djvu | 69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec

General

Target

69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
Size

730KB
MD5

d435eb4b6daa85246cd24f46d4143aac
SHA1

9822cf9863dc933dd970136144436e06cd7458f7
SHA256

69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec
SHA512

32e6bf572ab79d1024658c9f8fb840fc8b224e77050a03d919b0a404981522b580aead4e41b802ce7cec500466bb31de2c183b6b0ea08b941110511db0319880
SSDEEP

12288:7AcJmqdB6lNHMUyXu2olgYMsEWGgflYHydwr1eAIwcyC9Bw86:7HN6lxMHX7olAgtYSaeASDwJ

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test1/get.php

Attributes

extension
.qepi
offline_id
jgILOjDrBgyzY4JmT3B2jDSyBmDPBruKk8bKs6t1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/665ddae3fc3cd10bbaaa4350408b196920240504141005/4cae7e Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0867PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral1/memory/1464-2-0x0000000004330000-0x000000000444B000-memory.dmp	family_djvu
behavioral1/memory/1272-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1272-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1272-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1272-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1272-17-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-20-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-27-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-32-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/3340-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1116	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d778437a-5b23-40bb-8ffe-dbc39e63e57e\\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe\" --AutoStart"	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
24	api.2ip.ua
18	api.2ip.ua
19	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 1464 set thread context of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 4976 set thread context of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
3340	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
3340	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1464 wrote to memory of 1272	1464	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	87
PID 1272 wrote to memory of 1116	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	88
PID 1272 wrote to memory of 1116	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	88
PID 1272 wrote to memory of 1116	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	88
PID 1272 wrote to memory of 4976	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	89
PID 1272 wrote to memory of 4976	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	89
PID 1272 wrote to memory of 4976	1272	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	89
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91
PID 4976 wrote to memory of 3340	4976	69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe	91

C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
"C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1464
- C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
  "C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1272
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\d778437a-5b23-40bb-8ffe-dbc39e63e57e" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:1116
- - C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
    "C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe
      "C:\Users\Admin\AppData\Local\Temp\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
d4f07ee61e152f1392d3acfbd611a65d

SHA1
cbad4b0fc4b752be2a4b29ac12b40b9d04d3888a

SHA256
e3568bd51370abfded43c7e09b4f26d1d018e3d0925890d457d0bcf080cfc495

SHA512
209fed14cb895ff81521ed80a93b9c1c10c227b8102d65dddd9fd651fa5990d307a7f3836766f660362caaba2fb6573a2b3e542254eb593466e8696a3b87102e

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
301e2c614f28436568749dc9e2d64905

SHA1
96658269440dae28df42d020984e9afe6a55e946

SHA256
494873e01d3c18a4166ccc7f913fc2678766a3fd91add6936d1b4ed8c7ed3a5c

SHA512
c3b925059b29c4fb078ed5513f193befad84c2933f8270103494918677e6be37518d980e0578bc01fcebbc9473e1ed1f329000e8e31381af2f9cb0014ac483d6

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
c4abe8d862f8d1103af548d78d45af44

SHA1
8f2a875a36837784d2d6e5b34f22c11ec0fe3748

SHA256
77b6ddb2ad47069b53f69caeca92b07f8bdf1bb539225263752dbb895baafcd1

SHA512
b3541254d5e37d75789aa54b1354470c12cd2572f4f7eb2c9c7e710ef00b4c31d054504c3b4501aa9b9b24958f7b1d29e06d5119e01e159a53cdec733cc3f3bc

Download Submit
C:\Users\Admin\AppData\Local\d778437a-5b23-40bb-8ffe-dbc39e63e57e\69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec.exe

Filesize
730KB

MD5
d435eb4b6daa85246cd24f46d4143aac

SHA1
9822cf9863dc933dd970136144436e06cd7458f7

SHA256
69028182f75e219b36e5910b03edecc06fa6b2a60e39cdebe7aac943b827d1ec

SHA512
32e6bf572ab79d1024658c9f8fb840fc8b224e77050a03d919b0a404981522b580aead4e41b802ce7cec500466bb31de2c183b6b0ea08b941110511db0319880

Download Submit
memory/1272-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1272-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1272-17-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1272-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1272-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1464-2-0x0000000004330000-0x000000000444B000-memory.dmp

Filesize
1.1MB

Download
memory/1464-1-0x0000000004290000-0x000000000432C000-memory.dmp

Filesize
624KB

Download
memory/3340-20-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-25-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-27-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-30-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-33-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-32-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3340-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads