Analysis

  • max time kernel
    118s
  • max time network
    125s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    08/09/2022, 23:34

General

  • Target

    79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe

  • Size

    724KB

  • MD5

    3acd69a6bfb52f5953e1bd11f6559bee

  • SHA1

    a328848da5014d77215f09a732c69a19415e9b18

  • SHA256

    79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f

  • SHA512

    2ddbea23e46d62c69cb69e9fd19e51db5e1d96ef9cab3f3738185190e45891ee706f9dbd841dbd74b775581f2524803f5f3e902ea613d301815e7f9a3d2be721

  • SSDEEP

    12288:NX3E1omaBWmhlGdtPFwmXhXeTTisza10xSVlIXlC+EDkYsmTooUxF0hJmOku7xcZ:NHcomaksGjFwchuPis+MSVEc+EDk4To1

Malware Config

Extracted

Family

djvu

C2

http://acacaca.org/test1/get.php

Attributes
  • extension

    .mmpu

  • offline_id

    yd6oYv6aBN90yFzTWdZ34sXSXtXiauzOLXZyWht1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://acacaca.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-xuPJqoyzQE Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0554Jhyjd

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe
    "C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1332
    • C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe
      "C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:924
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\3f939ff7-2e5a-491b-9cdd-f2cb2ae6053d" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:3284
      • C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe
        "C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:2100
        • C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe
          "C:\Users\Admin\AppData\Local\Temp\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:1396
          • C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe
            "C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:1880
            • C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe
              "C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe"
              6⤵
              • Executes dropped EXE
              • Checks computer location settings
              • Loads dropped DLL
              • Checks processor information in registry
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of WriteProcessMemory
              PID:4552
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe" & del C:\PrograData\*.dll & exit
                7⤵
                • Suspicious use of WriteProcessMemory
                PID:760
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im build2.exe /f
                  8⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4288
                • C:\Windows\SysWOW64\timeout.exe
                  timeout /t 6
                  8⤵
                  • Delays execution with timeout.exe
                  PID:2104

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\ProgramData\mozglue.dll

    Filesize

    133KB

    MD5

    8f73c08a9660691143661bf7332c3c27

    SHA1

    37fa65dd737c50fda710fdbde89e51374d0c204a

    SHA256

    3fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd

    SHA512

    0042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89

  • C:\ProgramData\nss3.dll

    Filesize

    1.2MB

    MD5

    bfac4e3c5908856ba17d41edcd455a51

    SHA1

    8eec7e888767aa9e4cca8ff246eb2aacb9170428

    SHA256

    e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78

    SHA512

    2565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66

  • C:\ProgramData\sqlite3.dll

    Filesize

    630KB

    MD5

    e477a96c8f2b18d6b5c27bde49c990bf

    SHA1

    e980c9bf41330d1e5bd04556db4646a0210f7409

    SHA256

    16574f51785b0e2fc29c2c61477eb47bb39f714829999511dc8952b43ab17660

    SHA512

    335a86268e7c0e568b1c30981ec644e6cd332e66f96d2551b58a82515316693c1859d87b4f4b7310cf1ac386cee671580fdd999c3bcb23acf2c2282c01c8798c

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    215064dd8b4566627489319b46e9ca43

    SHA1

    7fa698eef5f02a961b5862df135d7ebfd8a12292

    SHA256

    390f76fdb79029603900524df2f0fbfd05bf18a3bbc74b9b05b2a6dc5938393c

    SHA512

    2a5b12b41d728ce30f1712d23226bbefe73111b786156b97126d6497ef234e78feaf6db08c7412eaa336c869b93ab239cd46b33cc31ff2c8497214cba5927753

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    a6a0160f7dee79a316edde54d910ebaa

    SHA1

    9b374842b8954e8b27a06f22f1c0de15ea768c31

    SHA256

    f3646358e7a0d83e1140296fb384dc20e38a165f8f086cf240ace49e27e5b7c0

    SHA512

    1510a5ac8bb5d3f7a3be3397ef5266861df92bb72d013d8f9432dae8f4310d7d494e67f6b49b712519fb96ef085eb1e233eb8bd4e42bfee10faf0f6da64e4b98

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    e45039690df0d2d3e68de36646342c39

    SHA1

    e71c1c196fac1defe26649392a6f85d8dd099406

    SHA256

    44cca0d93524020d636c4f042048280c9763dfa683cc5afd5e12c4e25b8bf183

    SHA512

    b69d78bfa058fe08d0d9e19349ef3f23c2706f4a76507bf6533a5d62f2f517595ab083c890e00ff3aa2cec0e6a593664125a58dbb5b480e7596729cc573c1151

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    e9142b3266cce3e7281501bf63311b19

    SHA1

    70141caec684bb2e03092192e003b08aba6c6f94

    SHA256

    0c874462701a4223a1523fdd3bdcdf5c0c5937d992223ca68df4a5236f2e5fc9

    SHA512

    57f934465f130e8c4864aa288b7bc1fd2e037b10b12f524cdca82742c4101417059efe4d0101633f98c9d384c535bcfb144e05374fcbeebae7e300186d6a2d99

  • C:\Users\Admin\AppData\Local\3f939ff7-2e5a-491b-9cdd-f2cb2ae6053d\79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f.exe

    Filesize

    724KB

    MD5

    3acd69a6bfb52f5953e1bd11f6559bee

    SHA1

    a328848da5014d77215f09a732c69a19415e9b18

    SHA256

    79ddbfe6816056c16173f0950de8c6f95cbaa9730f3647f91541d35942d00d6f

    SHA512

    2ddbea23e46d62c69cb69e9fd19e51db5e1d96ef9cab3f3738185190e45891ee706f9dbd841dbd74b775581f2524803f5f3e902ea613d301815e7f9a3d2be721

  • C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe

    Filesize

    383KB

    MD5

    8d7db6982df46c3b0f0cc879d892c08a

    SHA1

    64e3d7ab4793aeb05d18a82159c579e05c45fd71

    SHA256

    116e15e94d70dde65f91f155580bd9b34ff1956b9ebe1a53b6bce912b281c1f6

    SHA512

    0eeb242e6e1356a2a9e3183f12439ef36fac40e27ac8c0df5f591c7b3c1324145627c92c3fee15aedee2c1e8cc3b966152af73a33196166c2c1bfbbd979bdb5b

  • C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe

    Filesize

    383KB

    MD5

    8d7db6982df46c3b0f0cc879d892c08a

    SHA1

    64e3d7ab4793aeb05d18a82159c579e05c45fd71

    SHA256

    116e15e94d70dde65f91f155580bd9b34ff1956b9ebe1a53b6bce912b281c1f6

    SHA512

    0eeb242e6e1356a2a9e3183f12439ef36fac40e27ac8c0df5f591c7b3c1324145627c92c3fee15aedee2c1e8cc3b966152af73a33196166c2c1bfbbd979bdb5b

  • C:\Users\Admin\AppData\Local\6627061e-9913-4ea1-8b41-9d3e0eef1461\build2.exe

    Filesize

    383KB

    MD5

    8d7db6982df46c3b0f0cc879d892c08a

    SHA1

    64e3d7ab4793aeb05d18a82159c579e05c45fd71

    SHA256

    116e15e94d70dde65f91f155580bd9b34ff1956b9ebe1a53b6bce912b281c1f6

    SHA512

    0eeb242e6e1356a2a9e3183f12439ef36fac40e27ac8c0df5f591c7b3c1324145627c92c3fee15aedee2c1e8cc3b966152af73a33196166c2c1bfbbd979bdb5b

  • memory/924-134-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/924-136-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/924-142-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/924-133-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/924-138-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1332-135-0x0000000002EE6000-0x0000000002F78000-memory.dmp

    Filesize

    584KB

  • memory/1332-137-0x0000000004B20000-0x0000000004C3B000-memory.dmp

    Filesize

    1.1MB

  • memory/1396-145-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1396-147-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1396-152-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1396-167-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1880-162-0x0000000000AC0000-0x0000000000B09000-memory.dmp

    Filesize

    292KB

  • memory/1880-160-0x0000000000BB8000-0x0000000000BE4000-memory.dmp

    Filesize

    176KB

  • memory/2100-146-0x00000000048C3000-0x0000000004955000-memory.dmp

    Filesize

    584KB

  • memory/4552-157-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/4552-161-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/4552-159-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/4552-169-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB

  • memory/4552-163-0x0000000000400000-0x000000000045D000-memory.dmp

    Filesize

    372KB