Malware Analysis Report

2024-10-23 16:21

Sample ID 240906-czp35s1hmc
Target 2024-09-06_3aadaefca16a49659955ad2c8571924d_stop
SHA256 54843ec079381cbb8ea8840db141a92a1d6bfa44eaf7501d93202bfd1546c00a
Tags
djvu discovery persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

54843ec079381cbb8ea8840db141a92a1d6bfa44eaf7501d93202bfd1546c00a

Threat Level: Known bad

The file 2024-09-06_3aadaefca16a49659955ad2c8571924d_stop was found to be: Known bad.

Malicious Activity Summary

djvu discovery persistence ransomware

Detected Djvu ransomware

Djvu family

Djvu Ransomware

Modifies file permissions

Checks computer location settings

Adds Run key to start application

Looks up external IP address via web service

Enumerates physical storage devices

System Location Discovery: System Language Discovery

Unsigned PE

Suspicious behavior: EnumeratesProcesses

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-09-06 02:31

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Djvu family

djvu

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-09-06 02:31

Reported

2024-09-06 02:33

Platform

win7-20240903-en

Max time kernel

117s

Max time network

118s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1488793075-819845221-1497111674-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\f15eb7a3-42b1-4975-86dc-66f351e8e960\\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1732 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Windows\SysWOW64\icacls.exe
PID 1732 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Windows\SysWOW64\icacls.exe
PID 1732 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Windows\SysWOW64\icacls.exe
PID 1732 wrote to memory of 1664 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Windows\SysWOW64\icacls.exe
PID 1732 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe
PID 1732 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe
PID 1732 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe
PID 1732 wrote to memory of 2768 N/A C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\f15eb7a3-42b1-4975-86dc-66f351e8e960" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.27.94:80 c.pki.goog tcp
US 104.21.65.24:443 api.2ip.ua tcp
US 8.8.8.8:53 astdg.org udp
US 8.8.8.8:53 astdg.top udp

Files

C:\Users\Admin\AppData\Local\f15eb7a3-42b1-4975-86dc-66f351e8e960\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

MD5 3aadaefca16a49659955ad2c8571924d
SHA1 2e3a219c70ac217cc90da192ddccf91dfa6c4a95
SHA256 54843ec079381cbb8ea8840db141a92a1d6bfa44eaf7501d93202bfd1546c00a
SHA512 482e165e7a8ec70296b87b8ae42060c5183cd693cfa6c9f98da160086d0698266f689ff7883c8a97180eed97c7a163e7497a568a618636c50f6a13f888652ef5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 3378bc4d2f8e9c11b8456402d3235828
SHA1 295f6e44545c1d1fa86337b4147de74d8bb76b58
SHA256 abb05a00ce1f5721a68d2d680310c95809a924f7440d5027c4d918b117587a78
SHA512 034c671aabd457959cde1879c9d76885dbdcc20ded7d315acfd4bcd43a448f7798680ae35ddde7f3fb090876a26c9ab8bb7026b272123505adcd31154ded89fc

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 5afed2e54dc9571165638d9f180830f1
SHA1 0662da87e5efc884e4dd5abf82dc7a20707015cc
SHA256 10e0576f3d04e56a56aa080f9b8dfbf0402e9bf321182f6878fb4c9949c39f64
SHA512 c198fe48fba9378eb730b0c1929df3f81eaf047c819ef5acec48a3bb8af3fc6c24bffba6df3684efeca7aaa9e10719bcf0c54b9fa727c47fdc6cd17a097d69aa

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\Local\Temp\CabBE11.tmp

MD5 49aebf8cbd62d92ac215b2923fb1b9f5
SHA1 1723be06719828dda65ad804298d0431f6aff976
SHA256 b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f
SHA512 bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Analysis: behavioral2

Detonation Overview

Submitted

2024-09-06 02:31

Reported

2024-09-06 02:33

Platform

win10v2004-20240802-en

Max time kernel

95s

Max time network

123s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe"

Signatures

Detected Djvu ransomware

Description Indicator Process Target
N/A N/A N/A N/A

Djvu Ransomware

ransomware djvu

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A

Modifies file permissions

discovery
Description Indicator Process Target
N/A N/A C:\Windows\SysWOW64\icacls.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d0547177-2260-4bc2-bf80-546b4a34b736\\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe\" --AutoStart" C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A

Looks up external IP address via web service

Description Indicator Process Target
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A
N/A api.2ip.ua N/A N/A

Enumerates physical storage devices

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Windows\SysWOW64\icacls.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe"

C:\Windows\SysWOW64\icacls.exe

icacls "C:\Users\Admin\AppData\Local\d0547177-2260-4bc2-bf80-546b4a34b736" /deny *S-1-1-0:(OI)(CI)(DE,DC)

C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

"C:\Users\Admin\AppData\Local\Temp\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe" --Admin IsNotAutoStart IsNotTask

Network

Country Destination Domain Proto
US 8.8.8.8:53 api.2ip.ua udp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 c.pki.goog udp
NL 142.250.27.94:80 c.pki.goog tcp
US 172.67.139.220:443 api.2ip.ua tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 8.8.8.8:53 220.139.67.172.in-addr.arpa udp
US 8.8.8.8:53 94.27.250.142.in-addr.arpa udp
US 8.8.8.8:53 72.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 astdg.org udp
US 8.8.8.8:53 astdg.top udp
US 8.8.8.8:53 104.219.191.52.in-addr.arpa udp
US 8.8.8.8:53 astdg.top udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 astdg.top udp
US 8.8.8.8:53 astdg.top udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 15.164.165.52.in-addr.arpa udp
US 8.8.8.8:53 217.135.221.88.in-addr.arpa udp
US 8.8.8.8:53 22.236.111.52.in-addr.arpa udp

Files

C:\Users\Admin\AppData\Local\d0547177-2260-4bc2-bf80-546b4a34b736\2024-09-06_3aadaefca16a49659955ad2c8571924d_stop.exe

MD5 3aadaefca16a49659955ad2c8571924d
SHA1 2e3a219c70ac217cc90da192ddccf91dfa6c4a95
SHA256 54843ec079381cbb8ea8840db141a92a1d6bfa44eaf7501d93202bfd1546c00a
SHA512 482e165e7a8ec70296b87b8ae42060c5183cd693cfa6c9f98da160086d0698266f689ff7883c8a97180eed97c7a163e7497a568a618636c50f6a13f888652ef5

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 be653b3b7b2aa2d3926a2ba9392081a8
SHA1 fca26c6c2b4fc4a3c3f526fe69349345ec09d8d5
SHA256 7ecaa2914e96f16fdad91eb3b27430cffb1e7e27c40d8f081b871093e96aa89c
SHA512 8934d1e69607c31bf409f6fcb91194d09040507aee817c26734279529c5d4eac7db86fcc8ff3cccd601ec7792f799cf12675f936bba92316fd191e1773fe0c23

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

MD5 7fb5fa1534dcf77f2125b2403b30a0ee
SHA1 365d96812a69ac0a4611ea4b70a3f306576cc3ea
SHA256 33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f
SHA512 a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

MD5 971c514f84bba0785f80aa1c23edfd79
SHA1 732acea710a87530c6b08ecdf32a110d254a54c8
SHA256 f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA512 43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

MD5 37133614fca60260fc80e57a4219c017
SHA1 b00dc4d17636c663a0197236eace0d1960496895
SHA256 ba8d1d2da16524783933c698cf8fe9177e2c3ccc0632d0590ccaf623920ca840
SHA512 f9e87686c0db64d593887107643e84e8c1f9b7917d51c47e219c68d3d888d493dd7fc40c2f9a51d78e11fc3a190bde3e722ab95cc09d6ed79316ddfa1b3ed6fa