Overview

overview

10

Static

static

10

2024-06-02...op.exe

windows7-x64

10

2024-06-02...op.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    149s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02-06-2024 12:53

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe

  • Size

    1.1MB

  • MD5

    7826cab9402ff5b54ba7585173f7615e

  • SHA1

    b617afca56a794c30dea44104affb03e4e64efdc

  • SHA256

    b9b327cf544d1c0e014f828cbf994fd9369555159f9b0b1a3095040cbcc74b9e

  • SHA512

    ef0367012549da5a12d03835c906d75103421c7399c5916cfd6bb9722bf635f4773cee206bcdd4ea77c74e069b7ebceb2d0443c494ee69fb4eaaa8cecbbc4a53

  • SSDEEP

    24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO86WQHUq7:F0dwAYZt6C31WeTVRPOh67Uq7

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cajgtus.com/test2/get.php

Attributes
  • extension

    .vehu

  • offline_id

    EGfa5svnSGFJka7LZBQoqff0QtO1IpTauoDvGvt1

  • payload_url

    http://sdfjhuz.com/dl/build2.exe

    http://cajgtus.com/files/1/build3.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0872PsawqS

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3708
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\837ee473-7bda-4445-9df7-86a1c8bf8075" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:4576
    • C:\Users\Admin\AppData\Local\Temp\2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4256
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2276,i,5697607538120380977,9987005253899555344,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2964

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      1KB

      MD5

      8999aa854e3cae2cc82a314dc12420a3

      SHA1

      e9d06ba69f37453368b35b0f601e3c391fc36e86

      SHA256

      d9ce037a484b0cd8841a9f2ff72f44e4c1106b4edd257f76eaf4203e345cf196

      SHA512

      b840dfcdc27db311280d0731f9b4fc36e0a1a7e16090d6e4936bb1d011994b9a585b2393af9aea80ace8468430309cd26acc5220d39a4173574c4d5198f644be

      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      724B

      MD5

      8202a1cd02e7d69597995cabbe881a12

      SHA1

      8858d9d934b7aa9330ee73de6c476acf19929ff6

      SHA256

      58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

      SHA512

      97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
      Filesize

      410B

      MD5

      97cbc37ac339f1dfaac794e3de5e655d

      SHA1

      241eed05287e1d15471b15350c53908eb73a7baf

      SHA256

      eda6dbeea1e009fb1bace2e14cf0c7fe603090679adcf102205ebe7258d8385e

      SHA512

      306dc8267f386a47e53231de8874dc35191a4ef8019c5b5498f1c4d91eb380c9e3e1dc088802f539245c65a386762d4eece4ecf988a4b1e98278421c1f022b38

      Download Submit
    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
      Filesize

      392B

      MD5

      ca604ac0b21552d2bae9a95bb9be1cec

      SHA1

      06b113fd8e8bf4f0ba90e2adddf3c7302d85ee00

      SHA256

      268955996c2bcb9951d41df3ea080076a49382666e421e3331295e572bfb38c8

      SHA512

      5c997bed71161c6461517ef13f6837985bff31cf0769f352620993b6d8daa0c5758feb9f70308793e78a518e8228aa6ae9fc3653614f83e3ee6f9bd3d25df49e

      Download Submit
    • C:\Users\Admin\AppData\Local\837ee473-7bda-4445-9df7-86a1c8bf8075\2024-06-02_7826cab9402ff5b54ba7585173f7615e_stop.exe
      Filesize

      1.1MB

      MD5

      7826cab9402ff5b54ba7585173f7615e

      SHA1

      b617afca56a794c30dea44104affb03e4e64efdc

      SHA256

      b9b327cf544d1c0e014f828cbf994fd9369555159f9b0b1a3095040cbcc74b9e

      SHA512

      ef0367012549da5a12d03835c906d75103421c7399c5916cfd6bb9722bf635f4773cee206bcdd4ea77c74e069b7ebceb2d0443c494ee69fb4eaaa8cecbbc4a53

      Download Submit