djvu | 08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3

General

Target

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
Size

755KB
MD5

959b266cad13ba35aee35d8d4b723ed4
SHA1

026d092515263021e450372713937d0c4f352e2f
SHA256

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3
SHA512

d261068c3e26d8471a187b2c9e00dc2d447a0d7d70e917cd6dbaeaac668f05e6246a2da85ff2bd69e39ccf07d7e66abde118201cb27ce3f037dc0b74c00d4383

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://ring1.ug/As73yhsyU34578hxxx/SDf565g/get.php

Attributes

extension
.coot
offline_id
MRQ5kb5Z12tWuP3e25YoRt4PRDrJd2yuI3coott1
payload_url
http://ring1.ug/files/cost/updatewin1.exe
http://ring1.ug/files/cost/updatewin2.exe
http://ring1.ug/files/cost/updatewin.exe
http://ring1.ug/files/cost/3.exe
http://ring1.ug/files/cost/4.exe
http://ring1.ug/files/cost/5.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IbdGyCKhdr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: salesrestoresoftware@firemail.cc Reserve e-mail address to contact us: salesrestoresoftware@gmail.com Your personal ID: 0175Asd374y5iuhld

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 7 IoCs

Processes:

resource	yara_rule
behavioral2/memory/4884-131-0x0000000005F00000-0x000000000601A000-memory.dmp	family_djvu
behavioral2/memory/4884-132-0x0000000000400000-0x00000000058A5000-memory.dmp	family_djvu
behavioral2/memory/4884-135-0x0000000005F00000-0x000000000601A000-memory.dmp	family_djvu
behavioral2/memory/4884-136-0x0000000000400000-0x00000000058A5000-memory.dmp	family_djvu
behavioral2/memory/4048-143-0x0000000000400000-0x00000000058A5000-memory.dmp	family_djvu
behavioral2/memory/4048-144-0x0000000000400000-0x00000000058A5000-memory.dmp	family_djvu
behavioral2/memory/4884-145-0x0000000000400000-0x00000000058A5000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1552 icacls.exe

pid	process
1552	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\4d818e59-2f86-4a14-99d7-74390a1d9e9e\\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe\" --AutoStart"	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

5 api.2ip.ua
6 api.2ip.ua
22 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

1388 4884 WerFault.exe 08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

flow	ioc
5	api.2ip.ua
6	api.2ip.ua
22	api.2ip.ua

pid	pid_target	process	target process
1388	4884	WerFault.exe	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

Processes:

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

pid	process
4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
4048	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
4048	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

description	pid	process	target process
PID 4884 wrote to memory of 1552	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	icacls.exe
PID 4884 wrote to memory of 1552	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	icacls.exe
PID 4884 wrote to memory of 1552	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	icacls.exe
PID 4884 wrote to memory of 4048	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
PID 4884 wrote to memory of 4048	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
PID 4884 wrote to memory of 4048	4884	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe	08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe

C:\Users\Admin\AppData\Local\Temp\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
"C:\Users\Admin\AppData\Local\Temp\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\4d818e59-2f86-4a14-99d7-74390a1d9e9e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
2⤵
- Modifies file permissions
PID:1552

C:\Users\Admin\AppData\Local\Temp\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
"C:\Users\Admin\AppData\Local\Temp\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe" --Admin IsNotAutoStart IsNotTask
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4884 -s 2148
2⤵
- Program crash
PID:1388

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4884 -ip 4884
1⤵
PID:908

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Permissions Modification

1

T1222

Modify Registry

2

T1112

Install Root Certificate

1

T1130

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
727B

MD5
78077c9c0f44735ebc285343f6cddb03

SHA1
f16447f2ade323433685e824ee10fe6f251497cc

SHA256
cb322181548b26c639ccae02c2e6c35b82943e6f0655f2726a1415c688f030b1

SHA512
707b3ea73dfa939ce4e1b8c94c77b03a94541b228a28c36df953b6e495df940b346c350959747363a1a32760f0c53180e0e90f628c4f4bf09e53c19ba8e35460

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
471B

MD5
c68c131be481d00a6e7680b8abede43c

SHA1
6fe949c56d2746a93915c862cc84d526d004bf7f

SHA256
5ca8816929c5b74f39fa15656ca061f31bef42eb5bc9964bf7ccbbf441a34e5f

SHA512
f9d8ee9d070f352e4d9e32a161353546459dfa3836676eca21f5894db009a05b467e461280c7120464c721c821c4675ed9f41427bfe83d4f0f4d85bb172c55ea

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize
402B

MD5
5793e3daddf4809ecd13fcf75969b19e

SHA1
c1f4fdc8eedff95791d2af659869877c66ec4b10

SHA256
4fcc2e424a554f07d89c5325f8a0b797f940ed187de1717a6ae997069720eb84

SHA512
a59f178010727340bfd8e052d6cea8b8ef35e2debe307f61317bc0a6c1cef70dd52c6f00babf0bef7e2dd0b3e86f56a62e90d86c3dc32baaafa871c100596f6d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize
396B

MD5
13fa81603ae53a86d7bb973880027c7c

SHA1
e3a8c2adb56b0b47b3e84d863e8e54bdb78d5cba

SHA256
b47d803fd3c5f3cdfdc01cf91914f5c4a0434cbd1840c808b7b7d0b029e8d1bf

SHA512
a977e55f55502adf31bf15af5e1f0cae3607b595c16b731303db6d2cd640d21c0aaa88f193eac2bd3a001dec3768cd9294256b3d8c6543112696f131037ee9e7

Download Submit
C:\Users\Admin\AppData\Local\4d818e59-2f86-4a14-99d7-74390a1d9e9e\08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3.exe
Filesize
755KB

MD5
959b266cad13ba35aee35d8d4b723ed4

SHA1
026d092515263021e450372713937d0c4f352e2f

SHA256
08b6c38e79c9ac0ce7a7fafaaae1334c41d70b860ff2c8eb6b2742c58cdb06b3

SHA512
d261068c3e26d8471a187b2c9e00dc2d447a0d7d70e917cd6dbaeaac668f05e6246a2da85ff2bd69e39ccf07d7e66abde118201cb27ce3f037dc0b74c00d4383

Download Submit
memory/1552-133-0x0000000000000000-mapping.dmp

Download
memory/4048-137-0x0000000000000000-mapping.dmp

Download
memory/4048-138-0x0000000005D4B000-0x0000000005DDC000-memory.dmp

Filesize
580KB

Download
memory/4048-143-0x0000000000400000-0x00000000058A5000-memory.dmp

Filesize
84.6MB

Download
memory/4048-144-0x0000000000400000-0x00000000058A5000-memory.dmp

Filesize
84.6MB

Download
memory/4884-135-0x0000000005F00000-0x000000000601A000-memory.dmp

Filesize
1.1MB

Download
memory/4884-136-0x0000000000400000-0x00000000058A5000-memory.dmp

Filesize
84.6MB

Download
memory/4884-130-0x0000000005DFF000-0x0000000005E90000-memory.dmp

Filesize
580KB

Download
memory/4884-132-0x0000000000400000-0x00000000058A5000-memory.dmp

Filesize
84.6MB

Download
memory/4884-131-0x0000000005F00000-0x000000000601A000-memory.dmp

Filesize
1.1MB

Download
memory/4884-145-0x0000000000400000-0x00000000058A5000-memory.dmp

Filesize
84.6MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads