Overview
overview
10Static
static
1008751be484...2d.dll
windows7-x64
1008751be484...2d.dll
windows10-2004-x64
100a9f79abd4...51.exe
windows7-x64
30a9f79abd4...51.exe
windows10-2004-x64
30di3x.exe
windows7-x64
100di3x.exe
windows10-2004-x64
104a30275f14...ab.dll
windows7-x64
104a30275f14...ab.dll
windows10-2004-x64
102019-09-02...10.exe
windows7-x64
102019-09-02...10.exe
windows10-2004-x64
102c01b00772...eb.exe
windows7-x64
102c01b00772...eb.exe
windows10-2004-x64
1031.exe
windows7-x64
1031.exe
windows10-2004-x64
103DMark 11 ...on.exe
windows7-x64
33DMark 11 ...on.exe
windows10-2004-x64
342f9729255...61.exe
windows7-x64
1042f9729255...61.exe
windows10-2004-x64
105da0116af4...18.exe
windows7-x64
75da0116af4...18.exe
windows10-2004-x64
10c2716fcc73...86.exe
windows7-x64
10c2716fcc73...86.exe
windows10-2004-x64
1069c56d12ed...6b.exe
windows7-x64
1069c56d12ed...6b.exe
windows10-2004-x64
10905d572f23...50.exe
windows7-x64
10905d572f23...50.exe
windows10-2004-x64
10948340be97...54.exe
windows7-x64
10948340be97...54.exe
windows10-2004-x64
1095560f1a46...f9.dll
windows7-x64
395560f1a46...f9.dll
windows10-2004-x64
3Archive.zi...3e.exe
windows7-x64
8Archive.zi...3e.exe
windows10-2004-x64
8Resubmissions
05-11-2024 03:18
241105-dtxrgatbpg 10Analysis
-
max time kernel
141s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2024 03:18
Static task
static1
Behavioral task
behavioral1
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
08751be484e1572995ebb085df1c2c6372084d63a64dce7fab28130d79a6ea2d.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral3
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win7-20240729-en
Behavioral task
behavioral4
Sample
0a9f79abd48b95544d7e2b6658637d1eb23067a94e10bf06d05c9ecc73cf4b51.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral5
Sample
0di3x.exe
Resource
win7-20241010-en
Behavioral task
behavioral6
Sample
0di3x.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral7
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win7-20240708-en
Behavioral task
behavioral8
Sample
4a30275f14f80c6e11d5a253d7d004eda98651010e0aa47f744cf4105d1676ab.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral9
Sample
2019-09-02_22-41-10.exe
Resource
win7-20240903-en
Behavioral task
behavioral10
Sample
2019-09-02_22-41-10.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral11
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win7-20240903-en
Behavioral task
behavioral12
Sample
2c01b007729230c415420ad641ad92eb.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral13
Sample
31.exe
Resource
win7-20241010-en
Behavioral task
behavioral14
Sample
31.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral15
Sample
3DMark 11 Advanced Edition.exe
Resource
win7-20240903-en
Behavioral task
behavioral16
Sample
3DMark 11 Advanced Edition.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral17
Sample
42f972925508a82236e8533567487761.exe
Resource
win7-20240903-en
Behavioral task
behavioral18
Sample
42f972925508a82236e8533567487761.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral19
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win7-20240729-en
Behavioral task
behavioral20
Sample
5da0116af495e6d8af7241da9b8281d918b9ff9a98a3deab4cca1aec1e456c18.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral21
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win7-20241010-en
Behavioral task
behavioral22
Sample
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral23
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win7-20241010-en
Behavioral task
behavioral24
Sample
69c56d12ed7024696936fb69b4c6bee58174a275cb53fa966646a0b092d9626b.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral25
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win7-20240903-en
Behavioral task
behavioral26
Sample
905d572f23883f5f161f920e53473989cf7dffc16643aa759f77842e54add550.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral27
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win7-20240903-en
Behavioral task
behavioral28
Sample
948340be97cc69c2cf8e5c8327ee52a89eeb50095f978696c710ad773a46b654.exe
Resource
win10v2004-20241007-en
Behavioral task
behavioral29
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win7-20240903-en
Behavioral task
behavioral30
Sample
95560f1a465e8ba87a73f8e60a6657545073d55c3b5cfc2ffdaf3d69d46afcf9.dll
Resource
win10v2004-20241007-en
Behavioral task
behavioral31
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win7-20240903-en
Behavioral task
behavioral32
Sample
Archive.zip__ccacaxs2tbz2t6ob3e.exe
Resource
win10v2004-20241007-en
General
-
Target
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
-
Size
983KB
-
MD5
e15e3cfa542459e8d87e8bfdf70a38a1
-
SHA1
1c98fbf7b780fc8ab7f73d468ab77b41570c9665
-
SHA256
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
-
SHA512
fd55639cc4f757f90a01236b10bf33bd678ef7a141c6538a5285133aa8d610bb0bf287043717557a26d28a924f3c44fbf37c13421f27a389f2e8fc76ce4b91fe
-
SSDEEP
24576:Fp90jN2CdssXMZ/ggHEfsLJ4qFKqyqG5nFYR1t:N0NDdssygGl94qFKqyqYa
Malware Config
Extracted
djvu
http://dell1.ug/hosuhf37t5iqy3guygg6w4guiner/37tiuywgw/get.php
-
extension
.meds
-
offline_id
Pq9d1D32xIxjAlRK7OkLl3utdbWN8syVVEm35xt1
-
payload_url
http://dell1.ug/files/cost/updatewin1.exe
http://dell1.ug/files/cost/updatewin2.exe
http://dell1.ug/files/cost/updatewin.exe
http://dell1.ug/files/cost/3.exe
http://dell1.ug/files/cost/4.exe
http://dell1.ug/files/cost/5.exe
-
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-ZFjRnJfc9f Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 162Ad768734uygjdfg
Signatures
-
Detected Djvu ransomware 9 IoCs
Processes:
resource yara_rule behavioral22/memory/2144-2-0x0000000002470000-0x000000000258A000-memory.dmp family_djvu behavioral22/memory/2144-3-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/540-18-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/540-19-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/2144-26-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/2144-27-0x0000000002470000-0x000000000258A000-memory.dmp family_djvu behavioral22/memory/540-28-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/540-32-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu behavioral22/memory/540-33-0x0000000000400000-0x0000000000537000-memory.dmp family_djvu -
Djvu Ransomware
Ransomware which is a variant of the STOP family.
-
Djvu family
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\Control Panel\International\Geo\Nation c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2437139445-1151884604-3026847218-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\cfb856b6-1cd7-40b9-b3c0-4fb4399084d5\\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe\" --AutoStart" c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe -
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 2 api.2ip.ua 10 api.2ip.ua 1 api.2ip.ua -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4460 2144 WerFault.exe c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exeicacls.exec2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language icacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exec2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exepid process 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe 540 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe 540 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exedescription pid process target process PID 2144 wrote to memory of 4748 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe icacls.exe PID 2144 wrote to memory of 4748 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe icacls.exe PID 2144 wrote to memory of 4748 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe icacls.exe PID 2144 wrote to memory of 540 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe PID 2144 wrote to memory of 540 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe PID 2144 wrote to memory of 540 2144 c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe"C:\Users\Admin\AppData\Local\Temp\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\cfb856b6-1cd7-40b9-b3c0-4fb4399084d5" /deny *S-1-1-0:(OI)(CI)(DE,DC)2⤵
- Modifies file permissions
- System Location Discovery: System Language Discovery
PID:4748
-
-
C:\Users\Admin\AppData\Local\Temp\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe"C:\Users\Admin\AppData\Local\Temp\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe" --Admin IsNotAutoStart IsNotTask2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:540
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2144 -s 17962⤵
- Program crash
PID:4460
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2144 -ip 21441⤵PID:4692
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD567e486b2f148a3fca863728242b6273e
SHA1452a84c183d7ea5b7c015b597e94af8eef66d44a
SHA256facaf1c3a4bf232abce19a2d534e495b0d3adc7dbe3797d336249aa6f70adcfb
SHA512d3a37da3bb10a9736dc03e8b2b49baceef5d73c026e2077b8ebc1b786f2c9b2f807e0aa13a5866cf3b3cafd2bc506242ef139c423eaffb050bbb87773e53881e
-
Filesize
436B
MD5971c514f84bba0785f80aa1c23edfd79
SHA1732acea710a87530c6b08ecdf32a110d254a54c8
SHA256f157ed17fcaf8837fa82f8b69973848c9b10a02636848f995698212a08f31895
SHA51243dc1425d80e170c645a3e3bb56da8c3acd31bd637329e9e37094ac346ac85434df4edcdbefc05ae00aea33a80a88e2af695997a495611217fe6706075a63c58
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize174B
MD599b579c30d1622b9fa77578256cc089f
SHA1f52da9c42210d28904b1ef4398229b238077080d
SHA2568c408592cc777e40a64e15e4f5024c3f5caf3c4fbfc8c72338562b15204d3b28
SHA512c028737dd781b06e9573bd82e2eea61dfa0416102dcb66f72d53f0ddc0c7355000ca6998c86223061ed930efb3be1184995eef08e08a33aec67e7bb96f77c19c
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize170B
MD50d67b1bd032b65bfefe967780bf3d3e5
SHA1df269f8212d0fded12af7ff6fa4474133bcbf073
SHA2568783c824234c876c17bff5a019783bf336779e6054c5da866194a7927845be19
SHA5123aa2fe46832d30c6e2126811b81dad2715f22416d0b21b78ee6700e8b4c89ec41d9c8bef416645e3319b3897ab17df6a81db8bf01f7f18b9a6c2f97f412a8b1a
-
C:\Users\Admin\AppData\Local\cfb856b6-1cd7-40b9-b3c0-4fb4399084d5\c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286.exe
Filesize983KB
MD5e15e3cfa542459e8d87e8bfdf70a38a1
SHA11c98fbf7b780fc8ab7f73d468ab77b41570c9665
SHA256c2716fcc735a4f1b9fce29cb1dc20a26969b71f615e2b119e9680f015379d286
SHA512fd55639cc4f757f90a01236b10bf33bd678ef7a141c6538a5285133aa8d610bb0bf287043717557a26d28a924f3c44fbf37c13421f27a389f2e8fc76ce4b91fe