djvu | db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d

Analysis

max time kernel
142s
max time network
123s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
02/05/2024, 04:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
Size 762KB
Sample240502-fmf69abe74
SHA256 db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d
MD5 991d2a3d342b7830c7c53146c6684050
SHA1 4b96ffe3a3151416c67c86e2b97a4c9a20adea90
SHA512 45bbffe2d43bf004b6878d219cd63b596f4749728526eb4a3384a67939bdef910f51b362d3a47aadbc5a5db02a1d12796c4617aa2af9be632071477ac7490f37
SSDEEP 12288:RZU/atFcwl7aR3PjWtIQSujujHNp7NfOSlJGrZ8RbmjdAjPG6Hui8w0EVhlG9V0N:vcwlOESmmtppwreRqjdnwThlGwN
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.bgjs
offline_id
Z6iwSvCoAt8T8K2ROxecuXHPNHv7eDyWrc8Ks7t1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/54cdfd152fe98eedb628a1f4ddb7076420240421150208/403a27 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0863PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 18 IoCs

resource	yara_rule
behavioral2/memory/4580-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4280-4-0x0000000003840000-0x000000000395B000-memory.dmp	family_djvu
behavioral2/memory/4580-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4580-2-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4580-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4580-19-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/3772-34-0x0000000000400000-0x0000000001A89000-memory.dmp	family_djvu
behavioral2/memory/904-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-40-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/904-41-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2516	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-293923083-2364846840-4256557006-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\3eece8e1-8233-495c-9c65-e28386aa8f67\\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe\" --AutoStart"	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
7	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 4280 set thread context of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 3772 set thread context of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
904	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
904	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4280 wrote to memory of 4580	4280	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	80
PID 4580 wrote to memory of 2516	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	82
PID 4580 wrote to memory of 2516	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	82
PID 4580 wrote to memory of 2516	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	82
PID 4580 wrote to memory of 3772	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	83
PID 4580 wrote to memory of 3772	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	83
PID 4580 wrote to memory of 3772	4580	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	83
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86
PID 3772 wrote to memory of 904	3772	db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe	86

C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
"C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
  "C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\3eece8e1-8233-495c-9c65-e28386aa8f67" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:2516
- - C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
    "C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:3772
  - - C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
      "C:\Users\Admin\AppData\Local\Temp\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 1KB
SHA256 fd668a44e7e00cb370d96f1ed1de4a6853f0fe2679fbb5e9cc211450d7cd6111
MD5 a240d3899f5c942fa4d758eaa3f6cffd
SHA1 ab28b7e179d0b320b32b40f9302c6692bab2f06e
SHA512 8d774eda4fba5de333e50be8503c902c5f8aa6bc4516a0cad95f8cb8d697924fb88696b22cc712c6468ee9e8866a29c71d24f16d4e19dd0ded38069602babeee
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 724B
SHA256 58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5
MD5 8202a1cd02e7d69597995cabbe881a12
SHA1 8858d9d934b7aa9330ee73de6c476acf19929ff6
SHA512 97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9
MD5 SHA1 SHA512

Submit Download

24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Size 410B
SHA256 5f2ecb73b3160f608ad3d129d6f3555b3e8089fdf7baf5934f02a79e8efa75d5
MD5 74773cc1b604b0e0fb309bdee10f9b20
SHA1 d1f782a2b39cec32eb78520c7eb2b0aa830b9987
SHA512 1fe5bb5cf2754f697a5f4646173c7577b4a98ef6a7cb3a9cf7177526958e3a73ae711677e2df0500af42560122b2af650de548d883e9523b421c7428714b4d53
MD5 SHA1 SHA512

Submit Download

CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Size 392B
SHA256 19c9a54948dc1e3d15583758b8a5ec758acdcb08852e5e8a122ea0a0347c168e
MD5 08fe8e5f31f44849183a73886d88445a
SHA1 3f36a40f43a88466c4b7fceada69b8ba2c34a316
SHA512 710ca790cce9c14613c15d9db459e7f330ede71cf4f6718eb6892a1b0627236b45c6a50674e918b380a928992a905af3e225e92831d781405cfae25138cbff5a
MD5 SHA1 SHA512

Submit Download

db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe

Path C:\Users\Admin\AppData\Local\3eece8e1-8233-495c-9c65-e28386aa8f67\db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d.exe
Size 762KB
SHA256 db529b54a70304620f85d2ef0e45da9913caa69db6e61b336e4e388b7389bd7d
MD5 991d2a3d342b7830c7c53146c6684050
SHA1 4b96ffe3a3151416c67c86e2b97a4c9a20adea90
SHA512 45bbffe2d43bf004b6878d219cd63b596f4749728526eb4a3384a67939bdef910f51b362d3a47aadbc5a5db02a1d12796c4617aa2af9be632071477ac7490f37
SSDEEP 12288:RZU/atFcwl7aR3PjWtIQSujujHNp7NfOSlJGrZ8RbmjdAjPG6Hui8w0EVhlG9V0N:vcwlOESmmtppwreRqjdnwThlGwN
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/904-36-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-32-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-41-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-22-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-23-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-25-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-40-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-39-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-38-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/904-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/3772-34-0x0000000000400000-0x0000000001A89000-memory.dmp

Download

memory/3772-24-0x0000000000400000-0x0000000001A89000-memory.dmp

Download

memory/4280-4-0x0000000003840000-0x000000000395B000-memory.dmp

Download

memory/4280-1-0x00000000037A0000-0x0000000003838000-memory.dmp

Download

memory/4580-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4580-2-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4580-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4580-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4580-19-0x0000000000400000-0x0000000000537000-memory.dmp

Download