djvu | d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/07/2024, 02:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
Size 806KB
Sample240702-cjkhqasdlb
SHA256 d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee
MD5 88932ab33c38072946abc06b426d33b8
SHA1 accc6e0ba8e1e7250e2634a1f0e7f06be7f4beb2
SHA512 266beae33826041ee77d36f57b41ec4ffe9849faa6b40c4446e531685e30c317c3b282e4079b674a7f37ee79dafe92c41e5b0104e210703f4ca69f7013c9e4d7
SSDEEP 12288:qIowhzaoWcGawk7yVe+H1JU7VuzpzS3oxAiXZcmQGLu5t15KBM0JiY3u3SZtr9XW:vhzL5MkmQ+H/2KFXVotzeM03aSpyr
MD5 SHA1 SHA512 SSDEEP

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test2/get.php

Attributes

extension
.waqa
offline_id
Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1
payload_url
http://defgyma.com/dl/build2.exe

http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0875PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 15 IoCs

resource	yara_rule
behavioral2/memory/4884-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/64-2-0x0000000004130000-0x000000000424B000-memory.dmp	family_djvu
behavioral2/memory/4884-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4884-19-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-22-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-29-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-30-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-31-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/876-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3912	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ff09fd79-6dcd-43de-b2b4-5e427d5c319f\\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe\" --AutoStart"	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe

Looks up external IP address via web service 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
5	api.2ip.ua
6	api.2ip.ua
19	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 64 set thread context of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 2476 set thread context of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
876	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
876	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 64 wrote to memory of 4884	64	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	81
PID 4884 wrote to memory of 3912	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	82
PID 4884 wrote to memory of 3912	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	82
PID 4884 wrote to memory of 3912	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	82
PID 4884 wrote to memory of 2476	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	83
PID 4884 wrote to memory of 2476	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	83
PID 4884 wrote to memory of 2476	4884	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	83
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85
PID 2476 wrote to memory of 876	2476	d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe	85

C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
"C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:64
- C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
  "C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe"
  2⤵
  - Checks computer location settings
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\Users\Admin\AppData\Local\ff09fd79-6dcd-43de-b2b4-5e427d5c319f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
    3⤵
    - Modifies file permissions
    PID:3912
- - C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
    "C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe" --Admin IsNotAutoStart IsNotTask
    3⤵
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2476
  - - C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
      "C:\Users\Admin\AppData\Local\Temp\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe" --Admin IsNotAutoStart IsNotTask
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed
MD5 2365869258df7a66a2121b802ca4afd9
SHA1 73acc30a2edeb9d6830de559bb8a74f35168135d
SHA512 795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 436B
SHA256 5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f
MD5 1bfe0a81db078ea084ff82fe545176fe
SHA1 50b116f578bd272922fa8eae94f7b02fd3b88384
SHA512 37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d
MD5 SHA1 SHA512

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 6904693c7806d8da718879b8453f9ddf9f1005e88143724acf57197a2ad8f72a
MD5 ecde47973f2f92a04f1463749f27060d
SHA1 46c173fc967b7fc3bd37b68d40116252e519cbd3
SHA512 31f31f41301e8812e28bb9f4301951d912c94b06948f460163efa5daabeb776f22e563b38b214824156c11e540666348e8ef0aaaec50b170e518a1e534dc1a4b
MD5 SHA1 SHA512

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 ef10972bb87a8e069cd5a4a581b2110ffc532b2c52de470a5c4dfa8a43b9fe01
MD5 b666775c8c5f31b4cc21e36179754cd1
SHA1 0dbbc5363ceedb0bf964255404a18ad4b5691b81
SHA512 3000a3b6aef35c5708d12ed3c867ed25b52cb9f5d96f481e192e4d1da4648aa26daec209c7c09731992247868f3b4c6010c29674754ff4020c7484c14411f32d
MD5 SHA1 SHA512

Submit Download

d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe

Path C:\Users\Admin\AppData\Local\ff09fd79-6dcd-43de-b2b4-5e427d5c319f\d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee.exe
Size 806KB
SHA256 d47e05b0ad27c651fb9cf73444e1f6a26514acb16998e92fca8be115ae6a2dee
MD5 88932ab33c38072946abc06b426d33b8
SHA1 accc6e0ba8e1e7250e2634a1f0e7f06be7f4beb2
SHA512 266beae33826041ee77d36f57b41ec4ffe9849faa6b40c4446e531685e30c317c3b282e4079b674a7f37ee79dafe92c41e5b0104e210703f4ca69f7013c9e4d7
SSDEEP 12288:qIowhzaoWcGawk7yVe+H1JU7VuzpzS3oxAiXZcmQGLu5t15KBM0JiY3u3SZtr9XW:vhzL5MkmQ+H/2KFXVotzeM03aSpyr
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/64-1-0x0000000004030000-0x00000000040C8000-memory.dmp

Download

memory/64-2-0x0000000004130000-0x000000000424B000-memory.dmp

Download

memory/876-31-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-35-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-39-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-37-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-36-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-22-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-29-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-30-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/876-33-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-3-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-4-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-5-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-6-0x0000000000400000-0x0000000000537000-memory.dmp

Download

memory/4884-19-0x0000000000400000-0x0000000000537000-memory.dmp

Download