Analysis

  • max time kernel
    159s
  • max time network
    204s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/10/2023, 10:38

General

  • Target

    97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe

  • Size

    738KB

  • MD5

    a728ffeedadb894aa1db6c01e9e3920f

  • SHA1

    3a00d95c56cb353486a4c7deeebf33e13951428d

  • SHA256

    97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc

  • SHA512

    74c7b08285fe94d90239ac8781687f89ec9da57045a612de5cac1a895eee3bf037e24a1ca5a5491f44ba5892ea06a4a6f542c6e53eeece20531ddfd6ed3d2bcd

  • SSDEEP

    12288:NoQ9ym7sbNqZhrTX3qXqh4n8gxXuJSTCZoZmoowiA1aWDY1e2SSPiNN:NoQcm/qXqh4nJXOPkLionDPk2N

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .wwpl

  • offline_id

    LtYnlJvK0hICyOCeum6Tv4pbia9jcIGHVgA3Xht1

  • payload_url

    http://colisumy.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-xoUXGr6cqT Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0786JOsie

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 10 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe
    "C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe
      "C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:4056
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\53ee8169-bceb-4fb0-acd3-931dec043476" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:2028
      • C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe
        "C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:5044
        • C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe
          "C:\Users\Admin\AppData\Local\Temp\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
            PID:3084
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 3084 -s 568
              5⤵
              • Program crash
              PID:1148
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3084 -ip 3084
      1⤵
        PID:2548

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\53ee8169-bceb-4fb0-acd3-931dec043476\97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc.exe

        Filesize

        738KB

        MD5

        a728ffeedadb894aa1db6c01e9e3920f

        SHA1

        3a00d95c56cb353486a4c7deeebf33e13951428d

        SHA256

        97f5ba88957bcddbe310c6636e508b4621834955e2177d8d4bc9eb7faa90e2dc

        SHA512

        74c7b08285fe94d90239ac8781687f89ec9da57045a612de5cac1a895eee3bf037e24a1ca5a5491f44ba5892ea06a4a6f542c6e53eeece20531ddfd6ed3d2bcd

      • memory/1676-1-0x0000000002320000-0x000000000243B000-memory.dmp

        Filesize

        1.1MB

      • memory/1676-4-0x00000000021E0000-0x0000000002271000-memory.dmp

        Filesize

        580KB

      • memory/1676-0-0x00000000021E0000-0x0000000002271000-memory.dmp

        Filesize

        580KB

      • memory/3084-26-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/3084-24-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/3084-23-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-6-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-15-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-18-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-5-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-3-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/4056-2-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

      • memory/5044-21-0x0000000002170000-0x0000000002201000-memory.dmp

        Filesize

        580KB