Overview

overview

10

Static

static

3

7bc2928ce0...fd.exe

windows10-2004-x64

10

Resubmissions

06/04/2025, 11:17

250406-ndzk8sw1cv 10

06/04/2025, 10:50

250406-mxmv4syqs5 10

Analysis

  • max time kernel
    149s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2025, 10:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe

  • Size

    725KB

  • MD5

    e8bbb6d921b79101aea7d906a1798f3d

  • SHA1

    4fd59822cdedd1b194d27d2c01a9cde6222de1bb

  • SHA256

    7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd

  • SHA512

    c525e07c65c7be43aa90568f98253b397919cd0f597b1ba446fed51a578ca1aae4c93fa59e1345b20e3216a676ba35c89c67d6ced6bea68da44a53989fa4d656

  • SSDEEP

    12288:O7q+wuEST6sxwGCwuwn5vE2nyrJppqrNSP9kdrzA9PpXtuRt2BoivOnJztu3vdyB:CqrFvGjF5iZqrQag1t7+nJztuHi

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://ring1.ug/As73yhsyU34578hxxx/SDf565g/get.php

Attributes
  • extension

    .coot

  • offline_id

    MRQ5kb5Z12tWuP3e25YoRt4PRDrJd2yuI3coott1

  • payload_url

    http://ring1.ug/files/cost/updatewin1.exe

    http://ring1.ug/files/cost/updatewin2.exe

    http://ring1.ug/files/cost/updatewin.exe

    http://ring1.ug/files/cost/3.exe

    http://ring1.ug/files/cost/4.exe

    http://ring1.ug/files/cost/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-IbdGyCKhdr Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0175Asd374y5iuhld

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 8 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Djvu family
    djvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: AddClipboardFormatListener 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe
    "C:\Users\Admin\AppData\Local\Temp\7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1576
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\e68377fa-ed36-41be-90ad-44831a0a8640" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      • System Location Discovery: System Language Discovery
      PID:2828
    • C:\Users\Admin\AppData\Local\Temp\7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe
      "C:\Users\Admin\AppData\Local\Temp\7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      PID:4756
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1576 -s 2128
      2⤵
      • Program crash
      PID:3192
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1576 -ip 1576
    1⤵
      PID:2348
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:4092
      • C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
        "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\DenyBlock.docx" /o ""
        1⤵
        • Checks processor information in registry
        • Enumerates system info in registry
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious use of SetWindowsHookEx
        PID:3988

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        Filesize

        1KB

        MD5

        c9be626e9715952e9b70f92f912b9787

        SHA1

        aa2e946d9ad9027172d0d321917942b7562d6abe

        SHA256

        c13e8d22800c200915f87f71c31185053e4e60ca25de2e41e160e09cd2d815d4

        SHA512

        7581b7c593785380e9db3ae760af85c1a889f607a3cd2aa5a2695a0e5a0fe8ee751578e88f7d8c997faeda804e2fc2655d859bee2832eace526ed4379edaa3f5

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
        Filesize

        530B

        MD5

        1fbb37f79b317a9a248e7c4ce4f5bac5

        SHA1

        0ff4d709ebf17be0c28e66dc8bf74672ca28362a

        SHA256

        6fb1b8e593cb0388f67ead35313a230f524657317ea86271b3a97362e5ec6ad9

        SHA512

        287e1d62c9ceb660965c266f677c467fbb997c2f5dcd1d63e185e266488aafc3489ac1d3feec81d10f01ce4a72e61a8bc4e124f137ce8675a220aa7797002e74

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
        Filesize

        174B

        MD5

        305696635a19d637d435a375599fc459

        SHA1

        2484fd035b86914e75adb91b3cba287942980212

        SHA256

        de6e8d97ec03447f71ff054dbb0f2bd6ae15038476e747562fe068fa9eda91a8

        SHA512

        ac7c61b473ef505e0a267faa94c62b3cfc5e7c30a1bcd7d3d68884b74b3d176d3fe54b587cd4feb07a0231199b87a3df7b27cc89b39bf4b4ffe0a8a588f4df69

        Download Submit

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
        Filesize

        170B

        MD5

        9e676dcfe203a16302e838462e90ebf8

        SHA1

        eba65fac10623d055067b622b94f4c37e4219e48

        SHA256

        f2092727982cd9e66469d0137c17c7207b32789ab253acce0994b71e3198aaa9

        SHA512

        e09ed5dc677e7aa88083f7fa1c648f828f6458677e9df1eeeb2777fd6db2a95b601b1f729a9c3115c5a169e5d8d69cc04a944791bdf614dcb91243acfd339292

        Download Submit

      • C:\Users\Admin\AppData\Local\e68377fa-ed36-41be-90ad-44831a0a8640\7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd.exe
        Filesize

        725KB

        MD5

        e8bbb6d921b79101aea7d906a1798f3d

        SHA1

        4fd59822cdedd1b194d27d2c01a9cde6222de1bb

        SHA256

        7bc2928ce06e7db7bfe0bf3f2c2d2ff9df7f0a8041ea8c593dd0b912c1c3d3fd

        SHA512

        c525e07c65c7be43aa90568f98253b397919cd0f597b1ba446fed51a578ca1aae4c93fa59e1345b20e3216a676ba35c89c67d6ced6bea68da44a53989fa4d656

        Download Submit

      • memory/1576-16-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1576-14-0x0000000000400000-0x0000000004F0E000-memory.dmp

        Filesize

        75.1MB

        Download

      • memory/1576-1-0x0000000006C70000-0x0000000006D11000-memory.dmp

        Filesize

        644KB

        Download

      • memory/1576-15-0x0000000006D60000-0x0000000006E7A000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/1576-3-0x0000000000400000-0x0000000000537000-memory.dmp

        Filesize

        1.2MB

        Download

      • memory/1576-2-0x0000000006D60000-0x0000000006E7A000-memory.dmp

        Filesize

        1.1MB

        Download

      • memory/3988-39-0x00007FFAFF5F0000-0x00007FFAFF600000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-37-0x00007FFAFF5F0000-0x00007FFAFF600000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-40-0x00007FFAFF5F0000-0x00007FFAFF600000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-38-0x00007FFAFF5F0000-0x00007FFAFF600000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-41-0x00007FFAFF5F0000-0x00007FFAFF600000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-42-0x00007FFAFD250000-0x00007FFAFD260000-memory.dmp

        Filesize

        64KB

        Download

      • memory/3988-43-0x00007FFAFD250000-0x00007FFAFD260000-memory.dmp

        Filesize

        64KB

        Download

      • memory/4756-27-0x0000000000400000-0x0000000004F0E000-memory.dmp

        Filesize

        75.1MB

        Download

      • memory/4756-28-0x0000000000400000-0x0000000004F0E000-memory.dmp

        Filesize

        75.1MB

        Download

      • memory/4756-24-0x0000000000400000-0x0000000004F0E000-memory.dmp

        Filesize

        75.1MB

        Download