djvu | 9f24cff00ff55730e61d9fd9a182f92f272735ba6ce55bc93bdc7ea24424dc42

General

Target

373dbc2f5f92e4b275e9a6716b432d98.exe
Size

757KB
MD5

373dbc2f5f92e4b275e9a6716b432d98
SHA1

a74b2bce1c8d9d89ec0cb5c80d4df3cad0a1480b
SHA256

9f24cff00ff55730e61d9fd9a182f92f272735ba6ce55bc93bdc7ea24424dc42
SHA512

d79ae6ca8f2fd0e8a2626b10167a93c97e72f6ac89f51d2ceaba8258322e97ac0997b6b6276f728aa876e7fe30222a4423df25b16c5c69bf8787df095690ee63
SSDEEP

12288:OHJ05KhRStp9kf6pXA1BBoC+iW1UGIKYwpppP+MIzPcyWtnUjGrOv9hQsN/S/lS:n5KhYg6pQ17oC+e5wppBXIoNtUkOvQsl

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test1/get.php

Attributes

extension
.nood
offline_id
4p0Nzrg1q0ND5of5Gtp2UBjthSXuE8VxnMrd4vt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/a832401adcd58098c699f768ffea4f1720240305114308/7e601a Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0855PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 9 IoCs

resource	yara_rule
behavioral2/memory/900-2-0x0000000003D10000-0x0000000003E2B000-memory.dmp	family_djvu
behavioral2/memory/2404-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2404-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2404-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2404-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2404-15-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2288-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2288-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/2288-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\Control Panel\International\Geo\Nation	373dbc2f5f92e4b275e9a6716b432d98.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3912	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1904519900-954640453-4250331663-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8bb784a3-3861-4cd5-ad97-0942ad73a6ac\\373dbc2f5f92e4b275e9a6716b432d98.exe\" --AutoStart"	373dbc2f5f92e4b275e9a6716b432d98.exe

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	api.2ip.ua
20	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 900 set thread context of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 2248 set thread context of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1448	2288	WerFault.exe	109

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2404	373dbc2f5f92e4b275e9a6716b432d98.exe
2404	373dbc2f5f92e4b275e9a6716b432d98.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 900 wrote to memory of 2404	900	373dbc2f5f92e4b275e9a6716b432d98.exe	98
PID 2404 wrote to memory of 3912	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	105
PID 2404 wrote to memory of 3912	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	105
PID 2404 wrote to memory of 3912	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	105
PID 2404 wrote to memory of 2248	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	106
PID 2404 wrote to memory of 2248	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	106
PID 2404 wrote to memory of 2248	2404	373dbc2f5f92e4b275e9a6716b432d98.exe	106
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109
PID 2248 wrote to memory of 2288	2248	373dbc2f5f92e4b275e9a6716b432d98.exe	109

C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe
"C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:900
- C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe
  "C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2404
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8bb784a3-3861-4cd5-ad97-0942ad73a6ac" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe
    "C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2248
  - - C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe
      "C:\Users\Admin\AppData\Local\Temp\373dbc2f5f92e4b275e9a6716b432d98.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      PID:2288
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2288 -s 568
        5⤵
        Program crash
        
        PID:1448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2288 -ip 2288
1⤵
PID:1940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1428 --field-trial-handle=2588,i,14229658658073991926,6938034815163866135,262144 --variations-seed-version /prefetch:8
1⤵
PID:3380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\8bb784a3-3861-4cd5-ad97-0942ad73a6ac\373dbc2f5f92e4b275e9a6716b432d98.exe

Filesize
585KB

MD5
d61e020897e5b44ec90cb476df21de5b

SHA1
5dc8e6633fce671ac72de6b50559080affd52dee

SHA256
3d9480cf913736d17e99972d7503ca358334a15f6c0210452c45c222af921c4a

SHA512
22110bb180916a53922137f4e3f6a8e747abad113498af696db12950f3abf376603e9e109ef05b7abe9b4fc645994912316dd92608c1525875ecd3a52227aa57

Download Submit
memory/900-1-0x0000000003C70000-0x0000000003D06000-memory.dmp

Filesize
600KB

Download
memory/900-2-0x0000000003D10000-0x0000000003E2B000-memory.dmp

Filesize
1.1MB

Download
memory/2248-18-0x0000000003C90000-0x0000000003D23000-memory.dmp

Filesize
588KB

Download
memory/2288-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2288-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2288-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2404-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2404-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2404-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2404-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2404-15-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads