Malware Analysis Report

2024-10-23 16:21

Sample ID 240822-2ntdvstfpl
Target d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a

Threat Level: Known bad

The file d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Djvu Ransomware

Detected Djvu ransomware

Modifies file permissions

Adds Run key to start application

Looks up external IP address via web service

Suspicious use of SetThreadContext

Enumerates physical storage devices

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-08-22 22:44

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-08-22 22:44

Reported

2024-08-22 22:49

Platform

win7-20240704-en

Max time kernel

295s

Max time network

245s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2212144002-1172735686-1556890956-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\e18487a4-7997-417f-ac7a-de4810aebbc7\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 2520 wrote to memory of 1240 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1240 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 1240 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 1240 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 1240 wrote to memory of 2608 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 1240 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1240 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1240 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1240 wrote to memory of 1220 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 1220 wrote to memory of 2712 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\e18487a4-7997-417f-ac7a-de4810aebbc7" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
MX 187.211.53.230:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 2.18.190.71:80 crl.microsoft.com tcp

Files

memory/2520-0-0x0000000001C30000-0x0000000001CC1000-memory.dmp

memory/2520-2-0x0000000001CD0000-0x0000000001DEB000-memory.dmp

memory/2520-1-0x0000000001C30000-0x0000000001CC1000-memory.dmp

memory/1240-3-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/1240-6-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1240-7-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1240-8-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\e18487a4-7997-417f-ac7a-de4810aebbc7\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/1240-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/1220-30-0x0000000000310000-0x00000000003A1000-memory.dmp

memory/1220-31-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/1220-36-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/2712-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-38-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 b603c79b10a4040148624375aebdfca9
SHA1 bbf96a64c5bf1c29145d499f98edb6734b76cd16
SHA256 0fcbc87c1d992292ed6881b72d022f7aee91c897ad09cd9584574433c5b6035a
SHA512 7875752c64fe2ac180fe3e461adb2d08b503832800251212eed17bcfb71fd6849d751a1dea0c941ba75ec1b88e095a1dec5f8467d689e49d12a09c7521c973cd

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 6637d410a82cd6db74209e73423002de
SHA1 54f286f1a859d0c1c62d2acffee3cb665f7d7402
SHA256 3eaefd442fc4744a8e3542f0e1f87adff1e72097af3ce0f488744a57e59b3166
SHA512 8cdf3dd9cf8bed280d7c19b9f971621ee7ec000a1e773b40688b70ec8e866ed0c17ae618878bba39f0b51fcba9e3bff71de678f9d35c8e6dc50f73a874598eb6

C:\Users\Admin\AppData\Local\Temp\CabF4AB.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

MD5 c7b19d3bef576a8ee596982c673731d2
SHA1 608ae6750a3c01ef11248a9a81b0a36da52ef205
SHA256 886dd2e2380e53f156da893c249d02f3701b8b24e4b9175a8a3067e4e7ef9425
SHA512 b0aa903c9dffef447f3fd929316631d2c34a4e091a1a163698063a354bff15fb0bae1bc62b68a5701f7f636a095021c15fd45c0ce670f3b360d59fb6ffd8e343

memory/2712-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-55-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-59-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-61-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-62-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2712-63-0x0000000000400000-0x0000000000537000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-08-22 22:44

Reported

2024-08-22 22:49

Platform

win10-20240404-en

Max time kernel

293s

Max time network

245s

Command Line

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-873560699-1074803302-2326074425-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\177c2a19-dce9-440c-acf3-f9002686d5a5\\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 3620 wrote to memory of 316 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 316 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 316 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 316 wrote to memory of 96 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Windows\SysWOW64\icacls.exe
PID 316 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 316 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 316 wrote to memory of 4568 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe
PID 4568 wrote to memory of 4628 N/A C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

Processes

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\177c2a19-dce9-440c-acf3-f9002686d5a5" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

"C:\Users\Admin\AppData\Local\Temp\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
FR 216.58.214.163:80 c.pki.goog tcp
US 8.8.8.8:53 24.65.21.104.in-addr.arpa udp
US 8.8.8.8:53 0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.8.0.8.0.8.0.8.0.ip6.arpa udp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
US 8.8.8.8:53 163.214.58.216.in-addr.arpa udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
CO 190.147.2.86:80 cajgtus.com tcp
US 8.8.8.8:53 86.2.147.190.in-addr.arpa udp
US 8.8.8.8:53 23.236.111.52.in-addr.arpa udp
US 8.8.8.8:53 14.173.189.20.in-addr.arpa udp

Files

memory/3620-1-0x00000000020F0000-0x000000000218E000-memory.dmp

memory/3620-2-0x00000000021B0000-0x00000000022CB000-memory.dmp

memory/316-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/316-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/316-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/316-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\177c2a19-dce9-440c-acf3-f9002686d5a5\d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a.exe

MD5 006edf0ac466164ddc9e0ac56474fe0a
SHA1 ee9f512713af63759f11279090d2c8004762735b
SHA256 d343ea857cdf97aa0ccfd14970425c6888bd216d36ad7f6255a044bed36a4b2a
SHA512 43305369fea2dad52d51bc9d5947a2f7e78d33baadd07093c250b9eb1fd3762c511033bbfae2b8d6eb52254306d137e29cd15e0b30b0f6d44a9d4f3d12b8b808

memory/316-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4568-23-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/4628-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4568-27-0x0000000000400000-0x00000000004D3000-memory.dmp

memory/4628-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-26-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 3df567db61735af5ff947a5c99bfcd59
SHA1 974cfeacf174d64c22cf11a8e3f9ecf9c0cc13b9
SHA256 1e59375f9b4a8ecd21ccbb4c80540ca5f6205cd6adfc7d938c7b7d7e19f98d22
SHA512 15689a79f4db7fb7fd510801400d204f1e2c325bf4b699c6c65071ecf52f97bb012b553534b507c5e1478d83b8ec1aa80e68c50fbb3cfb46ca360304a2e0c234

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 63c5cebdf6039001aaa03f6df3ff46f0
SHA1 1908e3913902a2ad66802153c1c4329aa995183a
SHA256 532692dea825a447951947f679148f4ac403a661dcb05d627dfb95874788caf1
SHA512 98ab2a765f9a23970274835e35cb9198cff68d027bf9b7c31b0b7276b4293df9523dabd14b73bb84561087a77f17f7eb348e7746aaf2ec9841532298c5f291c7

memory/4628-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-44-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4628-45-0x0000000000400000-0x0000000000537000-memory.dmp