Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    150s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/09/2022, 00:38

General

  • Target

    e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe

  • Size

    819KB

  • MD5

    430e12f2a40eb7312b9518520680eba8

  • SHA1

    030e688cd031b6f93a318a11abd677c408907871

  • SHA256

    e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941

  • SHA512

    43b79954e04ecee98fa02be9bbb8338efd93979f6d46924a6fea9d7ff1d56e797a7422de79456a861354aaecc9a795d3721a61320be371ef4847f563ac4f2bb0

  • SSDEEP

    24576:n6XReUO6pPJNcHBt6Z8rBPJIyqHjf+Wkhkhbzi:nkRtBeTL1PQHjKg

Malware Config

Extracted

Family

djvu

C2

http://acacaca.org/test3/get.php

Attributes
  • extension

    .aamv

  • offline_id

    MyudhIExJux2oRQXw95TT1oAPu7mvqRMzxr1eet1

  • payload_url

    http://rgyui.top/dl/build2.exe

    http://acacaca.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-4Xcf4IX21n Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0564Jhyjd

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
    "C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4772
    • C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
      "C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1288
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\cce0b158-23da-4e53-be3c-5a65f7af933e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2180
      • C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
        "C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1708
        • C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
          "C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:4280
          • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe
            "C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:2772
            • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe
              "C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"
              6⤵
              • Executes dropped EXE
              PID:4988
          • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe
            "C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of WriteProcessMemory
            PID:4712
            • C:\Windows\SysWOW64\schtasks.exe
              /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
              6⤵
              • Creates scheduled task(s)
              PID:1580
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1472
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      2⤵
      • Creates scheduled task(s)
      PID:2796

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    2KB

    MD5

    ea3ead1b160922fb25b1b9d766a56fa5

    SHA1

    9f61cb0a5a80fa5ba776f71fed4728d002d3aca1

    SHA256

    4080213fba647d43c0ac02710ac7b631c23f8f791930016045cda9aeec1b6867

    SHA512

    ec817bdc668bff4c266ca8b6a6c4068251926714262a95f9ac7f7565e2d66a26371589182d0ba1d03fa482d99430b865cb7eb24becf92b72e45f20b26a215c15

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    1KB

    MD5

    e9e482bf825221326b7c080ef52e5036

    SHA1

    67244c170dad567630298f89364a5e9626e2517a

    SHA256

    60843d5086f10e833ca98696967f1a39ea04a2ffee6d87679b5803092b9cfa71

    SHA512

    c7a5fd63c0faa2a5cd8be90c7dcf10d8dd564964dc4b8ab4fa1a7a188fa89094563f595c94f4ea133582cfbcf9cc90cb74bd273924b7fa5eadae868bced51440

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

    Filesize

    488B

    MD5

    7a872f63a51cea12a63317c79ecaca9f

    SHA1

    e9a9fde4a0baf22db7272f44a1cb03be8f329806

    SHA256

    e603799d9b7f61fd6c94a61d5999cb3f5864d419c57aec2594a7d5b2e19c9ad3

    SHA512

    cfc5f137c95ba887689a59e0b5bac2a2cce3d756bded6f227dbb6a4d67e2f88335bc478d9a741d9f94fdd3c4b7948366c41b3fd5c6edf2268c3b0058dcca0c34

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

    Filesize

    482B

    MD5

    d461a8eac8a8324056ef55b8603468df

    SHA1

    441efd901093350d55ce722f1cd57ef28b999a95

    SHA256

    23d585908216ba8d5a2e1f8e3f03ac17220d1b16fb1a1a056832cd5b3db98dca

    SHA512

    bf2736fae75867737ed11d6a2eccce3cd35c01ead39deeee98e3f6535c081c0d58f72a3d6c068e32d1af3c97a468e5915b7806ba87d9ec0aaf961bf601e9a964

  • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe

    Filesize

    376KB

    MD5

    8b01bb02b7aeb097ba96dc7628575ca0

    SHA1

    11046fb024f695b1dc7a3a0be9167cb4e85548c6

    SHA256

    7abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a

    SHA512

    64cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35

  • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe

    Filesize

    376KB

    MD5

    8b01bb02b7aeb097ba96dc7628575ca0

    SHA1

    11046fb024f695b1dc7a3a0be9167cb4e85548c6

    SHA256

    7abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a

    SHA512

    64cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35

  • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe

    Filesize

    376KB

    MD5

    8b01bb02b7aeb097ba96dc7628575ca0

    SHA1

    11046fb024f695b1dc7a3a0be9167cb4e85548c6

    SHA256

    7abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a

    SHA512

    64cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35

  • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\cce0b158-23da-4e53-be3c-5a65f7af933e\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe

    Filesize

    819KB

    MD5

    430e12f2a40eb7312b9518520680eba8

    SHA1

    030e688cd031b6f93a318a11abd677c408907871

    SHA256

    e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941

    SHA512

    43b79954e04ecee98fa02be9bbb8338efd93979f6d46924a6fea9d7ff1d56e797a7422de79456a861354aaecc9a795d3721a61320be371ef4847f563ac4f2bb0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    9KB

    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • memory/1288-142-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1288-138-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1288-136-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1288-134-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1288-133-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/1708-146-0x0000000002121000-0x00000000021B2000-memory.dmp

    Filesize

    580KB

  • memory/2772-167-0x0000000000AC8000-0x0000000000AF4000-memory.dmp

    Filesize

    176KB

  • memory/2772-169-0x0000000000910000-0x000000000095A000-memory.dmp

    Filesize

    296KB

  • memory/4280-145-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4280-160-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4280-147-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4280-152-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/4772-137-0x0000000002360000-0x000000000247B000-memory.dmp

    Filesize

    1.1MB

  • memory/4772-135-0x00000000022C7000-0x0000000002358000-memory.dmp

    Filesize

    580KB

  • memory/4988-165-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/4988-168-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/4988-170-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB

  • memory/4988-171-0x0000000000400000-0x000000000045E000-memory.dmp

    Filesize

    376KB