djvu | 3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238

General

Target

3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
Size

769KB
MD5

f81f9b85dbaa3691c792de5b18bc0f44
SHA1

6b9d2bf80694b24ea5dac991f302b00a4e99db1a
SHA256

3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238
SHA512

2812b67c30d89484303f7b5baa4a1831da5bcc440074d05fdf7b0a64632858f9b7204ecc31004f43204b68fef1687c96a1010e4e126d7022c6864c438665710e
SSDEEP

12288:MDEfJkpgy6erd7RR+KgkdS7/RpYhVJDgldjezNNSCWN:nWy01e6dI/RpAJDqeZNSCW

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://sajdfue.com/test2/get.php

Attributes

extension
.uazq
offline_id
Jx0i3k2ogR5cKxX1evmz0Ex7TUxOUlnbh2dvnIt1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://sajdfue.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/df01994dd8d37c2c33469922f8e7155a20240402134014/fd95b0 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0860PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 17 IoCs

resource	yara_rule
behavioral1/memory/1588-2-0x0000000004980000-0x0000000004A9B000-memory.dmp	family_djvu
behavioral1/memory/1788-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1788-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1788-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1788-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1788-15-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4212-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\Control Panel\International\Geo\Nation	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4676	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2177723727-746291240-1644359950-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\8f7920ba-b88e-4759-8e05-354c877a1764\\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe\" --AutoStart"	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	api.2ip.ua
14	api.2ip.ua
28	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1588 set thread context of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 2108 set thread context of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
4212	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
4212	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1588 wrote to memory of 1788	1588	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	89
PID 1788 wrote to memory of 4676	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	90
PID 1788 wrote to memory of 4676	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	90
PID 1788 wrote to memory of 4676	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	90
PID 1788 wrote to memory of 2108	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	91
PID 1788 wrote to memory of 2108	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	91
PID 1788 wrote to memory of 2108	1788	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	91
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93
PID 2108 wrote to memory of 4212	2108	3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe	93

C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
"C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
  "C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\8f7920ba-b88e-4759-8e05-354c877a1764" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:4676
- - C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
    "C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2108
  - - C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe
      "C:\Users\Admin\AppData\Local\Temp\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
cdce5838e29c9e6eb3ba9f14b98a4273

SHA1
899d15721f75a164b0e6f06ba01545552843b6b6

SHA256
9349878d22734eb8d3a6111fcddd3d6b8f89e304d40766dbf728437281dcd992

SHA512
c9237ce071042ece8e2b2201f508b4b78cf48da788b328eaec3a32671daaf721bec8bc641567467f74142007ba0647c5ec6a6c24e3f1543e624b0264803aa16d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
2e2ee78441026a97e3ac222e50952135

SHA1
0534611a3beca037798e13aaf7c0928cf07ddb86

SHA256
c99476726ce11769c4c5c0772ee889d48b0f2dfef00b44062555fa3d95be232c

SHA512
da82eba433ccf16d7589f0ed55bb54c9280137089317b152f663b1cf774e5a14e8e9878e54c8b9ce02b203cc26e8d5b46af6997e0603e4751b8fdbd24104f5bd

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
86645d415aa578599ea79841e0b2f9dd

SHA1
6b19c786b38a2834b4dc7994260335ee493e9e3b

SHA256
e86f95904ea9dce695f327156f1dfe4e45d43eb2e82811f8668305986291d2df

SHA512
5c3529b66f01402321321c63468d33bdb93715b078cdef600809a98fb40d3d1611abae0115e4a8291205b94ee2e8027ae07959e9cc60333be0c5fb8ce055111d

Download Submit
C:\Users\Admin\AppData\Local\8f7920ba-b88e-4759-8e05-354c877a1764\3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238.exe

Filesize
769KB

MD5
f81f9b85dbaa3691c792de5b18bc0f44

SHA1
6b9d2bf80694b24ea5dac991f302b00a4e99db1a

SHA256
3ad3da99d6c8d226152664152b41774ce1261f4841a1039207a6d306ed230238

SHA512
2812b67c30d89484303f7b5baa4a1831da5bcc440074d05fdf7b0a64632858f9b7204ecc31004f43204b68fef1687c96a1010e4e126d7022c6864c438665710e

Download Submit
memory/1588-1-0x0000000002EA0000-0x0000000002F3D000-memory.dmp

Filesize
628KB

Download
memory/1588-2-0x0000000004980000-0x0000000004A9B000-memory.dmp

Filesize
1.1MB

Download
memory/1788-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1788-15-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1788-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1788-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1788-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2108-18-0x0000000002EC0000-0x0000000002F5C000-memory.dmp

Filesize
624KB

Download
memory/4212-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-22-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-27-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-29-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-32-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4212-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads