Resubmissions
04-10-2024 16:44
241004-t8yv3syhpd 1027-09-2024 16:54
240927-vepkzsvbre 1027-09-2024 16:44
240927-t86wpavard 1004-08-2024 18:04
240804-wnq1vawbpg 1003-08-2024 17:26
240803-vzvbzazekn 1003-08-2024 16:14
240803-tpp4tsshqa 1003-08-2024 15:52
240803-tbarzsseqc 1031-07-2024 19:40
240731-ydk3yszdpq 1031-07-2024 10:53
240731-my145atfmf 10Analysis
-
max time kernel
444s -
max time network
446s -
platform
windows10-1703_x64 -
resource
win10-20240404-en -
resource tags
-
submitted
31-07-2024 19:40
General
-
Target
942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe
-
Size
732KB
-
MD5
31b1fe0aacf5fcbced44e89252d1d4b8
-
SHA1
3d56a02e23bbf2f6b3ac86db262391ccd2d06e5a
-
SHA256
942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38
-
SHA512
1b49741fab83d12bf0082c9ee070d999ab79860744322d755d7b5a53998ad6827d38306bb7d43763ae487ee64d451de5aec5aaab357422250174c4b8920add60
-
SSDEEP
12288:UhR9WptAc/LnqJc0LYBlaql0OxymXkDptSwUlq1Y4I+hHfyc:u9gtAcWfLYbOcep+Uyc
Malware Config
Extracted
djvu
http://astdg.top/nddddhsspen6/get.php
-
extension
.gujd
-
offline_id
NcBG8wI6Q1WFhUNlCRyjmrWGeGew2vvCKtJgKot1
-
payload_url
http://securebiz.org/dl/build2.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-mNr1oio2P6 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0316ewgfDd
Signatures
-
Detected Djvu ransomware 30 IoCs
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Renames multiple (152) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 6 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 7 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe"C:\Users\Admin\AppData\Local\Temp\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe" --Admin IsNotAutoStart IsNotTask4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exeC:\Users\Admin\AppData\Local\789b85f8-4293-43c8-9743-7fbe68c0a3ca\942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD58241c9c6d5592728ef3a893e4aaf3a9e
SHA1bc2e8eebc4d58947fd67b2d2b9b1c09183def4dc
SHA25624722cadf1a54cf2d7c3fcdf3cfa19414bfa784b7302c5a310ad61c109cf02c1
SHA51276e1f7b2d58c05d21df714767c734094942fcbcf34293fc569258bd7e81be564f90b7ab3ac150972964014d247f8f770d2b58cc90ee314add72f61f0a04e5054
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
174B
MD53f339181acb793c6b7ceafde14f6c830
SHA13a55812ed012cf95bbc7a8831fc89d81ef50f243
SHA25661941f526d587d57660b459ce1453219395a6dffa012a8d8d89451b2df077e67
SHA512a73fa760403a4699f79754d71675a82785a4f4e07fab9f99dd0cd91e22248a38d0ce4dc5cc5a09d6c2ed25e86623ade69df4c54ad86c8662b28e028c55681723
-
Filesize
170B
MD5fe8f2dc0c31bec2e04ce84cfd426e3cd
SHA1d6e7e2ecdb825b84b11bd1ed777a059070587375
SHA2566feae42ae3e2afed87bbc7bfd2b33e4aa8a1fedfc986b11196dcb8768a6d1310
SHA512218a88837e718f57513f6118a37225b1bbeacc970acebae0d90e4c6b396bb32217856e2c9d48cbda7e475ded6549cfa8f375af0d2db24f17731d0bd274089395
-
Filesize
732KB
MD531b1fe0aacf5fcbced44e89252d1d4b8
SHA13d56a02e23bbf2f6b3ac86db262391ccd2d06e5a
SHA256942263c89534d74459991db826caf2e9a187c074730f5c4f0f83f8c91e980e38
SHA5121b49741fab83d12bf0082c9ee070d999ab79860744322d755d7b5a53998ad6827d38306bb7d43763ae487ee64d451de5aec5aaab357422250174c4b8920add60
-
Filesize
5.1MB
-
Filesize
5.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
600KB
-
Filesize
1.1MB