djvu | 6c0bd6cae657449a07dcb78940ea732d7e4e24546477b083116bff4c99bd417d

Analysis

max time kernel
146s
max time network
122s
platform
windows7_x64
resource
win7-20240215-en
resource tags

arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system
submitted
24/04/2024, 05:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

efd7d885536ef4fd62cbc513bbe04d6e.exe
Size

831KB
MD5

efd7d885536ef4fd62cbc513bbe04d6e
SHA1

7e3a86188066eaa404a60c9686624fda1b12ae51
SHA256

6c0bd6cae657449a07dcb78940ea732d7e4e24546477b083116bff4c99bd417d
SHA512

d983be29e14760e67722fa2d5a0c09f55d34a2528faed9ebdbdbb957a3cb6de1f806177eb40241dccfdbe6c8cfb0669459b9b7144f0807a5bd5bc2852aabc70d
SSDEEP

24576:LtSUbR9X6EqqMJPf4k2kriUyd19SfZ7Q:LtVRNxMJPf4qyJI

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.bgjs
offline_id
Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0863PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 16 IoCs

resource	yara_rule
behavioral1/memory/2040-5-0x00000000058F0000-0x0000000005A0B000-memory.dmp	family_djvu
behavioral1/memory/1736-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1736-7-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1736-8-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1736-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-48-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-49-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-51-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-58-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-62-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-63-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-66-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-65-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2472-67-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2568	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\62f1046f-c72f-4d41-bcc3-b321e4dbf809\\efd7d885536ef4fd62cbc513bbe04d6e.exe\" --AutoStart"	efd7d885536ef4fd62cbc513bbe04d6e.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
9	api.2ip.ua
3	api.2ip.ua
4	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2040 set thread context of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2684 set thread context of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	efd7d885536ef4fd62cbc513bbe04d6e.exe
2472	efd7d885536ef4fd62cbc513bbe04d6e.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 2040 wrote to memory of 1736	2040	efd7d885536ef4fd62cbc513bbe04d6e.exe	28
PID 1736 wrote to memory of 2568	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	29
PID 1736 wrote to memory of 2568	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	29
PID 1736 wrote to memory of 2568	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	29
PID 1736 wrote to memory of 2568	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	29
PID 1736 wrote to memory of 2684	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	30
PID 1736 wrote to memory of 2684	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	30
PID 1736 wrote to memory of 2684	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	30
PID 1736 wrote to memory of 2684	1736	efd7d885536ef4fd62cbc513bbe04d6e.exe	30
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31
PID 2684 wrote to memory of 2472	2684	efd7d885536ef4fd62cbc513bbe04d6e.exe	31

C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe
"C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe
  "C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\62f1046f-c72f-4d41-bcc3-b321e4dbf809" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2568
- - C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe
    "C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2684
  - - C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe
      "C:\Users\Admin\AppData\Local\Temp\efd7d885536ef4fd62cbc513bbe04d6e.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2472

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
49f1d491d6bb1437526f707e958f8232

SHA1
96f5f96c328d1ebf777344289353e152d9910b00

SHA256
ca7da5a73c8f86404f9f6c57022a72f623fe359e373c61e2a4aa63318da47b41

SHA512
cd55d4daf2e49e78c1952ae6e167b3054630b6a99ebc24ee91b432cfa392b4e6bfd7ee905e3cfaee22e2cc911e430025444a71be68855906dc09a46a600ba6c4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
aba28b88ef49e586a4182e015bb7e404

SHA1
9caee25a42c1d7439482c12de63c3c231db67ff3

SHA256
8d8acc0062ac023acd61c6f2a2597313ad1d435bb4a23e1ab3f50020a37e0d6e

SHA512
eb506689a5e8a611c3cbc0dd640c8cb3cab833979169b4199b6f8ac0e42a307ec2afa49f602b5df50e2ef6a70425907e5482e1d92c66fe82931de3adfe451b0a

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

Filesize
344B

MD5
f1dbb30e9405dd64626b1b85b4e0ac4d

SHA1
e6ebfb347f8301e80b1639c83a18e7cade071b8f

SHA256
d7059573b1568ff4b4d0dd2bd8cac0576cba425af9e5899332838f9b5105f5b6

SHA512
74db90d8f57247875eceddecbaad31d1ec7305185ab3c50afc7584e595e097fd9de6c75aa6663ca9b6b13c0a4e3ed2241a54b6726f64a1bd5f8765ee922cccc3

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
45b96e8166e2d6e12ff501f7b880afa2

SHA1
c1b25301aac7991c556cd77af7138f51f5b9d002

SHA256
da66f74db27c04b29b23314b0c81916aa0200638f8cff6324385dbad84b96a33

SHA512
21a252991fac2ce321ad878b34c35e9078b213d97b6db8115006bd8d581e3b48f3af152dda8b2c949fa94dc8f20dca448bc06580e5979b18884d36f63cc791ef

Download Submit
C:\Users\Admin\AppData\Local\62f1046f-c72f-4d41-bcc3-b321e4dbf809\efd7d885536ef4fd62cbc513bbe04d6e.exe

Filesize
831KB

MD5
efd7d885536ef4fd62cbc513bbe04d6e

SHA1
7e3a86188066eaa404a60c9686624fda1b12ae51

SHA256
6c0bd6cae657449a07dcb78940ea732d7e4e24546477b083116bff4c99bd417d

SHA512
d983be29e14760e67722fa2d5a0c09f55d34a2528faed9ebdbdbb957a3cb6de1f806177eb40241dccfdbe6c8cfb0669459b9b7144f0807a5bd5bc2852aabc70d

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2868.tmp

Filesize
65KB

MD5
ac05d27423a85adc1622c714f2cb6184

SHA1
b0fe2b1abddb97837ea0195be70ab2ff14d43198

SHA256
c6456e12e5e53287a547af4103e0397cb9697e466cf75844312dc296d43d144d

SHA512
6d0ef9050e41fbae680e0e59dd0f90b6ac7fea5579ef5708b69d5da33a0ece7e8b16574b58b17b64a34cc34a4ffc22b4a62c1ece61f36c4a11a0665e0536b90d

Download Submit
C:\Users\Admin\AppData\Local\bowsakkdestx.txt

Filesize
728B

MD5
e8af323947494f5d85671e789e57c7bb

SHA1
71013669073bd16f261a5259e5c62bc0c75c3ddf

SHA256
1b8976f7e884da5c8f9ba39b6c6223a2f6176514c5f8a1a5f15107c04007f84d

SHA512
8430dddc28b73448048016892cb6f13ac369a1e048133a937cfbea8f6cd972a833c198be05f3ddfef41e906a0cb3821698d0d5133d31726677aaccac510bfbb0

Download Submit
memory/1736-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1736-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1736-8-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1736-7-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1736-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2040-0-0x0000000004130000-0x00000000041C2000-memory.dmp

Filesize
584KB

Download
memory/2040-1-0x0000000004130000-0x00000000041C2000-memory.dmp

Filesize
584KB

Download
memory/2040-5-0x00000000058F0000-0x0000000005A0B000-memory.dmp

Filesize
1.1MB

Download
memory/2472-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-48-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-49-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-51-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-58-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-62-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-63-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-66-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-65-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2472-67-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2684-29-0x00000000040C0000-0x0000000004152000-memory.dmp

Filesize
584KB

Download
memory/2684-27-0x00000000040C0000-0x0000000004152000-memory.dmp

Filesize
584KB

Download