Overview

overview

10

Static

static

10

2024-10-30...op.exe

windows7-x64

10

2024-10-30...op.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    32s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-20241010-en
  • resource tags

    arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
  • submitted
    30-10-2024 02:46

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe

  • Size

    1.1MB

  • MD5

    3439f3b37ecb66f7e3b5445ca83dff88

  • SHA1

    d5d16f63fcb21a5348b56e172907d5b54df6d129

  • SHA256

    88b66e8ae5adcc9ae9f7c98cf1f2207e0ea3f378d3b01378990b178e0b91abaa

  • SHA512

    76999eaa8ad66aa2ed4065a0c17fac10684c42df38ec6872901bba24a88b7e8bb25d1d8eafc8a89f7acba10b81d6dc8af5db6dc9212f99e527e35572f777d598

  • SSDEEP

    24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8wWQHUq7:F0dwAYZt6C31WeTVRPOhw7Uq7

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test1/get.php

Attributes
  • extension

    .hlas

  • offline_id

    vyhLHcV0DMKjS0CgDoJGF0yJ299laBK7lZQM9Tt1

  • payload_url

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool. Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0878qual

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Djvu family
    djvu
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe"
    1⤵
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:2108
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\e631a3e2-9415-406d-81f4-bf3560c72824" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:2328
    • C:\Users\Admin\AppData\Local\Temp\2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:2160

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    1KB

    MD5

    67e486b2f148a3fca863728242b6273e

    SHA1

    452a84c183d7ea5b7c015b597e94af8eef66d44a

    SHA256

    facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb

    SHA512

    d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    436B

    MD5

    971c514f84bba0785f80aa1c23edfd79

    SHA1

    732acea710a87530c6b08ecdf32a110d254a54c8

    SHA256

    f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895

    SHA512

    43dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
    Filesize

    174B

    MD5

    db31720260df787e825659e1afec20a5

    SHA1

    e9d012664f8f5d006824ce21134a2d4813e2989c

    SHA256

    4ecf4cc7f7115ca77df0a836319b9a16e932fe0b2a332bcdcf18fe50115e46f5

    SHA512

    28a2bcbcb00e6a58c22d2c83090832d528d2ea826e8b42e3406ab1726e1a581ab6bd6deb2a9169b734f3c609c9032c2d1b6744fbd5a40938ab26e68114532898

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
    Filesize

    342B

    MD5

    7ee1d8cbfbfe1e4c398574e6108a35e0

    SHA1

    36517223fc5baae4db0cbe25b244568ac0d5fe9a

    SHA256

    3d6fd78e11be5038af185e5ad13a55c51f1c92407bb980adb95dc33caa8ca40e

    SHA512

    93f3404a35b92b04164aa44684062661045aabc7b895acb163c1c959b9de6a73c4b856063f685e9cb7dfb3c406897de1d0daf983fce91b9b0bdc539a1881d2c3

    Download Submit

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
    Filesize

    170B

    MD5

    ccfad188d259a4e95673a2b01960acac

    SHA1

    3ac1aa266db57b2a127cee61c3933532c7024c7f

    SHA256

    bc394226ed2208ca90ab911b920cb51a953ebd2fcc668d534aea3362cbd9cd00

    SHA512

    5b62dc4c3c5755353994f528253e1bd81be99d862a7787db86d7a09001e56846ccdf71568b7e21b756e4b27016cb08bf3f2abd704b6f41254b67e654fa7d6188

    Download Submit

  • C:\Users\Admin\AppData\Local\Temp\CabDAF4.tmp
    Filesize

    70KB

    MD5

    49aebf8cbd62d92ac215b2923fb1b9f5

    SHA1

    1723be06719828dda65ad804298d0431f6aff976

    SHA256

    b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

    SHA512

    bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

    Download Submit

  • C:\Users\Admin\AppData\Local\e631a3e2-9415-406d-81f4-bf3560c72824\2024-10-30_3439f3b37ecb66f7e3b5445ca83dff88_stop.exe
    Filesize

    1.1MB

    MD5

    3439f3b37ecb66f7e3b5445ca83dff88

    SHA1

    d5d16f63fcb21a5348b56e172907d5b54df6d129

    SHA256

    88b66e8ae5adcc9ae9f7c98cf1f2207e0ea3f378d3b01378990b178e0b91abaa

    SHA512

    76999eaa8ad66aa2ed4065a0c17fac10684c42df38ec6872901bba24a88b7e8bb25d1d8eafc8a89f7acba10b81d6dc8af5db6dc9212f99e527e35572f777d598

    Download Submit