djvu | 97f59ea0be79455fe75aaf1d457b2bc1857f77e87cd4de32b99dba996e3d6ea8

Analysis

max time kernel
151s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
30/11/2022, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1B912539242FC9CE1EB94C368A426B1C.exe
Size 754KB
Sample221130-sqaj4abf39
SHA256 97f59ea0be79455fe75aaf1d457b2bc1857f77e87cd4de32b99dba996e3d6ea8
MD5 1b912539242fc9ce1eb94c368a426b1c
SHA1 8b2c0af34e04019ef0a7f2ae22e7f47926514823
SHA512 723d8398b27d7c5d1c747f9bfa6f50ffcbe6fdc369a8cb1e2e4b08077f1ff27ffb4cdf3343f49a59f89555b3b4b15d3ba8db44496f549b0902e128fcd3a4c362
SSDEEP 12288:5CqcqkJOsEyunohC5iyri5qAlv8XWsi3FnHpCINj7nLf0Dkhld:CqkJREyun4C5iYiPv1HJN/4D8d
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://acacaca.org/test1/get.php

Attributes

extension
.oori
offline_id
wL6PsLHZ5p6rQzJ0dAHpE9gRzLIyUuIaRLkyeqt1
payload_url
http://rgyui.top/dl/build2.exe

http://acacaca.org/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-6icnx2ZM3Z Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0528Jhyjd

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

resource	yara_rule
behavioral2/memory/4320-133-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4320-134-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1648-136-0x00000000023F0000-0x000000000250B000-memory.dmp	family_djvu
behavioral2/memory/4320-137-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4320-138-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4320-142-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2384-145-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2384-147-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2384-148-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2384-153-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	1B912539242FC9CE1EB94C368A426B1C.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1696	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\a04c2f57-fe6c-4d28-9b39-44127152f420\\1B912539242FC9CE1EB94C368A426B1C.exe\" --AutoStart"	1B912539242FC9CE1EB94C368A426B1C.exe

Looks up external IP address via web service 4 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	api.2ip.ua
9	api.2ip.ua
55	api.2ip.ua
56	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1648 set thread context of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1752 set thread context of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4320	1B912539242FC9CE1EB94C368A426B1C.exe
4320	1B912539242FC9CE1EB94C368A426B1C.exe
2384	1B912539242FC9CE1EB94C368A426B1C.exe
2384	1B912539242FC9CE1EB94C368A426B1C.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 1648 wrote to memory of 4320	1648	1B912539242FC9CE1EB94C368A426B1C.exe	78
PID 4320 wrote to memory of 1696	4320	1B912539242FC9CE1EB94C368A426B1C.exe	80
PID 4320 wrote to memory of 1696	4320	1B912539242FC9CE1EB94C368A426B1C.exe	80
PID 4320 wrote to memory of 1696	4320	1B912539242FC9CE1EB94C368A426B1C.exe	80
PID 4320 wrote to memory of 1752	4320	1B912539242FC9CE1EB94C368A426B1C.exe	81
PID 4320 wrote to memory of 1752	4320	1B912539242FC9CE1EB94C368A426B1C.exe	81
PID 4320 wrote to memory of 1752	4320	1B912539242FC9CE1EB94C368A426B1C.exe	81
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83
PID 1752 wrote to memory of 2384	1752	1B912539242FC9CE1EB94C368A426B1C.exe	83

C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe
"C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1648
- C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe
  "C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\a04c2f57-fe6c-4d28-9b39-44127152f420" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1696
- - C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe
    "C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:1752
  - - C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe
      "C:\Users\Admin\AppData\Local\Temp\1B912539242FC9CE1EB94C368A426B1C.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2384

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 2KB
SHA256 280fd6ae3ad21323199759814c4dd82329eb8f9847ed1fa2be145e83b4c88bf3
MD5 76e7d5bf61b2e80d159f88aa9798ce91
SHA1 32a46de50c9c02b068e39cf49b78c7e2d5ace20d
SHA512 5efd8c64ac40ae006d2ce4509eb9e5f1448fb1156e914d303e8bc4dcfe1d94c57c7eae216b362877e7b644876656cc9e5c4cebfc905bab3f8b09cb1a051d69c4
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 1KB
SHA256 64a36c1637d0a111152002a2c0385b0df9dd81b616b3f2073fbbe3f2975aa4d8
MD5 916c512d221c683beeea9d5cb311b0b0
SHA1 bf0db4b1c4566275b629efb095b6ff8857b5748e
SHA512 af32cffea722438e9b17b08062dc2e209edc5417418964ead0b392bd502e1a647a8456b2ee2ea59faf69f93d0c6ea6f15949b6c30924db7da65b91cb18e8dc6c
MD5 SHA1 SHA512

Submit Download

07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
Size 488B
SHA256 2cff31d046d274a82d1f906d376ae60ea817bb75a17bd3cc2b5e401b860c3994
MD5 7979cd76f6112014208b13e1513fca6d
SHA1 ad588585ef5b32b66731993a90c106925fe57fe6
SHA512 e083753e917c3f1817af336654880adcf94c2e741d6a31daf05fdbf7bec085a2b0e594a573935ea34ff043ee3f1829da5a67cbeb814b6e3cea2e31c76248edf2
MD5 SHA1 SHA512

Submit Download

B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Size 482B
SHA256 4b205f0d796c6a7d27dfe9376bdb4d9c8e20284df0b5a3766d8b9d81f7694b49
MD5 3d5112d933e9fa283ecf7602fc00c93b
SHA1 a7aa2025297fd5ab9745fcc4dc56b110604ea0ba
SHA512 4a065f5e5edf1636a12d6195d013c28e62ca4c2d242b01ad1ee85865d34765eb00427348b27f437f8c76dd35ec01e8b7e675e3cac8583e4171795e77773920e9
MD5 SHA1 SHA512

Submit Download

1B912539242FC9CE1EB94C368A426B1C.exe

Path C:\Users\Admin\AppData\Local\a04c2f57-fe6c-4d28-9b39-44127152f420\1B912539242FC9CE1EB94C368A426B1C.exe
Size 754KB
SHA256 97f59ea0be79455fe75aaf1d457b2bc1857f77e87cd4de32b99dba996e3d6ea8
MD5 1b912539242fc9ce1eb94c368a426b1c
SHA1 8b2c0af34e04019ef0a7f2ae22e7f47926514823
SHA512 723d8398b27d7c5d1c747f9bfa6f50ffcbe6fdc369a8cb1e2e4b08077f1ff27ffb4cdf3343f49a59f89555b3b4b15d3ba8db44496f549b0902e128fcd3a4c362
SSDEEP 12288:5CqcqkJOsEyunohC5iyri5qAlv8XWsi3FnHpCINj7nLf0Dkhld:CqkJREyun4C5iYiPv1HJN/4D8d
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1648-135-0x00000000009B6000-0x0000000000A48000-memory.dmp

Download

memory/1648-136-0x00000000023F0000-0x000000000250B000-memory.dmp

Download

memory/1752-146-0x00000000006EB000-0x000000000077D000-memory.dmp

Download

memory/2384-148-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2384-153-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2384-145-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2384-147-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4320-137-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4320-142-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4320-138-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4320-134-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4320-133-0x0000000000400000-0x0000000000537000-memory.dmp

Download