ab72add45c7a9ff1fc3d961b7
Tags:	exeRansomwareStop
Infos:
Most interesting Screenshot:

Detection

Djvu

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Multi AV Scanner detection for submitted file

Detected unpacking (overwrites its own PE header)

Yara detected Djvu Ransomware

Detected unpacking (changes PE section rights)

Multi AV Scanner detection for dropped file

Machine Learning detection for sample

Injects a PE file into a foreign processes

Contains functionality to inject code into remote processes

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses 32bit PE files

Yara signature match

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Found potential string decryption / allocating functions

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

JA3 SSL client fingerprint seen in connection with other malware

Contains functionality to call native functions

Contains functionality to dynamically determine API calls

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains functionality for execution timing, often used to detect debuggers

Creates a DirectInput object (often for capturing keystrokes)

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Uses cacls to modify the permissions of files

Contains functionality to launch a program with higher privileges

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Uses Microsoft's Enhanced Cryptographic Provider

Contains functionality to query network adapater information

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

ZZGJ1bZClw.exe (PID: 6900 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6604 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' MD5: DC42DD95CE4017C9984F759A77788BEC)

icacls.exe (PID: 6436 cmdline: icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: FF0D1D4317A44C951240FAE75075D501)

ZZGJ1bZClw.exe (PID: 7064 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6792 cmdline: 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 600 cmdline: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 6632 cmdline: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 2932 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 992 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 7160 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

ZZGJ1bZClw.exe (PID: 5848 cmdline: 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart MD5: DC42DD95CE4017C9984F759A77788BEC)

cleanup

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://securebiz.org/dl/build2.exe", "http://wrrst.top/files/1/build3.exe"], "C2 url": "http://wrrst.top/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-J0DxAGRqKO\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nmanagerhelper@airmail.cc\r\n\r\nYour personal ID:\r\n0334gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEArYJyPCdGXOHid5eRLZKu\\\\nENptbpVJMEM6G4BWw0nZYRXqRcd8Eb\\/3wUMhIoEQPkSKUXomQ3kizWBjBXWIGfQj\\\\n7MlW+meuXudxwQKT1RgulOB1NqJRO6Cl7t4i2o5N76gvBnWLr+MGAgrXSlNt9j91\\\\n6ML3VoblAdI2UKfFllBhVjK96cSfX4ppCnJvzCsUV7KeEbzadqZxnsQ5c9G1yx5N\\\\nkpsZlWLVaVt+kiaMkU+oPZU4bsj4JqhZaLxC0llhYmxtE\\/menvg8LLEDpUx7M14C\\\\nnFsACVdbiJ9QNpoS2j5KXB6ZLtNN3Ywhf6FdtahfsizCEuHzBtB2yKmqrMuieyps\\\\nKQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6900	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6604	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 7064	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 600	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 2932	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6792	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 992	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 6632	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 7160	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: ZZGJ1bZClw.exe PID: 5848	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.ZZGJ1bZClw.exe.23115a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
4.2.ZZGJ1bZClw.exe.23115a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.ZZGJ1bZClw.exe.22815a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
5.2.ZZGJ1bZClw.exe.22815a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.ZZGJ1bZClw.exe.22915a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
6.2.ZZGJ1bZClw.exe.22915a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
8.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.ZZGJ1bZClw.exe.24415a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
12.2.ZZGJ1bZClw.exe.24415a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
10.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xdf7ea:$s1: http:// 0xfd898:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xfdf4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101b2f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xffa26:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xdf7ea:$f1: http://
1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
8.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
7.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
2.1.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
2.1.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
14.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.ZZGJ1bZClw.exe.400000.0.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe0dea:$s1: http:// 0xfee98:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff528:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0xff54f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10312f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x101026:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe0dea:$f1: http://
10.2.ZZGJ1bZClw.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0xe23ea:$s1: http:// 0x100498:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b28:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x100b4f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x10472f:$s1: \xE8\xF4\xF4\xF0\xBA\xAF\xAF 0x102626:$s2: \xE8\xF4\xF4\xF0\xF3\xBA\xAF\xAF 0xe23ea:$f1: http://
14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Click to see the 51 entries

Sigma Overview

No Sigma rule has matched

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack

Malware Configuration Extractor: Djvu {"Download URLs": ["http://securebiz.org/dl/build2.exe", "http://wrrst.top/files/1/build3.exe"], "C2 url": "http://wrrst.top/fhsgtsspen6/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-J0DxAGRqKO\r\nPrice of private key and decrypt software is $980.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $490.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nmanager@mailtemp.ch\r\n\r\nReserve e-mail address to contact us:\r\nmanagerhelper@airmail.cc\r\n\r\nYour personal ID:\r\n0334gSd743d", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\

Multi AV Scanner detection for submitted file

Show sources

Source: ZZGJ1bZClw.exe	Virustotal: Detection: 36%			Perma Link
Source: ZZGJ1bZClw.exe	ReversingLabs: Detection: 85%

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

ReversingLabs: Detection: 85%

Machine Learning detection for sample

Show sources

Source: ZZGJ1bZClw.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040E870
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	2_2_0040EAA0
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	2_2_00410FC0

Compliance:

Detected unpacking (overwrites its own PE header)

Show sources

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 2.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Unpacked PE file: 7.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 8.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 10.2.ZZGJ1bZClw.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Unpacked PE file: 14.2.ZZGJ1bZClw.exe.400000.0.unpack

Source: ZZGJ1bZClw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49779 version: TLS 1.2

Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: ZZGJ1bZClw.exe, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp
Source:	Binary string: C:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: dPC:\tihisud\62\cugenuxuya-mozemizeku.pdb source: ZZGJ1bZClw.exe
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,

2_2_0040F730

Networking:

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: http://wrrst.top/fhsgtsspen6/get.php

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Joe Sandbox View

IP Address: 77.123.139.190 77.123.139.190

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778

Source: ZZGJ1bZClw.exe, 00000002.00000003.362450680.00000000008FE000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ZZGJ1bZClw.exe, 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/7
Source: ZZGJ1bZClw.exe, ZZGJ1bZClw.exe, 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398488980.000000000061C000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, ZZGJ1bZClw.exe, 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000003.415619412.0000000000821000.00000004.00000001.sdmp, ZZGJ1bZClw.exe, 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: ZZGJ1bZClw.exe, 00000002.00000003.362692182.00000000008DA000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json=
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonMZ
Source: ZZGJ1bZClw.exe, 00000002.00000002.369437142.0000000000877000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonal
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416684605.000000000081B000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonl
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonrt0
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: ZZGJ1bZClw.exe, 0000000E.00000002.416652435.00000000007C8000.00000004.00000020.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsont:
Source: ZZGJ1bZClw.exe, 00000002.00000003.362635236.00000000008D0000.00000004.00000001.sdmp	String found in binary or memory: https://api.2ip.ua/y

Source: unknown

DNS traffic detected: queries for: clientconfig.passport.net

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

2_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua

Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 77.123.139.190:443 -> 192.168.2.6:49779 version: TLS 1.2

Source: ZZGJ1bZClw.exe, 00000001.00000002.361497898.000000000076A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

Spam, unwanted Advertisements and Ransom Demands:

Yara detected Djvu Ransomware

Show sources

Source: Yara match	File source: 5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.ZZGJ1bZClw.exe.23115a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.ZZGJ1bZClw.exe.22815a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ZZGJ1bZClw.exe.22915a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ZZGJ1bZClw.exe.24415a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000005.00000002.403053560.0000000002280000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.361885300.00000000022B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.387076079.0000000002310000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.415234158.0000000002440000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.395438224.0000000002290000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6900, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6604, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 7064, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 600, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 2932, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6792, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 992, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 6632, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 7160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: ZZGJ1bZClw.exe PID: 5848, type: MEMORYSTR

Source: ZZGJ1bZClw.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE, RELOCS_STRIPPED

Source: 5.2.ZZGJ1bZClw.exe.22815a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.ZZGJ1bZClw.exe.23115a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 4.2.ZZGJ1bZClw.exe.23115a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 5.2.ZZGJ1bZClw.exe.22815a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 12.2.ZZGJ1bZClw.exe.24415a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 7.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.ZZGJ1bZClw.exe.22b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 12.2.ZZGJ1bZClw.exe.24415a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 7.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 6.2.ZZGJ1bZClw.exe.22915a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 2.1.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 10.2.ZZGJ1bZClw.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 8.1.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 14.2.ZZGJ1bZClw.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000A.00000001.400162515.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000007.00000002.388374111.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000A.00000002.402983269.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000E.00000001.412816709.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000002.00000002.369250533.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000008.00000002.398022739.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000002.00000001.359707348.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 00000008.00000001.394915120.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0000000E.00000002.416440779.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 1_2_004023AC	1_2_004023AC
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040D240	2_2_0040D240
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00419F90	2_2_00419F90
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040C070	2_2_0040C070
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042E003	2_2_0042E003
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042C804	2_2_0042C804
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042F010	2_2_0042F010
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00443B40	2_2_00443B40
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0044237E	2_2_0044237E
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040DD40	2_2_0040DD40
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040BDC0	2_2_0040BDC0
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0042CE51	2_2_0042CE51
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040A660	2_2_0040A660
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0041E690	2_2_0041E690
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040274E	2_2_0040274E
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040A710	2_2_0040A710
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_0040F730	2_2_0040F730
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_2_00420F30	2_2_00420F30
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0040D240	2_1_0040D240
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_00419F90	2_1_00419F90
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0040C070	2_1_0040C070
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0042E003	2_1_0042E003
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 2_1_0042F010	2_1_0042F010
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: 4_2_004023AC	4_2_004023AC
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228CA10	5_2_0228CA10
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228DBE0	5_2_0228DBE0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228B000	5_2_0228B000
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228B0B0	5_2_0228B0B0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022830EE	5_2_022830EE
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022900D0	5_2_022900D0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022A18D0	5_2_022A18D0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022AE9A3	5_2_022AE9A3
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_022AF9B0	5_2_022AF9B0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228E6E0	5_2_0228E6E0
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: 5_2_0228C760	5_2_0228C760

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: String function: 022A8EC0 appears 38 times
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Code function: String function: 022B0160 appears 31 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00401DA1 appears 38 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00402974 appears 58 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 0042F7C0 appears 42 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 0044F23E appears 50 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 00428520 appears 50 times
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Code function: String function: 004547A0 appears 31 times

Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe

Code function: 5_2_02280110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,SetThreadContext,ResumeThread,ExitProcess,

5_2_02280110

Source: ZZGJ1bZClw.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: ZZGJ1bZClw.exe.2.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: ZZGJ1bZClw.exe	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: ZZGJ1bZClw.exe.2.dr	Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: ZZGJ1bZClw.exe	Virustotal: Detection: 36%
Source: ZZGJ1bZClw.exe	ReversingLabs: Detection: 85%

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File read: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Jump to behavior

Source: ZZGJ1bZClw.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe'	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53' /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Process created: C:\Users\user\Desktop\ZZGJ1bZClw.exe 'C:\Users\user\Desktop\ZZGJ1bZClw.exe' --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior
Source: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe	Process created: C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe 'C:\Users\user\AppData\Local\62eeaaf5-57b5-45a8-b82c-9369526aea53\ZZGJ1bZClw.exe' --AutoStart	Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\geo[1].json

Jump to behavior

Source: classification engine

Classification label: mal100.rans.troj.evad.winEXE@18/6@6/2

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

2_2_0040D240

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,_memmove,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

2_2_00411900

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 2_2_00412440 CreateToolhelp32Snapshot,Process32FirstW,CloseHandle,OpenProcess,TerminateProcess,CloseHandle,Process32NextW,CloseHandle,

2_2_00412440

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe

Code function: 1_2_0040102E SizeofResource,WaitForSingleObject,SetConsoleCP,SetEvent,EnterCriticalSection,FreeUserPhysicalPages,VerLanguageNameW,FindActCtxSectionStringA,lstrcpyW,PrepareTape,ReadFile,FindFirstVolumeA,FindNextVolumeA,AddConsoleAliasA,InterlockedIncrement,

1_2_0040102E

Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Command line argument: Q@		1_2_00405130
Source: C:\Users\user\Desktop\ZZGJ1bZClw.exe	Command line argument: Q@		4_2_00405130

Source: ZZGJ1bZClw.exe	String found in binary or memory: set-addPolicy
Source: ZZGJ1bZClw.exe	String found in binary or memory: id-cmc-addExtensions
Source: ZZGJ1bZClw.exe	String found in binary or memory: set-addPolicy
Source: ZZGJ1bZClw.exe	String found in binary or memory: id-cmc-addExtensions

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report ZZGJ1bZClw.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Djvu

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

Jbx Signature Overview

AV Detection:

Cryptography:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Spam, unwanted Advertisements and Ransom Demands:

System Summary: