Analysis

  • max time kernel
    102s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240802-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-08-2024 23:38

General

  • Target

    04e42207db45792cae0f6d3fd83f0680N.exe

  • Size

    801KB

  • MD5

    04e42207db45792cae0f6d3fd83f0680

  • SHA1

    cb17f3a1bb57541204afd27313b390e5ead5096c

  • SHA256

    b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9

  • SHA512

    b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

  • SSDEEP

    24576:7oL6YwH+hUfoA5snjj0ZvgCxwaEbNHzy9XSm3XNEGQnA:cL6Yw2UfoOoEwaONQXHNEGe

Malware Config

Extracted

Family

djvu

C2

http://asvb.top/nddddhsspen6/get.php

Attributes
  • extension

    .pcqq

  • offline_id

    3pNdLH1399769YerBBKCxHURRAqLhaXsGw3Fbkt1

  • payload_url

    http://asvb.top/files/penelop/updatewin1.exe

    http://asvb.top/files/penelop/updatewin2.exe

    http://asvb.top/files/penelop/updatewin.exe

    http://asvb.top/files/penelop/3.exe

    http://asvb.top/files/penelop/4.exe

    http://asvb.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-TVrnNufMGq Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0296Sirj

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 9 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe
    "C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:4716
    • C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe
      "C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe"
      2⤵
      • Checks computer location settings
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3528
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\75948559-0ffb-401d-9f4b-eb3d5bc23011" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:2548
      • C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe
        "C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4840
        • C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe
          "C:\Users\Admin\AppData\Local\Temp\04e42207db45792cae0f6d3fd83f0680N.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • System Location Discovery: System Language Discovery
          PID:4964
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -u -p 4964 -s 568
            5⤵
            • Program crash
            PID:4488
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4964 -ip 4964
    1⤵
      PID:3844

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\75948559-0ffb-401d-9f4b-eb3d5bc23011\04e42207db45792cae0f6d3fd83f0680N.exe

      Filesize

      801KB

      MD5

      04e42207db45792cae0f6d3fd83f0680

      SHA1

      cb17f3a1bb57541204afd27313b390e5ead5096c

      SHA256

      b377b7b8211e454117ba3d6cd6bb1ac84c0105c8647187cb5cf19ad50c9d26b9

      SHA512

      b81da4e8961bc8c25e6832db5c1227cb253e178e6c5a4db0725ed073639d944b8d8012865ace42b2781b3f09b082e44a8a19c2ee326a173acb8757caebacbbf7

    • memory/3528-4-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/3528-3-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/3528-5-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/3528-6-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/3528-19-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4716-1-0x0000000002220000-0x00000000022BD000-memory.dmp

      Filesize

      628KB

    • memory/4716-2-0x0000000002310000-0x000000000242B000-memory.dmp

      Filesize

      1.1MB

    • memory/4840-21-0x0000000000400000-0x00000000004D9000-memory.dmp

      Filesize

      868KB

    • memory/4840-27-0x0000000000400000-0x00000000004D9000-memory.dmp

      Filesize

      868KB

    • memory/4964-24-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4964-23-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB

    • memory/4964-26-0x0000000000400000-0x0000000000537000-memory.dmp

      Filesize

      1.2MB