Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

3

66d5df6818...24.exe

windows7-x64

10

66d5df6818...24.exe

windows10-1703-x64

10

66d5df6818...24.exe

windows10-2004-x64

10

66d5df6818...24.exe

windows11-21h2-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    141s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    02/09/2024, 16:12 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    66d5df681876c_file010924.exe

  • Size

    812KB

  • MD5

    7972b08246e568495d9d116fc2d0b159

  • SHA1

    3e12225494f08369858453fd9fc7481b4f788165

  • SHA256

    2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84

  • SHA512

    f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

  • SSDEEP

    24576:60oeRhL4Zihw/WaRupypku1ADMH0h0kT:60J482RuRuQMm

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test1/get.php

Attributes
  • extension

    .watz

  • offline_id

    Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@freshingmail.top Reserve e-mail address to contact us: datarestorehelpyou@airmail.cc Your personal ID: 0874PsawqS

rsa_pubkey.plain
1
-----BEGIN PUBLIC KEY-----
2
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAsZOJbLC8rdQ3RNFdWJ9l
3
sRHwDxjXZCN4K9IEo3ccj2X7KVzvLXJ/I+jMWoFDgbTA5TMMDPMhlSykGYr1rbX9
4
tDxs5EL7FC3R6jbLzQ+QVdvG2Slvd1aEiSAhkrB6Z97DC28ixTGkA4aCQKKFT5ge
5
SXPpDStS2N3zeiWPCMkOs9RErtxVW9sXoWRAFtBg2kSHTyKEWcRqnxplrJGdVQKU
6
0DxDnHDefnxaf/3VSRczBwGZlq/Mr2bfHM2Mf8JWmYztlmGbjGb//oixuuRePxzt
7
6xgozgVrC64HnagNFyODdlk2w/BpJWXIbgivZ0kR40Ll3NEAl3Z26cIkIc6pAJ3s
8
fwIDAQAB
9
-----END PUBLIC KEY-----

Signatures

  • Detected Djvu ransomware 17 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 26 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe
    "C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:444
    • C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe
      "C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe"
      2⤵
      • Adds Run key to start application
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:1240
      • C:\Windows\SysWOW64\icacls.exe
        icacls "C:\Users\Admin\AppData\Local\805c6345-9753-4be9-8c8d-79bfe221cdc6" /deny *S-1-1-0:(OI)(CI)(DE,DC)
        3⤵
        • Modifies file permissions
        • System Location Discovery: System Language Discovery
        PID:4040
      • C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe
        "C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe" --Admin IsNotAutoStart IsNotTask
        3⤵
        • Suspicious use of SetThreadContext
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:668
        • C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe
          "C:\Users\Admin\AppData\Local\Temp\66d5df681876c_file010924.exe" --Admin IsNotAutoStart IsNotTask
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          PID:1692

Network

  • flag-us
    DNS
    api.2ip.ua
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    api.2ip.ua
    IN A
    Response
    api.2ip.ua
    IN A
    188.114.97.0
    api.2ip.ua
    IN A
    188.114.96.0
  • flag-us
    DNS
    ctldl.windowsupdate.com
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    bg.microsoft.map.fastly.net
    bg.microsoft.map.fastly.net
    IN A
    199.232.214.172
    bg.microsoft.map.fastly.net
    IN A
    199.232.210.172
  • flag-us
    DNS
    ctldl.windowsupdate.com
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
  • flag-us
    DNS
    c.pki.goog
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    c.pki.goog
    IN A
    Response
    c.pki.goog
    IN CNAME
    pki-goog.l.google.com
    pki-goog.l.google.com
    IN A
    216.58.201.99
  • flag-us
    DNS
    8.8.8.8.in-addr.arpa
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    8.8.8.8.in-addr.arpa
    IN PTR
    Response
    8.8.8.8.in-addr.arpa
    IN PTR
    dnsgoogle
  • flag-us
    DNS
    cajgtus.com
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    cajgtus.com
    IN A
    Response
    cajgtus.com
    IN A
    102.189.104.201
    cajgtus.com
    IN A
    186.137.126.27
    cajgtus.com
    IN A
    123.213.233.131
    cajgtus.com
    IN A
    220.125.3.190
    cajgtus.com
    IN A
    46.100.50.5
    cajgtus.com
    IN A
    190.98.23.157
    cajgtus.com
    IN A
    211.202.224.10
    cajgtus.com
    IN A
    180.75.10.8
    cajgtus.com
    IN A
    181.204.98.226
    cajgtus.com
    IN A
    190.187.52.42
  • flag-us
    DNS
    81.144.22.2.in-addr.arpa
    66d5df681876c_file010924.exe
    Remote address:
    8.8.8.8:53
    Request
    81.144.22.2.in-addr.arpa
    IN PTR
    Response
    81.144.22.2.in-addr.arpa
    IN PTR
    a2-22-144-81deploystaticakamaitechnologiescom
  • flag-gb
    GET
    http://c.pki.goog/r/gsr1.crl
    66d5df681876c_file010924.exe
    Remote address:
    216.58.201.99:80
    Request
    GET /r/gsr1.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 1739
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Mon, 02 Sep 2024 15:55:07 GMT
    Expires: Mon, 02 Sep 2024 16:45:07 GMT
    Cache-Control: public, max-age=3000
    Age: 1046
    Last-Modified: Mon, 08 Jul 2024 07:38:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-gb
    GET
    http://c.pki.goog/r/r4.crl
    66d5df681876c_file010924.exe
    Remote address:
    216.58.201.99:80
    Request
    GET /r/r4.crl HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    User-Agent: Microsoft-CryptoAPI/10.0
    Host: c.pki.goog
    Response
    HTTP/1.1 200 OK
    Accept-Ranges: bytes
    Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
    Cross-Origin-Resource-Policy: cross-origin
    Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
    Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
    Content-Length: 436
    X-Content-Type-Options: nosniff
    Server: sffe
    X-XSS-Protection: 0
    Date: Mon, 02 Sep 2024 16:04:36 GMT
    Expires: Mon, 02 Sep 2024 16:54:36 GMT
    Cache-Control: public, max-age=3000
    Age: 477
    Last-Modified: Thu, 25 Jul 2024 14:48:00 GMT
    Content-Type: application/pkix-crl
    Vary: Accept-Encoding
  • flag-us
    DNS
    172.214.232.199.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    172.214.232.199.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    ctldl.windowsupdate.com
    Remote address:
    8.8.8.8:53
    Request
    ctldl.windowsupdate.com
    IN A
    Response
    ctldl.windowsupdate.com
    IN CNAME
    ctldl.windowsupdate.com.delivery.microsoft.com
    ctldl.windowsupdate.com.delivery.microsoft.com
    IN CNAME
    wu-b-net.trafficmanager.net
    wu-b-net.trafficmanager.net
    IN CNAME
    download.windowsupdate.com.edgesuite.net
    download.windowsupdate.com.edgesuite.net
    IN CNAME
    a767.dspw65.akamai.net
    a767.dspw65.akamai.net
    IN A
    2.22.144.81
    a767.dspw65.akamai.net
    IN A
    2.22.144.73
  • flag-us
    DNS
    0.97.114.188.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    0.97.114.188.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    201.104.189.102.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    201.104.189.102.in-addr.arpa
    IN PTR
    Response
  • flag-us
    DNS
    99.201.58.216.in-addr.arpa
    Remote address:
    8.8.8.8:53
    Request
    99.201.58.216.in-addr.arpa
    IN PTR
    Response
    99.201.58.216.in-addr.arpa
    IN PTR
    prg03s02-in-f991e100net
    99.201.58.216.in-addr.arpa
    IN PTR
    prg03s02-in-f3�H
    99.201.58.216.in-addr.arpa
    IN PTR
    lhr48s48-in-f3�H
  • flag-us
    DNS
    nexusrules.officeapps.live.com
    Remote address:
    8.8.8.8:53
    Request
    nexusrules.officeapps.live.com
    IN A
    Response
    nexusrules.officeapps.live.com
    IN CNAME
    prod.nexusrules.live.com.akadns.net
    prod.nexusrules.live.com.akadns.net
    IN A
    52.111.227.11
  • flag-eg
    GET
    http://cajgtus.com/test1/get.php?pid=15AF9E83CC0FD4162699D49CF0316442&first=true
    66d5df681876c_file010924.exe
    Remote address:
    102.189.104.201:80
    Request
    GET /test1/get.php?pid=15AF9E83CC0FD4162699D49CF0316442&first=true HTTP/1.1
    User-Agent: Microsoft Internet Explorer
    Host: cajgtus.com
    Response
    HTTP/1.1 200 OK
    Date: Mon, 02 Sep 2024 16:12:42 GMT
    Server: Apache/2.4.37 (Win64) PHP/5.6.40
    X-Powered-By: PHP/5.6.40
    Content-Length: 558
    Connection: close
    Content-Type: text/html; charset=UTF-8
  • 188.114.97.0:443
    api.2ip.ua
    tls
    66d5df681876c_file010924.exe
    1.1kB
     5.6kB
     14
    11
  • 216.58.201.99:80
    http://c.pki.goog/r/r4.crl
    http
    66d5df681876c_file010924.exe
    556 B
     3.8kB
     7
    5

    HTTP Request

    GET http://c.pki.goog/r/gsr1.crl

    HTTP Response

    200

    HTTP Request

    GET http://c.pki.goog/r/r4.crl

    HTTP Response

    200
  • 188.114.97.0:443
    api.2ip.ua
    tls
    66d5df681876c_file010924.exe
    1.1kB
     5.5kB
     15
    10
  • 102.189.104.201:80
    http://cajgtus.com/test1/get.php?pid=15AF9E83CC0FD4162699D49CF0316442&first=true
    http
    66d5df681876c_file010924.exe
    415 B
     974 B
     6
    5

    HTTP Request

    GET http://cajgtus.com/test1/get.php?pid=15AF9E83CC0FD4162699D49CF0316442&first=true

    HTTP Response

    200
  • 8.8.8.8:53
    api.2ip.ua
    dns
    66d5df681876c_file010924.exe
    194 B
     325 B
     3
    2

    DNS Request

    api.2ip.ua

    DNS Response

    188.114.97.0
    188.114.96.0

    DNS Request

    ctldl.windowsupdate.com

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    199.232.214.172
    199.232.210.172

  • 8.8.8.8:53
    c.pki.goog
    dns
    66d5df681876c_file010924.exe
    249 B
     547 B
     4
    4

    DNS Request

    c.pki.goog

    DNS Response

    216.58.201.99

    DNS Request

    8.8.8.8.in-addr.arpa

    DNS Request

    cajgtus.com

    DNS Response

    102.189.104.201
    186.137.126.27
    123.213.233.131
    220.125.3.190
    46.100.50.5
    190.98.23.157
    211.202.224.10
    180.75.10.8
    181.204.98.226
    190.187.52.42

    DNS Request

    81.144.22.2.in-addr.arpa

  • 8.8.8.8:53
    172.214.232.199.in-addr.arpa
    dns
    143 B
     411 B
     2
    2

    DNS Request

    172.214.232.199.in-addr.arpa

    DNS Request

    ctldl.windowsupdate.com

    DNS Response

    2.22.144.81
    2.22.144.73

  • 8.8.8.8:53
    0.97.114.188.in-addr.arpa
    dns
    145 B
     268 B
     2
    2

    DNS Request

    0.97.114.188.in-addr.arpa

    DNS Request

    201.104.189.102.in-addr.arpa

  • 8.8.8.8:53
    99.201.58.216.in-addr.arpa
    dns
    148 B
     310 B
     2
    2

    DNS Request

    99.201.58.216.in-addr.arpa

    DNS Request

    nexusrules.officeapps.live.com

    DNS Response

    52.111.227.11

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    1KB

    MD5

    7fb5fa1534dcf77f2125b2403b30a0ee

    SHA1

    365d96812a69ac0a4611ea4b70a3f306576cc3ea

    SHA256

    33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

    SHA512

    a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    174B

    MD5

    3daf6d4caaaa78cda5295a4c0b825111

    SHA1

    4b07a8cf9d599f2a9f3cffa9ca987dfdc53ee375

    SHA256

    a57e665bae9b4ac707ebd0acac088abb459a7cb3368b8c2dbdd66ac88a33079e

    SHA512

    1ecc0acc29ded358f130de1bf94c493be7ea397bacb549d0d98e8cce1f5b8e3c6f23eff84f025a7b414b018ee3078df150b943b80852659551406415060cc800

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    170B

    MD5

    364bece546a052849a54ff683f58d466

    SHA1

    ebe6cbc6bf5c03082ea96f968af86f09fe63bf69

    SHA256

    e9d3cb13519c69ccf683c1868d090ef2bb309f2d3d670c22d168c2d14ff73cae

    SHA512

    3ec426fa8bd66c93be0161edd72bdefe7af7c0b45fba2439a906d90ceef9a0638c0f1f4093a0589c0dc4f2952e3e95179cf17599f32136d5151240f3e658ee45

    Download Submit

  • C:\Users\Admin\AppData\Local\805c6345-9753-4be9-8c8d-79bfe221cdc6\66d5df681876c_file010924.exe
    Filesize

    812KB

    MD5

    7972b08246e568495d9d116fc2d0b159

    SHA1

    3e12225494f08369858453fd9fc7481b4f788165

    SHA256

    2a6c90c8db27e6ac04c7e339dfe4b3c2d47a292bcf6fc1c5b4e0ae62fc81ff84

    SHA512

    f0ead246f31d1badb3cd5fd67cb5b3081f027fdad44dd50364734d61722f1bc2cacb1ad5d842ca3f7000a2699e7bdf059a508b54a95f5e155ae274d70e833ff7

    Download Submit

  • memory/444-1-0x00000000024A0000-0x0000000002537000-memory.dmp

    Filesize

    604KB

    Download

  • memory/444-2-0x00000000025C0000-0x00000000026DB000-memory.dmp

    Filesize

    1.1MB

    Download

  • memory/668-27-0x0000000000400000-0x000000000065D000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/668-23-0x0000000000400000-0x000000000065D000-memory.dmp

    Filesize

    2.4MB

    Download

  • memory/1240-4-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1240-5-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1240-3-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1240-21-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1240-6-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-35-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-26-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-28-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-36-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-25-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-37-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-41-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-44-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-43-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-45-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

  • memory/1692-46-0x0000000000400000-0x0000000000537000-memory.dmp

    Filesize

    1.2MB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.