Overview

overview

10

Static

static

10

3485f3cbe4...ad.exe

windows7-x64

10

3485f3cbe4...ad.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    132s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/01/2024, 23:40

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe
  • Size 1.1MB
  • Sample240115-3pcyyahabl
  • SHA256 1ca8ad78274a829697b8381e96b914fea1a65b5b2351f536325d2143d689426e
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

  • djvu

C2

  • http://zexeq.com/test2/get.php

Attributes
  • extension

    .ppvw

  • offline_id

    phJtdHo970vyx7vwlYG00OakDR75RuJz7NXDArt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-eyUsqpKbFl Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0816JOsie

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe
    "C:\Users\Admin\AppData\Local\Temp\3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5044
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\f6ab2044-dc26-47de-93f7-17ff890ae962" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:4676
    • C:\Users\Admin\AppData\Local\Temp\3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe
      "C:\Users\Admin\AppData\Local\Temp\3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4180

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 1KB
        • SHA256 a2b62727608d9216237a6608a2e995c28d3656b72c06ee0b651878f26df7e8ff
        • MD5 SHA1 SHA512
        Submit Download

        CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Size 724B
        • SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
        • MD5 SHA1 SHA512
        Submit Download

        24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        • Size 410B
        • SHA256 47afca4d2c62ce366b6a9e85be18cc3618c9b0cf1492d7d4d0a7f7e296c1a99b
        • MD5 SHA1 SHA512
        Submit Download

        CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        • Size 392B
        • SHA256 7c7b92160da8e636ae963f4215017f867fc3f5fce399766ec3c7e5d8bc16db01
        • MD5 SHA1 SHA512
        Submit Download

        3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe
        • Path C:\Users\Admin\AppData\Local\f6ab2044-dc26-47de-93f7-17ff890ae962\3485f3cbe491a8770a5f05f4cfcd7742a6182fc61a450d2f8d364ca4c0af1c2e_payload.exe
        • Size 50KB
        • SHA256 6ade26f2cfb05b6fdf435fee2aa3dc29e5724f7411c8a20f995bc1bc0010d14d
        • MD5 SHA1 SHA512 SSDEEP
        Submit Download