Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
05-12-2021 06:37
Static task
static1
Behavioral task
behavioral1
Sample
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe
Resource
win10-en-20211104
General
-
Target
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe
-
Size
820KB
-
MD5
4f6912a60696b0ba325fd3cacc899858
-
SHA1
eb56d18675e2ca57bcba27689708835e5243e551
-
SHA256
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746
-
SHA512
7f45890c3629e77ffe28f53aab7e93ee7a7d1ac971d9cfd655492d10f2bbeb345f0caa27bae7ac4511c27f7b9c73a0d87d7d9d3b34f398d1a105abc7ecef5f33
Malware Config
Extracted
djvu
http://tzgl.org/lancer/get.php
-
extension
.hgsh
-
offline_id
gYuqQ5GsAaJom08TivUVhlPzZDKd916x4NcXrWt1
-
payload_url
http://kotob.top/dl/build2.exe
http://tzgl.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-m8LBBi8x8F Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0358Sigrj
Signatures
-
Detected Djvu ransomware 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3444-119-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/3444-120-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/2468-121-0x00000000022C0000-0x00000000023DB000-memory.dmp family_djvu behavioral1/memory/3444-122-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/804-128-0x0000000000424141-mapping.dmp family_djvu behavioral1/memory/804-133-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1042495040-510797905-2613508344-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a8e254e4-00ca-4707-9162-d962840eedf8\\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe\" --AutoStart" a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 8 api.2ip.ua 9 api.2ip.ua 25 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exea24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exedescription pid process target process PID 2468 set thread context of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 set thread context of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exea24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exepid process 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe 804 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe 804 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exea24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exea24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exedescription pid process target process PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 2468 wrote to memory of 3444 2468 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 3444 wrote to memory of 3472 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe icacls.exe PID 3444 wrote to memory of 3472 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe icacls.exe PID 3444 wrote to memory of 3472 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe icacls.exe PID 3444 wrote to memory of 1452 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 3444 wrote to memory of 1452 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 3444 wrote to memory of 1452 3444 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe PID 1452 wrote to memory of 804 1452 a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"2⤵
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\a8e254e4-00ca-4707-9162-d962840eedf8" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3472 -
C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe"C:\Users\Admin\AppData\Local\Temp\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
PID:804
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
1c63500df0b57e29edd1a5867d9f0e9b
SHA10475a0611ac4d171e90b46303b96317fc186b15d
SHA256c8f7c1bd12b80996707a806866379d91dc3008d5d2b0eeeb6d97d418aeeb7914
SHA51229b914ffe63496d98e8ffb76afde49702888743c88bd0fc6aabdf3e8855e3a5389d933a29ccb4564e8d3198c159a1debfb56d6f39f428689f8eb4d497b341bde
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
65052acb8dc97b38007797064162c9a1
SHA1862cf5f74d74b85103b088650a230ed0c6d32df3
SHA256ef406913c83356f132bbc250646c24befee2acfdabbc9debcbca68c1da01a30f
SHA512976f4bd21af190164d04534f4e534d44e14fd5d3c6798421f84ead4e0a53f25d386d4b59bfe0c7c5865af4f22593d975d6b48292b024a4b6ca0d65ff6ee735bd
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850DMD5
4aa00ef84eb9d4823d3c249942fe7376
SHA1b4d31c9eb56ea86744497f4b8d2c15c94654c8b6
SHA25647842c579be6c916201238729ccfb7924e99c0ac207c3e6ea91ee769a92c9a95
SHA512183ba9c951e3e19e527544cd3d7fd5bd2bfe6912470baae7de470965d8d4fbad8168ecd35879feb5e4769776aeedaf17bdf52ffc4187e549d97b5ea9e3a8b8da
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711EMD5
77d342a8eb35e9d70b074c623fc565f9
SHA1232477840d79d216f5195052c4a133a031c5c025
SHA25674c709cd15e29ec3f9e7a0a40b9998a635408d12165c179260612468ce9c014d
SHA5124505e7363095fb65794f31bf2d28f5285b286200c9305a0c1409294caf5d6ca666f98e306ddc412978f79eb17dc7b94286d485d34d63750a528d30d8e7cab6ae
-
C:\Users\Admin\AppData\Local\a8e254e4-00ca-4707-9162-d962840eedf8\a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746.exeMD5
4f6912a60696b0ba325fd3cacc899858
SHA1eb56d18675e2ca57bcba27689708835e5243e551
SHA256a24ed5964765bc4ee5a8dd8f90db3ee3fe861930aeeb6a9daf3b2d6785717746
SHA5127f45890c3629e77ffe28f53aab7e93ee7a7d1ac971d9cfd655492d10f2bbeb345f0caa27bae7ac4511c27f7b9c73a0d87d7d9d3b34f398d1a105abc7ecef5f33
-
memory/804-128-0x0000000000424141-mapping.dmp
-
memory/804-133-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/1452-125-0x0000000000000000-mapping.dmp
-
memory/1452-126-0x000000000214E000-0x00000000021DF000-memory.dmpFilesize
580KB
-
memory/2468-118-0x0000000002225000-0x00000000022B6000-memory.dmpFilesize
580KB
-
memory/2468-121-0x00000000022C0000-0x00000000023DB000-memory.dmpFilesize
1.1MB
-
memory/3444-122-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3444-120-0x0000000000424141-mapping.dmp
-
memory/3444-119-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3472-123-0x0000000000000000-mapping.dmp