Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
150s -
max time network
133s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17/09/2022, 00:38
Static task
static1
Behavioral task
behavioral1
Sample
e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
Resource
win10v2004-20220812-en
General
-
Target
e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
-
Size
819KB
-
MD5
430e12f2a40eb7312b9518520680eba8
-
SHA1
030e688cd031b6f93a318a11abd677c408907871
-
SHA256
e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941
-
SHA512
43b79954e04ecee98fa02be9bbb8338efd93979f6d46924a6fea9d7ff1d56e797a7422de79456a861354aaecc9a795d3721a61320be371ef4847f563ac4f2bb0
-
SSDEEP
24576:n6XReUO6pPJNcHBt6Z8rBPJIyqHjf+Wkhkhbzi:nkRtBeTL1PQHjKg
Malware Config
Extracted
djvu
http://acacaca.org/test3/get.php
-
extension
.aamv
-
offline_id
MyudhIExJux2oRQXw95TT1oAPu7mvqRMzxr1eet1
-
payload_url
http://rgyui.top/dl/build2.exe
http://acacaca.org/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-4Xcf4IX21n Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0564Jhyjd
Signatures
-
Detected Djvu ransomware 10 IoCs
resource yara_rule behavioral1/memory/1288-133-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1288-134-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1288-136-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4772-137-0x0000000002360000-0x000000000247B000-memory.dmp family_djvu behavioral1/memory/1288-138-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/1288-142-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4280-145-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4280-147-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4280-152-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral1/memory/4280-160-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
pid Process 2772 build2.exe 4712 build3.exe 1472 mstsca.exe 4988 build2.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 2180 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\cce0b158-23da-4e53-be3c-5a65f7af933e\\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe\" --AutoStart" e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 10 api.2ip.ua 11 api.2ip.ua 22 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4772 set thread context of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 1708 set thread context of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 2772 set thread context of 4988 2772 build2.exe 98 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1580 schtasks.exe 2796 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 4772 wrote to memory of 1288 4772 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 82 PID 1288 wrote to memory of 2180 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 84 PID 1288 wrote to memory of 2180 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 84 PID 1288 wrote to memory of 2180 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 84 PID 1288 wrote to memory of 1708 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 85 PID 1288 wrote to memory of 1708 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 85 PID 1288 wrote to memory of 1708 1288 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 85 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 1708 wrote to memory of 4280 1708 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 89 PID 4280 wrote to memory of 2772 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 90 PID 4280 wrote to memory of 2772 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 90 PID 4280 wrote to memory of 2772 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 90 PID 4280 wrote to memory of 4712 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 91 PID 4280 wrote to memory of 4712 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 91 PID 4280 wrote to memory of 4712 4280 e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe 91 PID 4712 wrote to memory of 1580 4712 build3.exe 92 PID 4712 wrote to memory of 1580 4712 build3.exe 92 PID 4712 wrote to memory of 1580 4712 build3.exe 92 PID 1472 wrote to memory of 2796 1472 mstsca.exe 96 PID 1472 wrote to memory of 2796 1472 mstsca.exe 96 PID 1472 wrote to memory of 2796 1472 mstsca.exe 96 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98 PID 2772 wrote to memory of 4988 2772 build2.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4772 -
C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\cce0b158-23da-4e53-be3c-5a65f7af933e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe"C:\Users\Admin\AppData\Local\Temp\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4280 -
C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build2.exe"6⤵
- Executes dropped EXE
PID:4988
-
-
-
C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe"C:\Users\Admin\AppData\Local\8da4f64c-8bdf-4bd0-b01b-56018ab5485f\build3.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4712 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"6⤵
- Creates scheduled task(s)
PID:1580
-
-
-
-
-
-
C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exeC:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"2⤵
- Creates scheduled task(s)
PID:2796
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize2KB
MD5ea3ead1b160922fb25b1b9d766a56fa5
SHA19f61cb0a5a80fa5ba776f71fed4728d002d3aca1
SHA2564080213fba647d43c0ac02710ac7b631c23f8f791930016045cda9aeec1b6867
SHA512ec817bdc668bff4c266ca8b6a6c4068251926714262a95f9ac7f7565e2d66a26371589182d0ba1d03fa482d99430b865cb7eb24becf92b72e45f20b26a215c15
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD5e9e482bf825221326b7c080ef52e5036
SHA167244c170dad567630298f89364a5e9626e2517a
SHA25660843d5086f10e833ca98696967f1a39ea04a2ffee6d87679b5803092b9cfa71
SHA512c7a5fd63c0faa2a5cd8be90c7dcf10d8dd564964dc4b8ab4fa1a7a188fa89094563f595c94f4ea133582cfbcf9cc90cb74bd273924b7fa5eadae868bced51440
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Filesize488B
MD57a872f63a51cea12a63317c79ecaca9f
SHA1e9a9fde4a0baf22db7272f44a1cb03be8f329806
SHA256e603799d9b7f61fd6c94a61d5999cb3f5864d419c57aec2594a7d5b2e19c9ad3
SHA512cfc5f137c95ba887689a59e0b5bac2a2cce3d756bded6f227dbb6a4d67e2f88335bc478d9a741d9f94fdd3c4b7948366c41b3fd5c6edf2268c3b0058dcca0c34
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5d461a8eac8a8324056ef55b8603468df
SHA1441efd901093350d55ce722f1cd57ef28b999a95
SHA25623d585908216ba8d5a2e1f8e3f03ac17220d1b16fb1a1a056832cd5b3db98dca
SHA512bf2736fae75867737ed11d6a2eccce3cd35c01ead39deeee98e3f6535c081c0d58f72a3d6c068e32d1af3c97a468e5915b7806ba87d9ec0aaf961bf601e9a964
-
Filesize
376KB
MD58b01bb02b7aeb097ba96dc7628575ca0
SHA111046fb024f695b1dc7a3a0be9167cb4e85548c6
SHA2567abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a
SHA51264cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35
-
Filesize
376KB
MD58b01bb02b7aeb097ba96dc7628575ca0
SHA111046fb024f695b1dc7a3a0be9167cb4e85548c6
SHA2567abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a
SHA51264cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35
-
Filesize
376KB
MD58b01bb02b7aeb097ba96dc7628575ca0
SHA111046fb024f695b1dc7a3a0be9167cb4e85548c6
SHA2567abb4b2423a93fa4b7a2cd19bcc854cc96d2e9ed20c13b86c39f49fe7cb80e4a
SHA51264cd772d4e319255e32909577ac137966cd47bd295aa3a61a76e52d651d80d313a3cfee7ea88d703bb293931a91558161184de2b76f8e5d9a2358a065c5c5f35
-
Filesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
Filesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
C:\Users\Admin\AppData\Local\cce0b158-23da-4e53-be3c-5a65f7af933e\e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941.exe
Filesize819KB
MD5430e12f2a40eb7312b9518520680eba8
SHA1030e688cd031b6f93a318a11abd677c408907871
SHA256e3ad0fc5b521683dfefac6709a8313009380072bfd1df8847056507f7f9c1941
SHA51243b79954e04ecee98fa02be9bbb8338efd93979f6d46924a6fea9d7ff1d56e797a7422de79456a861354aaecc9a795d3721a61320be371ef4847f563ac4f2bb0
-
Filesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a
-
Filesize
9KB
MD59ead10c08e72ae41921191f8db39bc16
SHA1abe3bce01cd34afc88e2c838173f8c2bd0090ae1
SHA2568d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0
SHA512aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a