Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
25/01/2024, 09:59
Static task
static1
Behavioral task
behavioral1
Sample
74660e011065ca6216f408d59cadf33e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
74660e011065ca6216f408d59cadf33e.exe
Resource
win10v2004-20231222-en
General
-
Target
74660e011065ca6216f408d59cadf33e.exe
-
Size
723KB
-
MD5
74660e011065ca6216f408d59cadf33e
-
SHA1
0ad378f1f469f5c57a1516aa05139eee4bda5e8e
-
SHA256
de8f146808af12f7a609b39c56cf46d9d204ef2e717ff5b83422b7d7deb34739
-
SHA512
1cd8adc191f35d905cbd5e28806d578203501530e58d6fbc21bbb321cd23f2a77931ec055e80b17445a7c0470c77353d659f9e1c116d4fddeb45d7f06f81f218
-
SSDEEP
12288:Mr4xyEQyHNzX/d9kyUS9jyyMTvhHrxoMve/LWV3qgH7DJdmtfpec:Mr4x3HB1P0/ejS37bDJdm1p
Malware Config
Extracted
djvu
http://astdg.top/fhsgtsspen6/get.php
-
extension
.orkf
-
offline_id
4aBXQVNZ4BhjpMjt78QLIFtBSJPbgbflYLHrBut1
-
payload_url
http://securebiz.org/dl/build2.exe
http://astdg.top/files/1/build3.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ykQaS2tRyB Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0328gDrgo
Signatures
-
Detected Djvu ransomware 21 IoCs
resource yara_rule behavioral2/memory/968-5-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/968-6-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/968-4-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/968-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/3308-2-0x0000000004C10000-0x0000000004D2B000-memory.dmp family_djvu behavioral2/memory/968-15-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-20-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-21-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-22-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-28-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-27-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-29-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-31-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-34-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-33-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-35-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/1296-37-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4692-53-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4692-54-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4692-55-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral2/memory/4692-56-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Renames multiple (196) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation 74660e011065ca6216f408d59cadf33e.exe -
Executes dropped EXE 2 IoCs
pid Process 4352 74660e011065ca6216f408d59cadf33e.exe 4692 74660e011065ca6216f408d59cadf33e.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3472 icacls.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e4bc9c35-37e3-4295-9f34-515d63f424d7\\74660e011065ca6216f408d59cadf33e.exe\" --AutoStart" 74660e011065ca6216f408d59cadf33e.exe -
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 15 api.2ip.ua 17 api.2ip.ua 22 api.2ip.ua 58 api.2ip.ua -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3308 set thread context of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 4152 set thread context of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4352 set thread context of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 968 74660e011065ca6216f408d59cadf33e.exe 968 74660e011065ca6216f408d59cadf33e.exe 1296 74660e011065ca6216f408d59cadf33e.exe 1296 74660e011065ca6216f408d59cadf33e.exe 4692 74660e011065ca6216f408d59cadf33e.exe 4692 74660e011065ca6216f408d59cadf33e.exe 1296 74660e011065ca6216f408d59cadf33e.exe 1296 74660e011065ca6216f408d59cadf33e.exe -
Suspicious use of WriteProcessMemory 36 IoCs
description pid Process procid_target PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 3308 wrote to memory of 968 3308 74660e011065ca6216f408d59cadf33e.exe 88 PID 968 wrote to memory of 3472 968 74660e011065ca6216f408d59cadf33e.exe 91 PID 968 wrote to memory of 3472 968 74660e011065ca6216f408d59cadf33e.exe 91 PID 968 wrote to memory of 3472 968 74660e011065ca6216f408d59cadf33e.exe 91 PID 968 wrote to memory of 4152 968 74660e011065ca6216f408d59cadf33e.exe 92 PID 968 wrote to memory of 4152 968 74660e011065ca6216f408d59cadf33e.exe 92 PID 968 wrote to memory of 4152 968 74660e011065ca6216f408d59cadf33e.exe 92 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4152 wrote to memory of 1296 4152 74660e011065ca6216f408d59cadf33e.exe 96 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102 PID 4352 wrote to memory of 4692 4352 74660e011065ca6216f408d59cadf33e.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3308 -
C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"2⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:3472
-
-
C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4152 -
C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe"C:\Users\Admin\AppData\Local\Temp\74660e011065ca6216f408d59cadf33e.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Suspicious behavior: EnumeratesProcesses
PID:1296
-
-
-
-
C:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7\74660e011065ca6216f408d59cadf33e.exeC:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7\74660e011065ca6216f408d59cadf33e.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4352 -
C:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7\74660e011065ca6216f408d59cadf33e.exeC:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7\74660e011065ca6216f408d59cadf33e.exe --Task2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4692
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize1KB
MD5819d2f6d228f94bfebac03edbfa4bc64
SHA1257acbdf2270c5285962d10460a77f422143cc8d
SHA256e8b016b694a9c3224b6a405cf52010c03b7bc6c8948ecc8a3d9aaa39a18f6d47
SHA512b81c03ca94d21cdb106281fa478dccd390e07bd0a03d0077952041f3d1d41a671ac9a3d4c97d41d9c8f74b14214abfcaff696a10d0615b603a7a9b1a67adde67
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize724B
MD58202a1cd02e7d69597995cabbe881a12
SHA18858d9d934b7aa9330ee73de6c476acf19929ff6
SHA25658f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
SHA51297ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize410B
MD5775cae5d8e861b8b8850289a202d541e
SHA16a68b7c53d6c6e391ed7965eaf45ac4a94c1b9ee
SHA256cd1751448972924e5255906534ee184348b9a44bb6e72c0164f0ac6271cc23c4
SHA5129838f716bb09e71c97abc650a91a9b358430e53b70764a9d05e9ee0b1e0a0aacdb745c3696ee427adfa9b7fe044e7160817d98409c8581353f035fb7496bab3c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize392B
MD5c1b5777d366096b61dc8c5748fe2934c
SHA13bf4120a193da89fdfda0988736cf6671d606b86
SHA256f38a407dd6831fa72d6e16c53dbfe6566fba8e77f7cfbc7985f2532a5bf43a27
SHA512f55c7caaf0ead5ac12a6f9d2ea95be8c7ba3b375d8552412a7b0da8af9626446a062f7ed7b5b17d5cc3919bae533fb6a94c1a4967fa88b2f5e43b7cbac1d5f89
-
C:\Users\Admin\AppData\Local\e4bc9c35-37e3-4295-9f34-515d63f424d7\74660e011065ca6216f408d59cadf33e.exe
Filesize723KB
MD574660e011065ca6216f408d59cadf33e
SHA10ad378f1f469f5c57a1516aa05139eee4bda5e8e
SHA256de8f146808af12f7a609b39c56cf46d9d204ef2e717ff5b83422b7d7deb34739
SHA5121cd8adc191f35d905cbd5e28806d578203501530e58d6fbc21bbb321cd23f2a77931ec055e80b17445a7c0470c77353d659f9e1c116d4fddeb45d7f06f81f218