Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231127-en -
resource tags
arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system -
submitted
02-12-2023 10:25
Static task
static1
Behavioral task
behavioral1
Sample
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
Resource
win7-20231020-en
Behavioral task
behavioral2
Sample
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
Resource
win10v2004-20231127-en
General
-
Target
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
-
Size
807KB
-
MD5
c8f255dd1d501e90d5b383fe057d056b
-
SHA1
66549427459c996431584a6d597e5b755f0f4bae
-
SHA256
ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054
-
SHA512
0cf26c04a2c6abf39b684e9501cf0dbc82b0f8d0ecd3d53b62c192c2b1e31d548ea58ce2054f4be40f4afe5a7b7d398c99e75e2a0a62d5ab0070cca45dacff0c
-
SSDEEP
24576:yQhoQwr33TTTXutUnq2/DFcrfun0EOAO7sHcQEzEJSgaBrI:yQho3r33DDdrhnXRpjJS
Malware Config
Extracted
djvu
http://zexeq.com/test1/get.php
-
extension
.jazi
-
offline_id
UlJXrkKDIkENh0vb5W9For2Yyh6riGytjO5p2St1
-
payload_url
http://brusuax.com/dl/build2.exe
http://zexeq.com/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-iu965qqEb1 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0830Usdk
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral2/memory/4324-2-0x0000000002580000-0x000000000269B000-memory.dmp family_djvu behavioral2/memory/3272-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3272-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3272-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3272-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3272-15-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4308-20-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4308-21-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4308-23-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\Control Panel\International\Geo\Nation NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1067295379-1486014338-1703171060-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e0daa11d-c57c-4321-96da-0bb0df1d5734\\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe\" --AutoStart" NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe -
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 34 api.2ip.ua 35 api.2ip.ua -
Suspicious use of SetThreadContext 2 IoCs
Processes:
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exeNEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exedescription pid process target process PID 4324 set thread context of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 set thread context of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3984 4308 WerFault.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exepid process 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exeNEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exeNEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exedescription pid process target process PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4324 wrote to memory of 3272 4324 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 3272 wrote to memory of 208 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe icacls.exe PID 3272 wrote to memory of 208 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe icacls.exe PID 3272 wrote to memory of 208 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe icacls.exe PID 3272 wrote to memory of 4020 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 3272 wrote to memory of 4020 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 3272 wrote to memory of 4020 3272 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe PID 4020 wrote to memory of 4308 4020 NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e0daa11d-c57c-4321-96da-0bb0df1d5734" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe"C:\Users\Admin\AppData\Local\Temp\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exe" --Admin IsNotAutoStart IsNotTask4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4308 -s 2245⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4308 -ip 43081⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\e0daa11d-c57c-4321-96da-0bb0df1d5734\NEAS.ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054.exeFilesize
807KB
MD5c8f255dd1d501e90d5b383fe057d056b
SHA166549427459c996431584a6d597e5b755f0f4bae
SHA256ae8c13e3aa1b5b5f4bd7870b47a0a408b462834a4b8efc19ffaa758b674eb054
SHA5120cf26c04a2c6abf39b684e9501cf0dbc82b0f8d0ecd3d53b62c192c2b1e31d548ea58ce2054f4be40f4afe5a7b7d398c99e75e2a0a62d5ab0070cca45dacff0c
-
memory/3272-3-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3272-4-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3272-5-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3272-6-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/3272-15-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4020-18-0x0000000002500000-0x000000000259F000-memory.dmpFilesize
636KB
-
memory/4308-20-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4308-21-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4308-23-0x0000000000400000-0x0000000000537000-memory.dmpFilesize
1.2MB
-
memory/4324-1-0x00000000024A0000-0x0000000002540000-memory.dmpFilesize
640KB
-
memory/4324-2-0x0000000002580000-0x000000000269B000-memory.dmpFilesize
1.1MB