djvu | 0dbb33b5aaa39d7e5b04eb88bbc5e8602e2ebfa84b3cb26ea4c70d6ef4c32b1e

Analysis

max time kernel
151s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/01/2024, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
58c8b9e8d891ee5527394759dc0f33f5.exe
Size 688KB
Sample240113-nc2zzahhd7
SHA256 0dbb33b5aaa39d7e5b04eb88bbc5e8602e2ebfa84b3cb26ea4c70d6ef4c32b1e
MD5 58c8b9e8d891ee5527394759dc0f33f5
SHA1 e4f3a7d684d781ce244b08b0a2bfa8210c7c9c11
SHA512 c5a64ee34df5c69b9d58f9eb554fa7c5173916bbc8bfe0085fb2f844fc5a584c99f260d56c8bd2c34f2b8b7a237161315d0c9b76dc718c0b7a2801a907913b90
SSDEEP 12288:PjSMjSgO+B0QIk5d+KjL25foGXo33KZRPCb2t9VAtVOvVC11lc:rSM2gO+B0QQKjK5gGXoqZRPPtAGVC
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://astdg.top/fhsgtsspen6/get.php

Attributes

extension
.orkf
offline_id
4aBXQVNZ4BhjpMjt78QLIFtBSJPbgbflYLHrBut1
payload_url
http://securebiz.org/dl/build2.exe

http://astdg.top/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0328gDrgo

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 14 IoCs

resource	yara_rule
behavioral2/memory/3560-2-0x0000000003C50000-0x0000000003D6B000-memory.dmp	family_djvu
behavioral2/memory/2912-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2912-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2912-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2912-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2912-15-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4544-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4544-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4544-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/440-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/440-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/440-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/440-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/440-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation	58c8b9e8d891ee5527394759dc0f33f5.exe

Executes dropped EXE 2 IoCs

pid	Process
4904	58c8b9e8d891ee5527394759dc0f33f5.exe
440	58c8b9e8d891ee5527394759dc0f33f5.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1688	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\2d81de04-be92-4db5-95f7-9a546b38aad1\\58c8b9e8d891ee5527394759dc0f33f5.exe\" --AutoStart"	58c8b9e8d891ee5527394759dc0f33f5.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
17	api.2ip.ua
19	api.2ip.ua
97	api.2ip.ua

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 3560 set thread context of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 5036 set thread context of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 4904 set thread context of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1788	4544	WerFault.exe	98

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2912	58c8b9e8d891ee5527394759dc0f33f5.exe
2912	58c8b9e8d891ee5527394759dc0f33f5.exe
440	58c8b9e8d891ee5527394759dc0f33f5.exe
440	58c8b9e8d891ee5527394759dc0f33f5.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 3560 wrote to memory of 2912	3560	58c8b9e8d891ee5527394759dc0f33f5.exe	91
PID 2912 wrote to memory of 1688	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	95
PID 2912 wrote to memory of 1688	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	95
PID 2912 wrote to memory of 1688	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	95
PID 2912 wrote to memory of 5036	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	96
PID 2912 wrote to memory of 5036	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	96
PID 2912 wrote to memory of 5036	2912	58c8b9e8d891ee5527394759dc0f33f5.exe	96
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 5036 wrote to memory of 4544	5036	58c8b9e8d891ee5527394759dc0f33f5.exe	98
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120
PID 4904 wrote to memory of 440	4904	58c8b9e8d891ee5527394759dc0f33f5.exe	120

C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe
"C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe
  "C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2912
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1688
- - C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe
    "C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:5036
  - - C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe
      "C:\Users\Admin\AppData\Local\Temp\58c8b9e8d891ee5527394759dc0f33f5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:4544
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 4544 -s 568
        5⤵
        Program crash
        
        PID:1788

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4544 -ip 4544
1⤵
PID:3804

C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1\58c8b9e8d891ee5527394759dc0f33f5.exe
C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1\58c8b9e8d891ee5527394759dc0f33f5.exe --Task
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1\58c8b9e8d891ee5527394759dc0f33f5.exe
  C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1\58c8b9e8d891ee5527394759dc0f33f5.exe --Task
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 ff76c6098703c7c12b1e212211cba794c40bca8635a0a3d401bab934a4f3057e
MD5 00c9c6e48b820c8c0de93fc516bf4d49
SHA1 964111aceae498fb681ff61e0553801aeb125ac2
SHA512 9cbf200a0d21c2e5a1cbeeb38fbd02732b28aae9e90ed3b89a163ea6b37372d68cdb191dd520d3b02b5300817ff7c22dd34211f24379eef8ea9d08916b485fc7
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 84b63c8b158d797b96843fc39f40e746929c21a609b888534d8177e962e2f470
MD5 7c0c270030a29f4f6e059fe757acfe91
SHA1 29e7386ea076f0216e27e8f4db4b65c41b071f03
SHA512 f5771e37771ab2d60f025c6f760ec1a9229bee9da6a2d5e0a04e6aa21a4901b91799ae7f601a15c5d2a5d06765a62c1adddb53e0f057af8cbd65f3e3d5fe7c45
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 76a8fb9d2dbd6e326506c584611e5df257473d34176b958d81cf12fb991c289d
MD5 2a86070c1849627e99e2fed0e2bd164f
SHA1 d57d099c24280d4ea208ed91534a3b09b7a2f4ae
SHA512 e1c631fb26c271f3cface1d7e4a3b27f808f6aa11ce22fd35a9e13de198ca870f903d878eaf0f1f6cf5268eca658259442815b361cde2cd3b9a11a885816345b
MD5 SHA1 SHA512

Submit Download

58c8b9e8d891ee5527394759dc0f33f5.exe

Path C:\Users\Admin\AppData\Local\2d81de04-be92-4db5-95f7-9a546b38aad1\58c8b9e8d891ee5527394759dc0f33f5.exe
Size 688KB
SHA256 0dbb33b5aaa39d7e5b04eb88bbc5e8602e2ebfa84b3cb26ea4c70d6ef4c32b1e
MD5 58c8b9e8d891ee5527394759dc0f33f5
SHA1 e4f3a7d684d781ce244b08b0a2bfa8210c7c9c11
SHA512 c5a64ee34df5c69b9d58f9eb554fa7c5173916bbc8bfe0085fb2f844fc5a584c99f260d56c8bd2c34f2b8b7a237161315d0c9b76dc718c0b7a2801a907913b90
SSDEEP 12288:PjSMjSgO+B0QIk5d+KjL25foGXo33KZRPCb2t9VAtVOvVC11lc:rSM2gO+B0QQKjK5gGXoqZRPPtAGVC
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/440-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/440-39-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/440-38-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/440-33-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/440-32-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2912-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2912-15-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2912-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2912-4-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/2912-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3560-1-0x0000000003BB0000-0x0000000003C4F000-memory.dmp

Download

memory/3560-2-0x0000000003C50000-0x0000000003D6B000-memory.dmp

Download

memory/4544-21-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4544-23-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4544-20-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4904-28-0x00000000038C0000-0x0000000003961000-memory.dmp

Download

memory/5036-18-0x0000000003970000-0x0000000003A12000-memory.dmp

Download