Malware Analysis Report

2024-10-23 16:21

Sample ID 240902-fn33eascqq
Target 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84
SHA256 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84

Threat Level: Known bad

The file 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84 was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu Ransomware

Modifies file permissions

Looks up external IP address via web service

Adds Run key to start application

Suspicious use of SetThreadContext

Unsigned PE

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Suspicious use of WriteProcessMemory

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-02 05:02

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-02 05:02

Reported

2024-09-02 05:07

Platform

win7-20240708-en

Max time kernel

294s

Max time network

163s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\0755d1eb-8e99-4320-aa36-5d1e136375f9\\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2168 wrote to memory of 2972 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2972 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 2972 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 2972 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 2972 wrote to memory of 2900 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 2972 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2972 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2972 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2972 wrote to memory of 2820 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 2820 wrote to memory of 2572 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\0755d1eb-8e99-4320-aa36-5d1e136375f9" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
GB 142.250.178.3:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
CO 181.128.22.240:80 cajgtus.com tcp
US 8.8.8.8:53 crl.microsoft.com udp
GB 88.221.134.146:80 crl.microsoft.com tcp
US 8.8.8.8:53 www.microsoft.com udp
GB 95.100.245.144:80 www.microsoft.com tcp

Files

memory/2168-0-0x0000000001E20000-0x0000000001EB1000-memory.dmp

memory/2168-1-0x0000000001E20000-0x0000000001EB1000-memory.dmp

memory/2972-2-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

memory/2168-5-0x0000000001F20000-0x000000000203B000-memory.dmp

memory/2168-6-0x0000000001E20000-0x0000000001EB1000-memory.dmp

memory/2972-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2972-8-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2972-9-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\0755d1eb-8e99-4320-aa36-5d1e136375f9\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

MD5 7972b08246e568495d9d116fc2d0b159
SHA1 3e12225494f08369858453fd9fc7481b4f788165
SHA256 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84
SHA512 f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

memory/2972-29-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2820-30-0x0000000000660000-0x00000000006F1000-memory.dmp

memory/2820-31-0x0000000000400000-0x000000000065D000-memory.dmp

memory/2820-37-0x0000000000400000-0x000000000065D000-memory.dmp

memory/2572-36-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-38-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 0426062d21d50967f3b5acb55cf8b31a
SHA1 a56741c7ab3953c1e7f54035deec25db1f0fbf5d
SHA256 5b856b6453d94c9e73305af672b33dfbceaff5d214cff2196624ab449a7e5f94
SHA512 ea6933b65ddfe6c51b5f1be359b13564943449cebe91da5f3e296c96284ba9a529e3653f0f37c9e3b25395d210d5c5b4358c480d9f193e4e6090c33185b6eac7

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 582d076d005da822be73ba665e3145df
SHA1 7ad0d914feb63e90d4f9ec5d8e16b75557c35b0f
SHA256 9592b2b680316f797785664ec91f89bc71907cf1520422af63506f334beaa091
SHA512 feb964baf2c7d60876adc08bfa4175cbf198929799f6637ea73a8579c7fbf3387cf1bc4a55607053c38697eeb3498ff5475ef5a54a4b6f0251ca1a6cd985c7db

C:\Users\Admin\AppData\Local\Temp\CabF68F.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

memory/2572-53-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-54-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-52-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-58-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-61-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2572-60-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2168-62-0x0000000001F20000-0x000000000203B000-memory.dmp

memory/2572-63-0x0000000000400000-0x0000000000537000-memory.dmp

memory/2820-64-0x0000000000400000-0x000000000065D000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-02 05:02

Reported

2024-09-02 05:07

Platform

win10-20240611-en

Max time kernel

297s

Max time network

298s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1453213197-474736321-1741884505-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\21149b5b-2e26-4571-b607-3306989a44e8\\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 1592 wrote to memory of 4532 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 4532 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 4532 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 4532 wrote to memory of 1992 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Windows\SysWOW64\icacls.exe
PID 4532 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 4532 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 4532 wrote to memory of 3508 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe
PID 3508 wrote to memory of 228 N/A C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\21149b5b-2e26-4571-b607-3306989a44e8" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe" --Admin IsNotAutoStart IsNotTask

C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

"C:\Users\Admin\AppData\Local\Temp\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
GB 142.250.178.3:80 c.pki.goog tcp
US 8.8.8.8:53 3.178.250.142.in-addr.arpa udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 cajgtus.com udp
IR 46.100.50.5:80 cajgtus.com tcp
US 8.8.8.8:53 5.50.100.46.in-addr.arpa udp
US 8.8.8.8:53 31.243.111.52.in-addr.arpa udp
US 8.8.8.8:53 28.173.189.20.in-addr.arpa udp

Files

memory/1592-1-0x00000000022F0000-0x0000000002391000-memory.dmp

memory/1592-2-0x0000000002410000-0x000000000252B000-memory.dmp

memory/4532-3-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4532-4-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4532-5-0x0000000000400000-0x0000000000537000-memory.dmp

memory/4532-6-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\Local\21149b5b-2e26-4571-b607-3306989a44e8\2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84.exe

MD5 7972b08246e568495d9d116fc2d0b159
SHA1 3e12225494f08369858453fd9fc7481b4f788165
SHA256 2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84
SHA512 f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

memory/4532-21-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3508-23-0x0000000000400000-0x000000000065D000-memory.dmp

memory/228-25-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3508-27-0x0000000000400000-0x000000000065D000-memory.dmp

memory/228-28-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-26-0x0000000000400000-0x0000000000537000-memory.dmp

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 a64232b16dae67548ed28a75f676d503
SHA1 194e05dd71c896fc2e6882373ffe1c606b3f9587
SHA256 b0f8816b801b05ef2bdcb9a281438591da7197bcc59311fb47f95aba5d66153f
SHA512 66b723908d77c75be4fdd3f2c2ffe8aa716202abda101afcd5ec6ab9525d40af2b1a0c916dc84e63d2aabef7921fb267a26cd582f7b2377e13b88f5b25590993

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 6f8371743133c3f8cce84b676844897f
SHA1 88f2a8b117db0ae66af6f4ce70d5d6a545f7422f
SHA256 11d23bf8e66ee5b73d2c72fb16356911ffa53a9d373457655be9d20916d0eac8
SHA512 1d6fdf57f9bfd008def4176fca7487f3b0515e79dde41845b059d0e089c9eab09394f4dc74fa3856c434062330cda4239c773df814adb1abc004fa725e71d485

memory/228-37-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-35-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-43-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-44-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-41-0x0000000000400000-0x0000000000537000-memory.dmp

memory/228-45-0x0000000000400000-0x0000000000537000-memory.dmp

memory/3508-46-0x0000000000400000-0x000000000065D000-memory.dmp