Resubmissions
04-10-2024 16:44
241004-t8yv3syhpd 1027-09-2024 16:54
240927-vepkzsvbre 1027-09-2024 16:44
240927-t86wpavard 1004-08-2024 18:04
240804-wnq1vawbpg 1003-08-2024 17:26
240803-vzvbzazekn 1003-08-2024 16:14
240803-tpp4tsshqa 1003-08-2024 15:52
240803-tbarzsseqc 1031-07-2024 19:40
240731-ydk3yszdpq 1031-07-2024 10:53
240731-my145atfmf 10Analysis
-
max time kernel
862s -
max time network
873s -
platform
windows10-1703_x64 -
resource
win10-20240611-en -
resource tags
-
submitted
31-07-2024 19:40
General
-
Target
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe
-
Size
787KB
-
MD5
0b862b9c889d4bdc6f0bac7d702d8753
-
SHA1
fdc030df123e6e6a712cbc960a2e7c63266bf040
-
SHA256
4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
-
SHA512
4f7284a625b4909f9a0d80023c1dbfe3ed2de8a14fdf9a5bd3687d7e2fb21e265ee6cca613e4e6c8cab35f806501b155e6ed70a11530eb1cc78dbc38b22d3e8b
-
SSDEEP
24576:reKt4RjnJ+wWEr55fRue+cfxiskJM0BPA:rORdGA55fkcJinM0BI
Malware Config
Extracted
djvu
http://astdg.top/nddddhsspen6/get.php
-
extension
.moqs
-
offline_id
CatwRkqdYh2Jomn6DqwFoGgcSbDsle1xlE1NPtt1
-
payload_url
http://securebiz.org/dl/build2.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-N3p42CffoV Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0318ewgfDd
Signatures
-
Detected Djvu ransomware 35 IoCs
-
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Renames multiple (141) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Executes dropped EXE 6 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Looks up external IP address via web service 8 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of SetThreadContext 5 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
-
Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"2⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe"C:\Users\Admin\AppData\Local\Temp\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe" --Admin IsNotAutoStart IsNotTask4⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
-
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exeC:\Users\Admin\AppData\Local\f0809e71-9154-467c-bd57-1f421ff03446\4bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7.exe --Task2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
42B
MD5fd7c0f2f7c2d8497510edf8f5b14ab23
SHA1e9a2b95d0eaf487ce55193375ad14a794761dd67
SHA256da21778ac6629e8d58e191658ce1dc9445cf770636d4ff5f0752bf2f167c4e69
SHA512ff5faf897593e5029d64513b2ba4ffa8a0e92d1d1b048814b93080669f0b63bb2b42dbd56874a7dc08aceaf6bf70b83b3e65278a3012d7a2f8a53ff88716b43f
-
Filesize
1KB
MD57fb5fa1534dcf77f2125b2403b30a0ee
SHA1365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA25633a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
Filesize
174B
MD52a436f535d80b1d1c590070893383639
SHA11a1306e6be746e23acf9db4d39f993a8b7395f7e
SHA25612692a9cdbcded3c8c00b7001362deffd06b34d6b26249e6ba56e7aa39c34dcd
SHA512f3ca8513198b151263d319ba9223ae4a776b464e052a3e9c4ecfdb766a8b5a7f8418af8b322642b041604ee603d4c5d2fbb67ab888f1d0414181e19b7895b27d
-
Filesize
170B
MD58b6147519e42893dab36834bc8645e0d
SHA1a79655f70a9582006c42dc4aeb369138e987eafe
SHA25689f83eee0ddcb7d8aa2996d79248a49375bf2154dff9674d96184c8b3d269eb6
SHA512c16fd1f1338345a2f1cfb3e68f6469b1f61ab0da2d284d3194e8725973c61cebf87f94bbd24b05b9f3d21c744b36bb6b3c83652bec553d260415c0f77b60c1a6
-
Filesize
787KB
MD50b862b9c889d4bdc6f0bac7d702d8753
SHA1fdc030df123e6e6a712cbc960a2e7c63266bf040
SHA2564bf2dace8a23551a3cd374a14b68cef6185aa18f9148dac8bf77f19f734d3ad7
SHA5124f7284a625b4909f9a0d80023c1dbfe3ed2de8a14fdf9a5bd3687d7e2fb21e265ee6cca613e4e6c8cab35f806501b155e6ed70a11530eb1cc78dbc38b22d3e8b
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
588KB
-
Filesize
1.1MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
5.2MB
-
Filesize
5.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
1.2MB