Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Resubmissions

24/12/2023, 18:24

231224-w112ksffdr 10

24/12/2023, 18:21

231224-wzcycsfchm 10

07/11/2023, 17:16

231107-vs31jadh73 10

Analysis

  • max time kernel
    148s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/12/2023, 18:21

General

  • Target

    95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe

  • Size

    765KB

  • MD5

    52f22c2a5b2c339e75f176bf5bfcb3f3

  • SHA1

    0a3b96aa59d5eda04c731bfb9c2ba7fef997d1b9

  • SHA256

    95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4

  • SHA512

    ec5f24367c46ff558110022ad8e1106fe5d1d9b9f94cf423b0cd1e1cd7d5ee3111e16cc12ccf3d6e65c5a5d5358691726172e33fb6338e1b7291be9566766da8

  • SSDEEP

    12288:mokzmesNcOJCG4jm2E2SLZJsiXlg8XGB2P3yo1jaUPC4t56ha6DJof5:izk/QDo2SVJsylBXjVNPyvu

Malware Config

Extracted

Family

djvu

C2

http://zexeq.com/test1/get.php

Attributes
  • extension

    .jzeq

  • offline_id

    4FMaMDK6uqPZOxJj64677pqiSGF54A1Dam9zfUt1

  • payload_url

    http://colisumy.com/dl/build2.exe

    http://zexeq.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TAbs6oTGSU Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0821ASdw

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 17 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
    "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2212
    • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
      "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2280
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\234e9d17-043f-49e3-8365-014a2794f1ef" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        PID:4052
      • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
        "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:4016
        • C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe
          "C:\Users\Admin\AppData\Local\Temp\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • Checks computer location settings
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of WriteProcessMemory
          PID:996
          • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe
            "C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"
            5⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:776
            • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe
              "C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe"
              6⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:3388
  • C:\Windows\SysWOW64\schtasks.exe
    /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
    1⤵
    • Creates scheduled task(s)
    PID:4324
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4976
    • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3248
      • C:\Windows\SysWOW64\schtasks.exe
        /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
        3⤵
        • Creates scheduled task(s)
        PID:3628
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    1⤵
    • Executes dropped EXE
    PID:3804

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    1KB

    MD5

    ad1b831e6b39763c118dd6bf34d8641a

    SHA1

    43e23a3d91315736f59751521ade3224f45ece86

    SHA256

    fe673f5da906667a2f5b08f086d292da711c854fce0268f8e4ed7d4d6e62d58a

    SHA512

    cabe0d43a8bc792b9725af5bdb918a7edfe4e7542771cceb57d8686fab0c2c1a5201346f8e960ee31cfa46c1c291d59bcee04b867ff43dfea2520066c8da3fc1

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

    Filesize

    410B

    MD5

    d0348475d97cbf142823f89361bf1631

    SHA1

    bb08be152141c14ad3701acca78fbadcd534750c

    SHA256

    f99b15705d6c99e228d1fd844eb03e57283c509018e6fad558b6e9b08e8d4b9c

    SHA512

    53d977be6ca52a93171f5da178316336afddf6a16e0f580d915a6378473ed66fb69b9275a7534733cd43ed6fdcd4f9118f535495e15627e2eedfe57b49fcb6e9

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

    Filesize

    392B

    MD5

    f188017dd83e83c8d10095c45c5e46dd

    SHA1

    c245c973bf37a5413ce9dc8f9ff3338c5ea88e3b

    SHA256

    9f7af5d37856852a54ec9f820532b55a4457f3ae16b0d5edc02e3d31131cd5e5

    SHA512

    9ad8b3e9e78610ca8884b2bd0075fd6565e31eff076222732e24a240eb52b5961b48735fa1fb7a427ca96a3030443c1ff77c77e79fac90c97b0fd216f4615bfd

  • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe

    Filesize

    123KB

    MD5

    eccf76919c29ef71366b42f4c90c6eed

    SHA1

    f290614fbadb8394195c6ca21b262eb443b4da70

    SHA256

    9ace70192eba0778261d2850efe915d7c5dbd58b316629b3c6da8e87e4d9cf59

    SHA512

    58e8b4dc3183841d2b6bb5dcbf4822d6c1a81e6c7d87653a7422ef8d26719ca6700430b703e55ce0f970415512a116156b0fee70efa3eeeb00ea7bf459d5cc17

  • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe

    Filesize

    109KB

    MD5

    9b0a4e50f7a3759d0b0602d44f052721

    SHA1

    ac52bcfce67c9415ba2057005f7d9137b99d575b

    SHA256

    ca3b686e64ed6f43cfb32fc12a83cbeab9fcfc7712f88ad404f4497d9a4787bf

    SHA512

    da3ceb7b4441cd32e879612d3044e101f2d5fb129896606965ed63001119cc4960c3abb9dbf5429d14fc4fa72d6700beaf865038dbb326dd36d3ac34c805a29a

  • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe

    Filesize

    127KB

    MD5

    3fde9f5ea22bc162a08ac6d11b91fe47

    SHA1

    e02cf18803a21bbd21cf70cbf3c5c62e480dbfe1

    SHA256

    1ad4bbc9e8a76999ba10038c5c0925dda39bb480a58b4101d8e861026d4de208

    SHA512

    b2238ab5c41f9f957e10841c8c23808c660f5440caee78eca03e214ca7db6ed86467ab7162b90b89c56c3f671e29d40fc1bd49fcbb80f766eba30a9fc133cbc1

  • C:\Users\Admin\AppData\Local\19cf3f99-ca3c-4c7c-866a-e2efd9729a89\build3.exe

    Filesize

    57KB

    MD5

    74ae9689cb04bde426e036319feeb49b

    SHA1

    b932fd3571f6113cacf1e5eb2b3453a05887963c

    SHA256

    b59f5c8dc70d0092f4257c3e13745f67e6324edeee709eff32336d3c93bca180

    SHA512

    642d69ab7ef11418b9d97cfa8882ba38ba5c08fcec428a8a758b9de8ee1d576b4d1fe1a2ca93dc4f1f5e6a8eba8c21f7309975c0c43033350d51e5efe7fcafca

  • C:\Users\Admin\AppData\Local\234e9d17-043f-49e3-8365-014a2794f1ef\95e9cb14d98addba28afd394f68a90d4500fa5396a6b27fdbe5024bd17f972b4.exe

    Filesize

    65KB

    MD5

    c37efeb4ac415ddb19de2bf576ce920b

    SHA1

    a099cf9eefddea9c46c1a385055ea75ff0e6a254

    SHA256

    03391acd52a3640f58172b539d705b671d68db4d627e08f9cc6ec2a2e2582f1e

    SHA512

    54f1802269ed3e4c7f7358edc24375ac8828561b427549d41736d3abbae933afb680f9bc4bfb214d19b0c9cf42f2e3b205e47df2fdd6845786da4b3477f72f58

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe

    Filesize

    299KB

    MD5

    41b883a061c95e9b9cb17d4ca50de770

    SHA1

    1daf96ec21d53d9a4699cea9b4db08cda6fbb5ad

    SHA256

    fef2c8ca07c500e416fd7700a381c39899ee26ce1119f62e7c65cf922ce8b408

    SHA512

    cdd1bb3a36182575cd715a52815765161eeaa3849e72c1c2a9a4e84cc43af9f8ec4997e642702bb3de41f162d2e8fd8717f6f8302bba5306821ee4d155626319

  • memory/776-59-0x0000000000910000-0x0000000000914000-memory.dmp

    Filesize

    16KB

  • memory/776-57-0x0000000000930000-0x0000000000A30000-memory.dmp

    Filesize

    1024KB

  • memory/996-27-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-51-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-22-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-28-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-20-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-34-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-35-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-32-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-48-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/996-21-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2212-1-0x00000000025D0000-0x000000000266A000-memory.dmp

    Filesize

    616KB

  • memory/2212-2-0x0000000002790000-0x00000000028AB000-memory.dmp

    Filesize

    1.1MB

  • memory/2280-15-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2280-6-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2280-5-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2280-4-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/2280-3-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

  • memory/3388-56-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3388-61-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/3388-64-0x0000000000410000-0x00000000004D9000-memory.dmp

    Filesize

    804KB

  • memory/3388-63-0x0000000000400000-0x0000000000406000-memory.dmp

    Filesize

    24KB

  • memory/4016-18-0x00000000009B0000-0x0000000000A52000-memory.dmp

    Filesize

    648KB

  • memory/4976-77-0x0000000000960000-0x0000000000A60000-memory.dmp

    Filesize

    1024KB