djvu | a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5

General

Target

a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
Size

772KB
MD5

64efba237298a5bc92c3f29fb2963e14
SHA1

aefa2591500ba6e5357e7bd4c132f220fc148567
SHA256

a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5
SHA512

dbde6d2037c5d5a7a530d2c704132a3231bfbb2b93f9c4d1cc4adeeaf0ff0d334aec030646a25be87614d46c2739513b1a43faf1241bc858df285016bb3a62e7
SSDEEP

12288:ia3/NThBSnHO4FQ2WxFxze3+LiaNPhEMvQ/8viaA4u8bAPe78i+e5LkZCLLDZaj9:Gnu4FQVzyUBHY6Vu8blLPLLIZ0v0

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test2/get.php

Attributes

extension
.uazq
offline_id
Jx0i3k2ogR5cKxX1evmz0Ex7TUxOUlnbh2dvnIt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/df01994dd8d37c2c33469922f8e7155a20240402134014/fd95b0 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0860PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral1/memory/1276-2-0x0000000004A80000-0x0000000004B9B000-memory.dmp	family_djvu
behavioral1/memory/1628-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1628-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1628-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1628-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1628-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3620-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2504	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f19d2f56-a855-4e92-ae42-aa6fd3fdefed\\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe\" --AutoStart"	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
4	api.2ip.ua
5	api.2ip.ua
20	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1276 set thread context of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 3160 set thread context of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
3620	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
3620	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1276 wrote to memory of 1628	1276	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	85
PID 1628 wrote to memory of 2504	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	90
PID 1628 wrote to memory of 2504	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	90
PID 1628 wrote to memory of 2504	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	90
PID 1628 wrote to memory of 3160	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	91
PID 1628 wrote to memory of 3160	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	91
PID 1628 wrote to memory of 3160	1628	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	91
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93
PID 3160 wrote to memory of 3620	3160	a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe	93

C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
"C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
  "C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\f19d2f56-a855-4e92-ae42-aa6fd3fdefed" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
    "C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3160
  - - C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe
      "C:\Users\Admin\AppData\Local\Temp\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
9539346f11b9c39a31f1a2e84eeb7ad9

SHA1
7dae139e917bd4c773f17a83f1c99ad75baba295

SHA256
862a49d15a022936a284d5e80693ade5c30bb35fc3dce3adbf228de112faf7c9

SHA512
965586270b744903a3805c5bde66bebaeba90787bd4d6d42a9859740cab2e1d5d89085edc9170537557b4e5f9295d01a215045e8bfeb5c84dcb927941a90f4c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
aa0f7ae114e5d7fbd26c35462c9453a2

SHA1
38e43698cf9c5d551eacdbc30b4e29d558acd5ec

SHA256
0b7a2a4c6acca788aceedfec2c1f13dcc9581f36e663825106bcbec5e9d86d5f

SHA512
226d229701a61be0586d55e34af6083c2827090c2fec8774b837c458590d58b3d58dedefe257e07aea97faed940650daf7e15c443c78a763dee6f714b84512f3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
b14f3321ecad530126d4999188441584

SHA1
3b05db281fac8cf0da966a4d1b036643996fb9db

SHA256
c8499985a0facc6b2f9efee6246c0b779f653bd4405f40dc436d9a1a812273cb

SHA512
63d0f6a906dd302fa530b6d3987ec3d597a2c5455be9f1fafdaf94bbad3ad8d42f8908dcb6560e557aa8b9183dab429ff979714e1aa744c0e0966f05b99571d3

Download Submit
C:\Users\Admin\AppData\Local\f19d2f56-a855-4e92-ae42-aa6fd3fdefed\a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5.exe

Filesize
772KB

MD5
64efba237298a5bc92c3f29fb2963e14

SHA1
aefa2591500ba6e5357e7bd4c132f220fc148567

SHA256
a9aca626049447543fb5b2f8a60c0b689332afd317d6b7655e5a2636341c8ad5

SHA512
dbde6d2037c5d5a7a530d2c704132a3231bfbb2b93f9c4d1cc4adeeaf0ff0d334aec030646a25be87614d46c2739513b1a43faf1241bc858df285016bb3a62e7

Download Submit
memory/1276-1-0x00000000049E0000-0x0000000004A80000-memory.dmp

Filesize
640KB

Download
memory/1276-2-0x0000000004A80000-0x0000000004B9B000-memory.dmp

Filesize
1.1MB

Download
memory/1628-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1628-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1628-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1628-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1628-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3160-20-0x0000000002FC0000-0x0000000003055000-memory.dmp

Filesize
596KB

Download
memory/3620-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-31-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3620-39-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads