Analysis

  • max time kernel
    149s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-08-2024 12:02

General

  • Target

    bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe

  • Size

    1.1MB

  • MD5

    bba54c282b52450d29c0372a0d0801ea

  • SHA1

    670981a5ef11461aa1891ab300c41f7e83c4e64d

  • SHA256

    3d3df3e7eb70a5b2ec5d8484b65aa13b0bfa15161ad29b1435f17fc7c80cdef9

  • SHA512

    056cba65bbaf1aaa7f9a3d548dd6b958e562cd4e3be5e91b1998c3d998f5197a241b7bf8da8470743962d902153b6cfbf2239e18b7bacdd6f30ecae248e71c5d

  • SSDEEP

    24576:qn4qZ9kMnVFb91WNZj2GdNiZ5SfkVEmLq9kqRn:q4qZyQVx0Zj2Ge2S3O9DRn

Malware Config

Extracted

Family

djvu

C2

http://ring1.ug/As73yhsyU34578hxxx/SDf565g/get.php

Attributes
  • extension

    .coot

  • offline_id

    MRQ5kb5Z12tWuP3e25YoRt4PRDrJd2yuI3coott1

  • payload_url

    http://ring1.ug/files/cost/updatewin1.exe

    http://ring1.ug/files/cost/updatewin2.exe

    http://ring1.ug/files/cost/updatewin.exe

    http://ring1.ug/files/cost/3.exe

    http://ring1.ug/files/cost/4.exe

    http://ring1.ug/files/cost/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IbdGyCKhdr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0175Asd374y5iuhld

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 8 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2420
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\0cf2e5d2-89bf-4461-a170-643108ee2737" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:3788
    • C:\Users\Admin\AppData\Local\Temp\bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2524
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 2132
      2⤵
      • Program crash
      PID:4052
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2420 -ip 2420
    1⤵
      PID:4912

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      1KB

      MD5

      7fb5fa1534dcf77f2125b2403b30a0ee

      SHA1

      365d96812a69ac0a4611ea4b70a3f306576cc3ea

      SHA256

      33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

      SHA512

      a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      436B

      MD5

      971c514f84bba0785f80aa1c23edfd79

      SHA1

      732acea710a87530c6b08ecdf32a110d254a54c8

      SHA256

      f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

      SHA512

      43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

      Filesize

      174B

      MD5

      d8369eee79b6f0d2da81ed774265e022

      SHA1

      54d1c66b06324f6efb51947a6b8f641c399aa17a

      SHA256

      d39686c686fe1e9fee515b6807c350b95f2668a2e546b0a3cd0ba594861544fc

      SHA512

      bb555795aa7ff02861cb7f53d604f3504c2444305a6d767265455b6b269468d0a220031d9ba9d0a701e65c566eac8d14592653f6e8043748c43669a5d826740e

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

      Filesize

      170B

      MD5

      484b64931e32e0f4d2690d9960d79f7b

      SHA1

      a3a14d3a4ec80140111719766d4bc9fbd0db8666

      SHA256

      3b6267b9840712cc1be15857b8da8383cadda0cc8dd5e541cd4390fc2e81639a

      SHA512

      8edf9684f81c422746b6f70c94c9a1cdcee4220e58d4cfb3bd667e0968addab5bc92f1b38b3f648da0c130c5b51c32c70f3d7f563ebdddd5bc39e783a56dc4ce

    • C:\Users\Admin\AppData\Local\0cf2e5d2-89bf-4461-a170-643108ee2737\bba54c282b52450d29c0372a0d0801ea_JaffaCakes118.exe

      Filesize

      1.1MB

      MD5

      bba54c282b52450d29c0372a0d0801ea

      SHA1

      670981a5ef11461aa1891ab300c41f7e83c4e64d

      SHA256

      3d3df3e7eb70a5b2ec5d8484b65aa13b0bfa15161ad29b1435f17fc7c80cdef9

      SHA512

      056cba65bbaf1aaa7f9a3d548dd6b958e562cd4e3be5e91b1998c3d998f5197a241b7bf8da8470743962d902153b6cfbf2239e18b7bacdd6f30ecae248e71c5d

    • memory/2420-14-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2420-16-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/2420-15-0x0000000009AC0000-0x0000000009BDA000-memory.dmp

      Filesize

      1.1MB

    • memory/2420-1-0x00000000099F0000-0x0000000009ABB000-memory.dmp

      Filesize

      812KB

    • memory/2420-3-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/2420-2-0x0000000009AC0000-0x0000000009BDA000-memory.dmp

      Filesize

      1.1MB

    • memory/2524-24-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2524-27-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB

    • memory/2524-29-0x0000000000400000-0x0000000001400000-memory.dmp

      Filesize

      16.0MB