Analysis

  • max time kernel
    122s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    06-09-2024 06:13

General

  • Target

    2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe

  • Size

    1.1MB

  • MD5

    86dbb6ed19cb1e8f2da1c3dfa22f32b0

  • SHA1

    528ac12a59b58fab81b25500384a65e5d6d23a84

  • SHA256

    0ba115b3fee2afb35dee040675291100006d24a9684232be8c730f166b3b431f

  • SHA512

    e2e9bb68dd565b530cf451d5a7e37f66c110859126407eb1c12ffb8ec5f05cd36cc7fc931cf69e290b0901834c4530d372fec3c4f0c76c16fdf7f0459ff57b61

  • SSDEEP

    24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8OWQHUq7:F0dwAYZt6C31WeTVRPOhO7Uq7

Malware Config

Extracted

Family

djvu

C2

http://rlrz.org/lancer/get.php

Attributes
  • extension

    .rivd

  • offline_id

    WbO7bkwHxaepEmevfYYUBNgcxNJGpd7hoNKokRt1

  • payload_url

    http://znpst.top/dl/build2.exe

    http://rlrz.org/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-CcXGxzXf71 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0342gSd743d

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Modifies file permissions 1 TTPs 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2168
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\a4dcb087-a81f-402b-b7fb-c9515b563980" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:2760
    • C:\Users\Admin\AppData\Local\Temp\2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe
      "C:\Users\Admin\AppData\Local\Temp\2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2224

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    1KB

    MD5

    7fb5fa1534dcf77f2125b2403b30a0ee

    SHA1

    365d96812a69ac0a4611ea4b70a3f306576cc3ea

    SHA256

    33a39e9ec2133230533a686ec43760026e014a3828c703707acbc150fe40fd6f

    SHA512

    a9279fd60505a1bfeef6fb07834cad0fd5be02fd405573fc1a5f59b991e9f88f5e81c32fe910f69bdc6585e71f02559895149eaf49c25b8ff955459fd60c0d2e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12

    Filesize

    174B

    MD5

    4daea680ac410331f06a77edf9c6e986

    SHA1

    d8bfc325034f87251cdc36de226692ac7934ea20

    SHA256

    fab0b30453abb6e16087a5a037d5bd44dcc875cbb7234088ce30f8187a1538bb

    SHA512

    a0ae9e47a3a7f7128c08066a569a35565c0ae67642f721b0536d56cf4db2055468c84d2c0fc97fb98ed614bb45c01bc1a8a8602185af4ce095b8e6b9a1539cb6

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015

    Filesize

    342B

    MD5

    385ba1bfa1ffae2a5421d65e70120246

    SHA1

    f5e4d7bfb758cc5a57a9342df9fc8c15c169f187

    SHA256

    65e81eb150b192636ab55213495690742821983480b6eaa487a30e2f798e3f87

    SHA512

    9cbef0d30d79bf490e548a35c27bed4bc49f13d73e74d1c207a159434e33296892bf57ce189f9d2f093cc707032455b2cf3bf3e784e1bf19a903326376cb243a

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8

    Filesize

    170B

    MD5

    834045612f20eee83dc6f26cfb4a0745

    SHA1

    3f47bb1c143f3ea59a1f482095c821bee6af263c

    SHA256

    8a6a32b9c6e9ae865875b19505f259e457f15331e13f969a91c4e306c8421a24

    SHA512

    52de92e1c5529328f225e18d9ac122795366ef68fbd9850cf82838ce84088b9d6c437d858e371b218becdac2b0d7626b3d0c1e31fc6489fffdeb568adb9421e3

  • C:\Users\Admin\AppData\Local\Temp\CabF048.tmp

    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

  • C:\Users\Admin\AppData\Local\a4dcb087-a81f-402b-b7fb-c9515b563980\2024090686dbb6ed19cb1e8f2da1c3dfa22f32b0stop.exe

    Filesize

    1.1MB

    MD5

    86dbb6ed19cb1e8f2da1c3dfa22f32b0

    SHA1

    528ac12a59b58fab81b25500384a65e5d6d23a84

    SHA256

    0ba115b3fee2afb35dee040675291100006d24a9684232be8c730f166b3b431f

    SHA512

    e2e9bb68dd565b530cf451d5a7e37f66c110859126407eb1c12ffb8ec5f05cd36cc7fc931cf69e290b0901834c4530d372fec3c4f0c76c16fdf7f0459ff57b61