djvu | d76730739de688d0598bba500856909a7800c26a2b09ffb2e111c385c6448d94

Analysis

max time kernel
33s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/12/2023, 19:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2ceb3343bc2673461aadd7fc703bd421.exe
Size 256KB
Sample231215-x5hapsghgp
SHA256 d76730739de688d0598bba500856909a7800c26a2b09ffb2e111c385c6448d94
MD5 2ceb3343bc2673461aadd7fc703bd421
SHA1 9867874baab5d3aa24dfc728204e4b2a15bdacc2
SHA512 ef5ab0960122d22c4c937cbaed17d898355fb8a600a95e4662be453c6a5a0492154bb87b5aa54907e9e41b7a0543eb6e9659f7b07500fb35a0fda94b9446a7a4
SSDEEP 6144:2nxDu7LCBb1K+qUI4El0lL+4lTLYvKGvV2jfn:2o3wbI+qUI4FL+eT+/vV2jv
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu smokeloader up3 backdoor discovery persistence ransomware trojan

Malware Config

Extracted

Family

smokeloader

Botnet

Extracted

Family

smokeloader

Version

2020

http://host-file-host6.com/
http://host-host-file8.com/

rc4.i32

Extracted

Family

djvu

http://zexeq.com/test1/get.php

Attributes

extension
.ljuy
offline_id
B5moRKh7Z0xwbuNave594QPrrx2R2HOTp49pUFt1
payload_url
http://brusuax.com/dl/build2.exe

http://zexeq.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mFyI2phKff Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0836ASdw

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 5 IoCs

resource	yara_rule
behavioral2/memory/3880-26-0x0000000002690000-0x00000000027AB000-memory.dmp	family_djvu
behavioral2/memory/1112-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1112-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1112-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/1112-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file

Deletes itself 1 IoCs

pid	Process
3328	Process not Found

Executes dropped EXE 2 IoCs

pid	Process
3880	E05F.exe
1112	E05F.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4576	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-996941297-2279405024-2328152752-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8bd72a5f-7bd0-4f95-b21a-4d4dfa53bf85\\E05F.exe\" --AutoStart"	E05F.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
53	api.2ip.ua
55	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1964 set thread context of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 3880 set thread context of 1112	3880	E05F.exe	98

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ceb3343bc2673461aadd7fc703bd421.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ceb3343bc2673461aadd7fc703bd421.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ceb3343bc2673461aadd7fc703bd421.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
672	2ceb3343bc2673461aadd7fc703bd421.exe
672	2ceb3343bc2673461aadd7fc703bd421.exe
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found
3328	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
672	2ceb3343bc2673461aadd7fc703bd421.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found
Token: SeShutdownPrivilege	3328	Process not Found
Token: SeCreatePagefilePrivilege	3328	Process not Found

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 1964 wrote to memory of 672	1964	2ceb3343bc2673461aadd7fc703bd421.exe	88
PID 3328 wrote to memory of 5040	3328	Process not Found	91
PID 3328 wrote to memory of 5040	3328	Process not Found	91
PID 5040 wrote to memory of 2204	5040	cmd.exe	93
PID 5040 wrote to memory of 2204	5040	cmd.exe	93
PID 3328 wrote to memory of 3056	3328	Process not Found	94
PID 3328 wrote to memory of 3056	3328	Process not Found	94
PID 3056 wrote to memory of 2952	3056	cmd.exe	96
PID 3056 wrote to memory of 2952	3056	cmd.exe	96
PID 3328 wrote to memory of 3880	3328	Process not Found	97
PID 3328 wrote to memory of 3880	3328	Process not Found	97
PID 3328 wrote to memory of 3880	3328	Process not Found	97
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 3880 wrote to memory of 1112	3880	E05F.exe	98
PID 1112 wrote to memory of 4576	1112	E05F.exe	99
PID 1112 wrote to memory of 4576	1112	E05F.exe	99
PID 1112 wrote to memory of 4576	1112	E05F.exe	99
PID 3328 wrote to memory of 320	3328	Process not Found	100
PID 3328 wrote to memory of 320	3328	Process not Found	100
PID 3328 wrote to memory of 320	3328	Process not Found	100

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\2ceb3343bc2673461aadd7fc703bd421.exe
"C:\Users\Admin\AppData\Local\Temp\2ceb3343bc2673461aadd7fc703bd421.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\2ceb3343bc2673461aadd7fc703bd421.exe
  "C:\Users\Admin\AppData\Local\Temp\2ceb3343bc2673461aadd7fc703bd421.exe"
  2⤵
  - Checks SCSI registry key(s)
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  PID:672

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C498.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2204

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\C748.bat" "
1⤵
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Windows\system32\reg.exe
  reg add "HKEY_CURRENT_USER\Software\clicker\key" /v primary /t REG_DWORD /d 1
  2⤵
  PID:2952

C:\Users\Admin\AppData\Local\Temp\E05F.exe
C:\Users\Admin\AppData\Local\Temp\E05F.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3880
- C:\Users\Admin\AppData\Local\Temp\E05F.exe
  C:\Users\Admin\AppData\Local\Temp\E05F.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of WriteProcessMemory
  PID:1112
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8bd72a5f-7bd0-4f95-b21a-4d4dfa53bf85" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4576

C:\Users\Admin\AppData\Local\Temp\E969.exe
C:\Users\Admin\AppData\Local\Temp\E969.exe
1⤵
PID:320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E05F.exe

Path C:\Users\Admin\AppData\Local\8bd72a5f-7bd0-4f95-b21a-4d4dfa53bf85\E05F.exe
Size 723KB
SHA256 fb037be4ea4f37b3f34669cb8d735c8870ab12e6f6a66f9f8769352eff8c3601
MD5 04f187f5409a2587935e2a224effbac2
SHA1 8c065ca90955df90a476fee8b542921578cc0e5f
SHA512 9264fa1b4289c25130a44f6f132f46eca614d64939f1d42641e2c588579bc376467695f7f15387cbdf9b1eb2e1c960531e1403a84c90abff10acb2f2f5b8cc13
SSDEEP 12288:X2pTXNseIyvBIDc597Uq4XY9xVYcHcDVs4B860r8mnp+iyU6DVv8ijnT:GpTPIyv+Sgq19LYcHaVvjc19y1
MD5 SHA1 SHA512 SSDEEP

Submit Download

C498.bat

Path C:\Users\Admin\AppData\Local\Temp\C498.bat
Size 77B
SHA256 d6cceb3c71b80403364bf142f2fa4624ee0be36a49bac25ed45a497cf1ce9c3a
MD5 55cc761bf3429324e5a0095cab002113
SHA1 2cc1ef4542a4e92d4158ab3978425d517fafd16d
SHA512 33f9f5cad22d291077787c7df510806e4ac31f453d288712595af6debe579fabed6cdf4662e46e6fa94de135b161e739f55cfae05c36c87af85ed6a6ad1c9155
MD5 SHA1 SHA512

Submit Download

E05F.exe

Path C:\Users\Admin\AppData\Local\Temp\E05F.exe
Size 765KB
SHA256 cf2e7c968a1047f82dd350815b834985dfe89a145e52188e6c706a2cb5184b6f
MD5 4ffe2bae0bbd4d6bf8c5635e66243b2f
SHA1 8a8a6aa5e1fec3e3ce87e32fffa9eea31de4e959
SHA512 6ef6f28e06061d6c9a47e339fbd7ec5eb7508946f59daf640319fc1759d61c5dc8d53496ed016edfab6025ef0aafcef644344e92245757875767f2042fa0b78f
SSDEEP 12288:X2pTXNseIyvBIDc597Uq4XY9xVYcHcDVs4B860r8mnp+iyU6DVv8ijnT7:GpTPIyv+Sgq19LYcHaVvjc19y11
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/672-4-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/672-7-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/672-3-0x0000000000400000-0x0000000000409000-memory.dmp

Download

memory/1112-27-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1112-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1112-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1112-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/1964-1-0x0000000000AD0000-0x0000000000BD0000-memory.dmp

Download

memory/1964-2-0x0000000000A60000-0x0000000000A69000-memory.dmp

Download

memory/3328-5-0x00000000012C0000-0x00000000012D6000-memory.dmp

Download

memory/3880-25-0x00000000024E0000-0x000000000257C000-memory.dmp

Download

memory/3880-26-0x0000000002690000-0x00000000027AB000-memory.dmp

Download