djvu | 6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 00:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
Size

1.1MB
MD5

10ae98958bf7c0ab1ea79c665b3c9178
SHA1

ecbbf43f2e6f66ca27f4a1279c9b482e2d0c261c
SHA256

6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d
SHA512

c3e0c8541a23a42fd3f63a609e5e253a0d72b5f1f775e838bfa3d3c941abfdc7ae1a22f90a7f63ec67e86fd12f80da9c08ae8b810abee0809c31dd24b6a7079b
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8SWQHUq7:F0dwAYZt6C31WeTVRPOhS7Uq7

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.vepi
offline_id
EGfa5svnSGFJka7LZBQoqff0QtO1IpTauoDvGvt1
payload_url
http://sdfjhuz.com/dl/build2.exe
http://cajgtus.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/33b490a613f49fa190924f199d2c079e20240512191214/caaf73 Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0871PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 1 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\70627f23-6d02-4c10-8507-2894a59d6681\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe family_djvu
Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2664 icacls.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\70627f23-6d02-4c10-8507-2894a59d6681\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	family_djvu

pid	process
2664	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\70627f23-6d02-4c10-8507-2894a59d6681\\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe\" --AutoStart"	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

8 api.2ip.ua
3 api.2ip.ua
4 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

pid process

2428 6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
2728 6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

flow	ioc
8	api.2ip.ua
3	api.2ip.ua
4	api.2ip.ua

pid	process
2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
2728	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

description	pid	process	target process
PID 2428 wrote to memory of 2664	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	icacls.exe
PID 2428 wrote to memory of 2664	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	icacls.exe
PID 2428 wrote to memory of 2664	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	icacls.exe
PID 2428 wrote to memory of 2664	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	icacls.exe
PID 2428 wrote to memory of 2728	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
PID 2428 wrote to memory of 2728	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
PID 2428 wrote to memory of 2728	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
PID 2428 wrote to memory of 2728	2428	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe	6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe

C:\Users\Admin\AppData\Local\Temp\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
"C:\Users\Admin\AppData\Local\Temp\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2428

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\70627f23-6d02-4c10-8507-2894a59d6681" /deny *S-1-1-0:(OI)(CI)(DE,DC)
2⤵
- Modifies file permissions
PID:2664

C:\Users\Admin\AppData\Local\Temp\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
"C:\Users\Admin\AppData\Local\Temp\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe" --Admin IsNotAutoStart IsNotTask
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2728

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
a2302c3b16124e8211ed629a5e35728b

SHA1
bccf44bfea669fc7ad1d97a7cb32ac8152917f61

SHA256
f108902accacd3de7d1e3ab0e9dff6997ab3c2e6aa0b3c63faf4ecb5fcf36b37

SHA512
1b551561dcb85b9b7e40cd0ea7537c602efc6bd3cd4eb3b86bee44177869c0bb11565aac5ee33cdb5dae90bf6fa32cee8b2edcfec878a76fe7734ef9930df9fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
0012f66ab5b220e5e24db7c51692f050

SHA1
cf846dee231ea8b1a97e21b3981b26f95d8bc8ee

SHA256
7430459e926950acd441ff77327486f970ed9a7564352a390a1a784aa844441e

SHA512
774d70275bf212598dba65c222979bb66bb2739696c363af583e795fe8a9a662a7adb102e72fa83b7775efe2aa39d23d09a05f62647f16bd4208c5ead5e73368

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6360c6cdd94d3278a4851965327ecda9

SHA1
356f7edb4f3dac33001a7f3ecd0263b29136bc8a

SHA256
9e5bd6625950c769ea5d2dcd9c0c473d7b24f04e3a95b51da92db8493325da26

SHA512
4a4d4bba3a553e96642f66c33ab659c10f245a4e03c807ba06e2114b4177cee28c9e9be7f161dd40f434927d52d1e7d2ae0c265f990e1af41341076725974fd2

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
3815a3d3eeadfb46c977b0d8a8b921ab

SHA1
85582b39a70227bb3605827dbe66463125e4560d

SHA256
50032a599102914112e0783bb320dcb20ebee5d7c32f4bbf9c89ed113a0909bf

SHA512
8ba35b5f62cc426d014618ce5a9fe8b92e5f6a51b8340f8d8688d97480156824ff8dd5329eaf8bf9f8ccd8892baec9cae46002c6837b5bf3fb178ca09945b0ed

Download Submit
C:\Users\Admin\AppData\Local\70627f23-6d02-4c10-8507-2894a59d6681\6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d.exe
Filesize
1.1MB

MD5
10ae98958bf7c0ab1ea79c665b3c9178

SHA1
ecbbf43f2e6f66ca27f4a1279c9b482e2d0c261c

SHA256
6d856705550fc2c2a38b80939b15631ca97c2037faeb03cab173e70e5b672e9d

SHA512
c3e0c8541a23a42fd3f63a609e5e253a0d72b5f1f775e838bfa3d3c941abfdc7ae1a22f90a7f63ec67e86fd12f80da9c08ae8b810abee0809c31dd24b6a7079b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab2118.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit