djvu | 9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6

General

Target

9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
Size

1.1MB
MD5

4025241aa35f544c34e1f79cff7f5a3d
SHA1

d064744c4d522406908aaee40d87d9fda54b6339
SHA256

9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6
SHA512

7a74c18e2377bf628b85e2b530ed62825a52193f33e458ebe90116cb210631fa4f1ba4f1809b5bb4c0573bdb66970137182ca8a095cff6712c65cb169363e329
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO83WQHUq7:F0dwAYZt6C31WeTVRPOh37Uq7

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test2/get.php

Attributes

extension
.qehu
offline_id
jgILOjDrBgyzY4JmT3B2jDSyBmDPBruKk8bKs6t1
payload_url
http://sdfjhuz.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/665ddae3fc3cd10bbaaa4350408b196920240504141005/4cae7e Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0868PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 1 IoCs

resource	yara_rule
behavioral2/files/0x0007000000023412-9.dat	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
8	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d4c74f0a-44b7-41ef-8dc9-554c1c9303ad\\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe\" --AutoStart"	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
13	api.2ip.ua
1	api.2ip.ua
2	api.2ip.ua

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
4784	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
4784	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 8	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	85
PID 1192 wrote to memory of 8	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	85
PID 1192 wrote to memory of 8	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	85
PID 1192 wrote to memory of 4784	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	86
PID 1192 wrote to memory of 4784	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	86
PID 1192 wrote to memory of 4784	1192	9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe	86

C:\Users\Admin\AppData\Local\Temp\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
"C:\Users\Admin\AppData\Local\Temp\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\Users\Admin\AppData\Local\d4c74f0a-44b7-41ef-8dc9-554c1c9303ad" /deny *S-1-1-0:(OI)(CI)(DE,DC)
  2⤵
  - Modifies file permissions
  PID:8
- C:\Users\Admin\AppData\Local\Temp\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe
  "C:\Users\Admin\AppData\Local\Temp\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe" --Admin IsNotAutoStart IsNotTask
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
1KB

MD5
8999aa854e3cae2cc82a314dc12420a3

SHA1
e9d06ba69f37453368b35b0f601e3c391fc36e86

SHA256
d9ce037a484b0cd8841a9f2ff72f44e4c1106b4edd257f76eaf4203e345cf196

SHA512
b840dfcdc27db311280d0731f9b4fc36e0a1a7e16090d6e4936bb1d011994b9a585b2393af9aea80ace8468430309cd26acc5220d39a4173574c4d5198f644be

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA

Filesize
410B

MD5
8a0e53d97b53574b29b99032cc250930

SHA1
4f1d2ac5e224bb6252bb7b10df6ce9d2c7a66cfa

SHA256
323b2690ebc66917f743b68c5f5d625e88d91b158d9a5c402f87953e82227a82

SHA512
622b382dff556899faf9c69d548ce06c75c2ddfe2b3d908048a4fa01d541ee2650ba53abcaf1e171f4f957716c61adf1da5f368d8908c8996184c7aacc650208

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464

Filesize
392B

MD5
b21474ace7cca047e10235ea929549c2

SHA1
31b960332bbac9d16993dd4d42902686bb919554

SHA256
5cdb0c63de38dcf36f488ecbfadbede81880142c9f1428c88a3c3a6c37458734

SHA512
a2f778e9b6d8147a872bc5c498af6c3d05888f8d4da1fafd6000b897c7b5c8cd988ca84a4a9e60208d89997af45d4cc8e2a69ea7f5de87a78a1799277e5285ce

Download Submit
C:\Users\Admin\AppData\Local\d4c74f0a-44b7-41ef-8dc9-554c1c9303ad\9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6.exe

Filesize
1.1MB

MD5
4025241aa35f544c34e1f79cff7f5a3d

SHA1
d064744c4d522406908aaee40d87d9fda54b6339

SHA256
9660a3b6f287bacbe76f7d4208fbd48e7be4b303e7d4c398b9826912668a5cd6

SHA512
7a74c18e2377bf628b85e2b530ed62825a52193f33e458ebe90116cb210631fa4f1ba4f1809b5bb4c0573bdb66970137182ca8a095cff6712c65cb169363e329

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads