djvu | fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5

General

Target
fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
Size 693KB
Sample210929-jpac9sebc9
SHA256 fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5
MD5 1f8c099a24f7397ff6893bcd5b06919c
SHA1 4f7fa55fab58739bbadc3455178fbc7384677b6f
SHA512 f5f4eefd3b6ed8eb5bed28313ddec924c1f0f2aa4413b490338a5169a69b59ca68f0e8f1e4410b3fa556860056b31739c2c412c7dc780d81e186ca446f4572bc
MD5 SHA1 SHA512

Score

10^/10

Malware Config

Signatures

Detected Djvu ransomware 6 IoCs

resource	yara_rule
behavioral2/memory/2436-115-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2436-116-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/2348-117-0x00000000022F0000-0x000000000240B000-memory.dmp	family_djvu
behavioral2/memory/2436-118-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4092-123-0x0000000000424141-mapping.dmp	family_djvu
behavioral2/memory/4092-124-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3160	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\08dcccc3-983b-4eb1-89a3-8670b7f7983d\\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe\" --AutoStart"	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
3	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2348 set thread context of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 3792 set thread context of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
4092	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
4092	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2348 wrote to memory of 2436	2348	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	70
PID 2436 wrote to memory of 3160	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	71
PID 2436 wrote to memory of 3160	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	71
PID 2436 wrote to memory of 3160	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	71
PID 2436 wrote to memory of 3792	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	72
PID 2436 wrote to memory of 3792	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	72
PID 2436 wrote to memory of 3792	2436	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	72
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74
PID 3792 wrote to memory of 4092	3792	fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe	74

C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
"C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348
- C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
  "C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2436
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\08dcccc3-983b-4eb1-89a3-8670b7f7983d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3160
- - C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
    "C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3792
  - - C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe
      "C:\Users\Admin\AppData\Local\Temp\fe9867448fb67fcadeb9f432d363b93e06ac3e3a7bc87e44a93f1f16746ea2e5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4092

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2348-117-0x00000000022F0000-0x000000000240B000-memory.dmp

Download

memory/2436-115-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2436-118-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4092-124-0x0000000000400000-0x0000000000537000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads