djvu | 30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce

General

Target
30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
Size 697KB
Sample210929-jpac9sebc8
SHA256 30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce
MD5 8108ba038e091b2d315d19652ce576ae
SHA1 fa27cbc95b3f83589ea82eae8056b841ab960da7
SHA512 f41ecbbbb0eb92db850487eef4f13cae8eb69d91be5f83aabf0725df87aee2888722ea40fe611685f915014ec513f6dd2a7ab84d95e9164e44e2055a84f92619
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Detected Djvu ransomware 6 IoCs

resource	yara_rule
behavioral2/memory/1516-115-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1516-116-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/1516-118-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1828-117-0x00000000022F0000-0x000000000240B000-memory.dmp	family_djvu
behavioral2/memory/3132-123-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/3132-124-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2544	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ddf6eb0c-358e-46a1-a168-1452768d9712\\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe\" --AutoStart"	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1828 set thread context of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 2796 set thread context of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
3132	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
3132	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1828 wrote to memory of 1516	1828	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	70
PID 1516 wrote to memory of 2544	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	71
PID 1516 wrote to memory of 2544	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	71
PID 1516 wrote to memory of 2544	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	71
PID 1516 wrote to memory of 2796	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	72
PID 1516 wrote to memory of 2796	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	72
PID 1516 wrote to memory of 2796	1516	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	72
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74
PID 2796 wrote to memory of 3132	2796	30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe	74

C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
"C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
  "C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\ddf6eb0c-358e-46a1-a168-1452768d9712" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2544
- - C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
    "C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2796
  - - C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe
      "C:\Users\Admin\AppData\Local\Temp\30fe1a0c497da6babc63705181d30f2912d7b28d987eb3b8a416d768a10095ce.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3132

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1516-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1516-118-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1828-117-0x00000000022F0000-0x000000000240B000-memory.dmp

Download

memory/3132-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads