Malware Analysis Report

2025-08-05 17:09

Sample ID 230331-s3ysfsbb55
Target f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c
SHA256 f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c

Threat Level: Known bad

The file f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Modifies system certificate store

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2023-03-31 15:39

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2023-03-31 15:39

Reported

2023-03-31 15:46

Platform

win10v2004-20230221-en

Max time kernel

303s

Max time network

369s

Command Line

"C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\89734b94-1474-48f1-b839-966ca176633e\\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

Modifies system certificate store

evasion spyware trojan
Description Indicator Process Target
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c0000000100000004000000000800000f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 324 wrote to memory of 2496 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 2496 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Windows\SysWOW64\icacls.exe
PID 2496 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Windows\SysWOW64\icacls.exe
PID 2496 wrote to memory of 3912 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Windows\SysWOW64\icacls.exe
PID 2496 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 2496 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe
PID 2496 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe

Processes

C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe

"C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe"

C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe

"C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\89734b94-1474-48f1-b839-966ca176633e" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe

"C:\Users\Admin\AppData\Local\Temp\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 209.197.3.8:80 tcp
US 52.182.143.208:443 tcp
US 52.182.143.210:443 tcp
US 204.79.197.200:443 tcp
US 8.8.8.8:53 233.141.123.20.in-addr.arpa udp
US 209.197.3.8:80 tcp
NL 173.223.113.164:443 tcp
NL 173.223.113.131:80 tcp
US 204.79.197.203:80 tcp
US 8.8.8.8:53 254.155.27.67.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 api.2ip.ua udp
NL 162.0.217.254:443 api.2ip.ua tcp
US 8.8.8.8:53 254.217.0.162.in-addr.arpa udp
US 8.8.8.8:53 7.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 crl.comodoca.com udp
US 172.64.155.188:80 crl.comodoca.com tcp
US 8.8.8.8:53 2.36.159.162.in-addr.arpa udp
US 8.8.8.8:53 188.155.64.172.in-addr.arpa udp
US 8.8.8.8:53 86.23.85.13.in-addr.arpa udp
US 8.8.8.8:53 126.22.238.8.in-addr.arpa udp
US 8.8.8.8:53 76.38.195.152.in-addr.arpa udp
US 8.8.8.8:53 68.32.18.104.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp

Files

memory/2496-134-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2496-135-0x0000000000400000-0x0000000000537000-memory.dmp

memory/324-136-0x0000000002740000-0x000000000285B000-memory.dmp

memory/2496-137-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2496-140-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2496-154-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\89734b94-1474-48f1-b839-966ca176633e\f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c.exe

MD5 e5a01ac0fdc56bedef4e05c92a6d0f18
SHA1 59717771b834d04bf8b90112623b15774b69549d
SHA256 f17d58b44d1c50e97145890d241c8e5b08fc9d53318b8d98f5c83801ff0fca4c
SHA512 d0ee6acff372030d7484af8445ad21613c4d42fee69c1dfc1d0fa9dcfea31fef2d7c757b46823f32f658d5eebb5c95c8015dc8a967b9a048413fbb493e2b4034

memory/2496-157-0x0000000000400000-0x0000000000537000-memory.dmp