djvu | f6454bef1b6bfe39b4ba52c0e15eab252394d47e688ef935ea328ff67e71daa0

Analysis

max time kernel
143s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20220721-en
resource tags

arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
submitted
08/08/2022, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
87173b73a09857b493d985d71149ecab.exe
Size 729KB
Sample220808-bxdrnaddc4
SHA256 f6454bef1b6bfe39b4ba52c0e15eab252394d47e688ef935ea328ff67e71daa0
MD5 87173b73a09857b493d985d71149ecab
SHA1 6b99e63b1d8804b5f5c3b75c3c1b44a53f8bdebe
SHA512 bcf0768609827f6a2f5005a5573a2fa76c9cd9f50822563be2d3c27899b99c0996c98b412b84d3675985e97f079802f275730708c2a61153af5efa22a67968bc
MD5 SHA1 SHA512

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://acacaca.org/test2/get.php

Attributes

extension
.vvyu
offline_id
rE5LpDv2ftYRXAo7bC18EpzfRMTHSGjgfyIMfZt1
payload_url
http://rgyui.top/dl/build2.exe

http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-QsoSRIeAK6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0531Jhyjd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/1432-131-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1432-132-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/436-135-0x0000000004380000-0x000000000449B000-memory.dmp	family_djvu
behavioral2/memory/1432-134-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1432-136-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1432-140-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/212-143-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/212-145-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/212-148-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/212-151-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\Control Panel\International\Geo\Nation	87173b73a09857b493d985d71149ecab.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3948	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1101907861-274115917-2188613224-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a82b7ab8-cb9a-4b9d-bb98-fa0641721329\\87173b73a09857b493d985d71149ecab.exe\" --AutoStart"	87173b73a09857b493d985d71149ecab.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.2ip.ua
10	api.2ip.ua
24	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 436 set thread context of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 1088 set thread context of 212	1088	87173b73a09857b493d985d71149ecab.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1130

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349	87173b73a09857b493d985d71149ecab.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e	87173b73a09857b493d985d71149ecab.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1432	87173b73a09857b493d985d71149ecab.exe
1432	87173b73a09857b493d985d71149ecab.exe
212	87173b73a09857b493d985d71149ecab.exe
212	87173b73a09857b493d985d71149ecab.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 436 wrote to memory of 1432	436	87173b73a09857b493d985d71149ecab.exe	83
PID 1432 wrote to memory of 3948	1432	87173b73a09857b493d985d71149ecab.exe	88
PID 1432 wrote to memory of 3948	1432	87173b73a09857b493d985d71149ecab.exe	88
PID 1432 wrote to memory of 3948	1432	87173b73a09857b493d985d71149ecab.exe	88
PID 1432 wrote to memory of 1088	1432	87173b73a09857b493d985d71149ecab.exe	89
PID 1432 wrote to memory of 1088	1432	87173b73a09857b493d985d71149ecab.exe	89
PID 1432 wrote to memory of 1088	1432	87173b73a09857b493d985d71149ecab.exe	89
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92
PID 1088 wrote to memory of 212	1088	87173b73a09857b493d985d71149ecab.exe	92

C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe
"C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:436
- C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe
  "C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Modifies system certificate store
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1432
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\a82b7ab8-cb9a-4b9d-bb98-fa0641721329" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3948
- - C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe
    "C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1088
  - - C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe
      "C:\Users\Admin\AppData\Local\Temp\87173b73a09857b493d985d71149ecab.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Install Root Certificate

T1130

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 2KB
SHA256 6a503464962b7bc1de784e96c4e26eb771366a3941f1c59a6037527a9627284d
MD5 a8035fe536cb094728b0c38b41236a65
SHA1 f6345db1de0f3e41868f9ce4992e97a12d0ae293
SHA512 f8a2618fbad8a9427f054c8c7a705fa9144c59af56ce70726c9db962d74135c9aad8fe320125aac4fb2bf8368d08908a1df86c065bfcd8a9ff57fc06c25b467a
MD5 SHA1 SHA512

Submit Download

572BF21E454637C9F000BE1AF9B1E1A9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\572BF21E454637C9F000BE1AF9B1E1A9
Size 506B
SHA256 02d10341c1aa4d29467f7df1b262d459240a70a0e308632ed071aeda2c55e886
MD5 876826fd485d73f73ea687ecd6797e30
SHA1 edca137d0002c2e72678e00f28497de39d9304f4
SHA512 e385d00d5532dced8d755a9f2c6eb5039c7f15a7f1420440a1eb3a6f87762156d40b24ecfcb9f344a2c89014e750ffcc42775deb27b3b73437a45a8cb6f470b1
MD5 SHA1 SHA512

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 488B
SHA256 06458e9d590649a4b7f2990433310eb8140629f0686583578083f32a993de8eb
MD5 acae70802bde283e48f8325d47c3a3d1
SHA1 d263cc2e8ea19170b7632b02a88a2f31953868c0
SHA512 d46fd2ee035d249bb3e5d097a1ae4d46f2341cea8f3d58314d86f6fa357e510b70bdef41991c9a58347277426fb9680416d129870630d665137ad5c69e23624a
MD5 SHA1 SHA512

Submit Download

572BF21E454637C9F000BE1AF9B1E1A9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\572BF21E454637C9F000BE1AF9B1E1A9
Size 248B
SHA256 f1e07c6086de66eaf6991b19ec905f50f3ae037318ccd7a57e92c095e281b798
MD5 1dfc2a1ee34acf342f0c6bfe917faa77
SHA1 6d1dae35308901a02c4e3081bf936702d4850c0f
SHA512 3f39edc44e3b2f7224497913e2ff8a419e4d0719be3dbfaf93f18d6a5f19b0806c9461016b7976b0a625b87ac10d0ac965cedaec986059ae5404ac43e7f29e49
MD5 SHA1 SHA512

Submit Download

87173b73a09857b493d985d71149ecab.exe

Path C:\Users\Admin\AppData\Local\a82b7ab8-cb9a-4b9d-bb98-fa0641721329\87173b73a09857b493d985d71149ecab.exe
Size 729KB
SHA256 f6454bef1b6bfe39b4ba52c0e15eab252394d47e688ef935ea328ff67e71daa0
MD5 87173b73a09857b493d985d71149ecab
SHA1 6b99e63b1d8804b5f5c3b75c3c1b44a53f8bdebe
SHA512 bcf0768609827f6a2f5005a5573a2fa76c9cd9f50822563be2d3c27899b99c0996c98b412b84d3675985e97f079802f275730708c2a61153af5efa22a67968bc
SSDEEP 12288:LQLwL70cEa2r7hfehPLEQx63o7Lh13KNUBe4lX8wm1DMWIOgOLJ2S0k:LQL2TGWdguj6NoeuswhWIigK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/212-148-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/212-151-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/212-145-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/212-143-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/436-133-0x00000000042EC000-0x000000000437D000-memory.dmp

Download

memory/436-135-0x0000000004380000-0x000000000449B000-memory.dmp

Download

memory/1088-144-0x000000000413A000-0x00000000041CB000-memory.dmp

Download

memory/1432-134-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1432-140-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1432-136-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1432-132-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1432-131-0x0000000000400000-0x0000000000537000-memory.dmp

Download