Overview

overview

10

Static

static

10

2024-06-02...op.exe

windows7-x64

10

2024-06-02...op.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    129s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 23:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe

  • Size

    1.1MB

  • MD5

    10ae98958bf7c0ab1ea79c665b3c9178

  • SHA1

    ecbbf43f2e6f66ca27f4a1279c9b482e2d0c261c

  • SHA256

    6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d

  • SHA512

    c3e0c8541a23a42fd3f63a609e5e253a0d72b5f1f775e838bfa3d3c941abfdc7ae1a22f90a7f63ec67e86fd12f80da9c08ae8b810abee0809c31dd24b6a7079b

  • SSDEEP

    24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8SWQHUq7:F0dwAYZt6C31WeTVRPOhS7Uq7

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test1/get.php

Attributes
  • extension

    .vepi

  • offline_id

    EGfa5svnSGFJka7LZBQoqff0QtO1IpTauoDvGvt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://cajgtus.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0871PsawqS

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3848
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\1cf9ff5e-2143-4eb6-89dd-ccf6f638e503" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:1172
    • C:\Users\Admin\AppData\Local\Temp\2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:984

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

File and Directory Permissions Modification

1
T1222

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    1KB

    MD5

    a2302c3b16124e8211ed629a5e35728b

    SHA1

    bccf44bfea669fc7ad1d97a7cb32ac8152917f61

    SHA256

    f108902accacd3de7d1e3ab0e9dff6997ab3c2e6aa0b3c63faf4ecb5fcf36b37

    SHA512

    1b551561dcb85b9b7e40cd0ea7537c602efc6bd3cd4eb3b86bee44177869c0bb11565aac5ee33cdb5dae90bf6fa32cee8b2edcfec878a76fe7734ef9930df9fc

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
    Filesize

    724B

    MD5

    8202a1cd02e7d69597995cabbe881a12

    SHA1

    8858d9d934b7aa9330ee73de6c476acf19929ff6

    SHA256

    58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

    SHA512

    97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
    Filesize

    410B

    MD5

    bfef4365bb705d1407feaf43f9f439b1

    SHA1

    9ecfe26ed8fad9a165e1dbb0a60d1fd9ebbb447f

    SHA256

    88435e8fc6386b4228dfc39d11739259adcabc35b8638e20972ee57b36628bcc

    SHA512

    1351e37c64121f2e943f03287c235ba3589c7269aaed758134450e3451a9740fc62311db2166f7ad6af72b8f8cd2616ae34dd2bd5b6c8e134c88d2623cdf40b8

    Download Submit
  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
    Filesize

    392B

    MD5

    d2704a8930617c91de11c5f2be053e97

    SHA1

    8a42ad22b395b7e619fe5326402fe658b2d21e88

    SHA256

    f7532795e663cf1afd1185e3b238892ddddf2d032e196ac7e0fd76130692176e

    SHA512

    003bdcadd62d2be875398ec7912863fd17ba696c4ee83ac21e4cc2a1a4f26c5edc44e557f1fa9261eccea47d1c092c6d6c01eafb24f078ad86f3dcc8d184387c

    Download Submit
  • C:\Users\Admin\AppData\Local\1cf9ff5e-2143-4eb6-89dd-ccf6f638e503\2024-06-02_10ae98958bf7c0ab1ea79c665b3c9178_stop.exe
    Filesize

    1.1MB

    MD5

    10ae98958bf7c0ab1ea79c665b3c9178

    SHA1

    ecbbf43f2e6f66ca27f4a1279c9b482e2d0c261c

    SHA256

    6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d

    SHA512

    c3e0c8541a23a42fd3f63a609e5e253a0d72b5f1f775e838bfa3d3c941abfdc7ae1a22f90a7f63ec67e86fd12f80da9c08ae8b810abee0809c31dd24b6a7079b

    Download Submit