djvu | 2a49863307152d805e8769320d6504ddaab2f56c9390c3d88bd7906340ddeceb

General

Target

new.exe
Size

921KB
MD5

a2d948cf6bce18c7e48fdf30118b2075
SHA1

6f0e6a1b5025ddcc12f7334eb3be77529aaa8179
SHA256

2a49863307152d805e8769320d6504ddaab2f56c9390c3d88bd7906340ddeceb
SHA512

be41681d970d382d395ee5f435419e2b3576a7ed24c7ed7931e32a95867296c8343a349643df50718b1ddb81d3ac7002864af58afe38091d7e1af6facdf4dc4e

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://vnjt.top/lancer/getm.php

Attributes

extension
.enfp
offline_id
gy4HLd4Nu8hMhno9C8AEpO10FUGAYGVNmXbgsUt1
payload_url
http://vnjt.top/files/cost/updatewin1.exe

http://vnjt.top/files/cost/updatewin2.exe

http://vnjt.top/files/cost/updatewin.exe

http://vnjt.top/files/cost/3.exe

http://vnjt.top/files/cost/4.exe

http://vnjt.top/files/cost/5.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-NuEqGxqRg2 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0288Widasd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 3 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3504-132-0x00000000025E0000-0x00000000026FA000-memory.dmp	family_djvu
behavioral1/memory/3504-133-0x0000000000400000-0x00000000008E0000-memory.dmp	family_djvu
behavioral1/memory/4700-143-0x0000000000400000-0x00000000008E0000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

new.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation new.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2732 icacls.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	new.exe

pid	process
2732	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

new.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ac605e26-fd39-4cca-b914-d84414e73573\\new.exe\" --AutoStart"	new.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

36 api.2ip.ua
37 api.2ip.ua
46 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

4408 3504 WerFault.exe new.exe

flow	ioc
36	api.2ip.ua
37	api.2ip.ua
46	api.2ip.ua

pid	pid_target	process	target process
4408	3504	WerFault.exe	new.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

new.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	new.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	new.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

new.exenew.exe

pid process

3504 new.exe
3504 new.exe
4700 new.exe
4700 new.exe

pid	process
3504	new.exe
3504	new.exe
4700	new.exe
4700	new.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

new.exe

description	pid	process	target process
PID 3504 wrote to memory of 2732	3504	new.exe	icacls.exe
PID 3504 wrote to memory of 2732	3504	new.exe	icacls.exe
PID 3504 wrote to memory of 2732	3504	new.exe	icacls.exe
PID 3504 wrote to memory of 4700	3504	new.exe	new.exe
PID 3504 wrote to memory of 4700	3504	new.exe	new.exe
PID 3504 wrote to memory of 4700	3504	new.exe	new.exe

C:\Users\Admin\AppData\Local\Temp\new.exe
"C:\Users\Admin\AppData\Local\Temp\new.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3504
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\ac605e26-fd39-4cca-b914-d84414e73573" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:2732
- C:\Users\Admin\AppData\Local\Temp\new.exe
  "C:\Users\Admin\AppData\Local\Temp\new.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3504 -s 1820
  2⤵
  - Program crash
  PID:4408

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 3504 -ip 3504
1⤵
PID:2440

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Install Root Certificate

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
727B

MD5
8ae6f45bb6c9f288a96a3402dc17e2d9

SHA1
9ddb0d782cb4728675a1f5b61cfc632997349cdf

SHA256
ae4681e5db7de9744bdd78a943d6be6a390aa925125935d6cb691a27c8b2ebd3

SHA512
ee94f18f21437c1fba42cca69d535997c89438801ea6e823e99d384e9bc0239b041dc5ed854063a571bac2bbd2f83d7113c7f456d130b15e7db847e7fe4e8ec7

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
471B

MD5
b1c4234d2346ca5a2267de9f0bab4b81

SHA1
d6d10976b258ee86430063fdfb1838bb73838aeb

SHA256
e75d5e79323e42e337cf188a296db211f5d7dd488d03adf4b1be7836f997e3ed

SHA512
8b1d4c34ad847b73d060cb35dba350032be0a8cd82637a5c52805c078ea986ea44446040f588fb4edda4a233e424bdb6dc3ba016b7647936ec4ef4f971ff1e17

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Filesize
402B

MD5
6ac5e8e4e7861bcd6144b9c86b41b245

SHA1
543d2c375313f56a1438d0704fd9bf696b1df11a

SHA256
fbfa62642823194ac60658f9aeeeacdc829bc85cd9f96d68dbd0812a71ec7166

SHA512
73770bcda011b75a37420fff358b082741b593522dc53540f4a92a77943d6c989458ce9493319a0f6b8d2617b370de2418d62d7a2ca1cc4756506f4ad7768c52

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Filesize
396B

MD5
1b1e445e4b305c4ce2372701da3d4228

SHA1
140c20f23630af97b1daabfba6393ca6020506e8

SHA256
a24023235defacd1a3ed304d05e15ff4242138033bdc79db751f7387336bbf40

SHA512
4eb76022fe75dd109c20135aa32dc439ba5acddf6f18570166add815913e3c7f3967386c29ead1bb05ca33404dfc2d31c987899c54c8ab9ea78cc8fe0a957363

Download Submit
C:\Users\Admin\AppData\Local\ac605e26-fd39-4cca-b914-d84414e73573\new.exe

Filesize
921KB

MD5
a2d948cf6bce18c7e48fdf30118b2075

SHA1
6f0e6a1b5025ddcc12f7334eb3be77529aaa8179

SHA256
2a49863307152d805e8769320d6504ddaab2f56c9390c3d88bd7906340ddeceb

SHA512
be41681d970d382d395ee5f435419e2b3576a7ed24c7ed7931e32a95867296c8343a349643df50718b1ddb81d3ac7002864af58afe38091d7e1af6facdf4dc4e

Download Submit
memory/2732-134-0x0000000000000000-mapping.dmp

Download
memory/3504-133-0x0000000000400000-0x00000000008E0000-memory.dmp

Filesize
4.9MB

Download
memory/3504-130-0x0000000000400000-0x00000000008E0000-memory.dmp

Filesize
4.9MB

Download
memory/3504-132-0x00000000025E0000-0x00000000026FA000-memory.dmp

Filesize
1.1MB

Download
memory/3504-131-0x00000000024E5000-0x0000000002576000-memory.dmp

Filesize
580KB

Download
memory/4700-137-0x0000000000400000-0x00000000008E0000-memory.dmp

Filesize
4.9MB

Download
memory/4700-136-0x0000000000000000-mapping.dmp

Download
memory/4700-142-0x00000000024C2000-0x0000000002553000-memory.dmp

Filesize
580KB

Download
memory/4700-143-0x0000000000400000-0x00000000008E0000-memory.dmp

Filesize
4.9MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads