djvu | c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c

Analysis

max time kernel
142s
max time network
145s
platform
windows7_x64
resource
win7-20240508-en
resource tags

arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system
submitted
03-06-2024 05:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
Size

764KB
MD5

90a43c3c9ec31a11ca3bed5e73338844
SHA1

bbe0549e43373e5f6f8c5191074bf2baafff55f6
SHA256

c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c
SHA512

53836136f7eac16f6083f0b20035dd662adc4cf11762444bf11a19b53789fbae77011fd05ea55fb4b715ee4bf46026a96c160c3946bba51d02731fc3aaf71a65
SSDEEP

12288:8lHDjsrL4TBGqwcLkLxDm1Xsn9JoewipkcjzYiZgj65kJmrCxgsa:TnXqwcgZm189JpkcjzY1jxJmuxgl

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://nokd.top/ydtftysdtyftysdfsdpen3/get.php

Attributes

extension
.mado
offline_id
8TaHEsq5r7cNJKbYdWseLEB2pW1FuZKoKjKg5tt1
payload_url
http://nokd.top/files/penelop/updatewin1.exe
http://nokd.top/files/penelop/updatewin2.exe
http://nokd.top/files/penelop/updatewin.exe
http://nokd.top/files/penelop/3.exe
http://nokd.top/files/penelop/4.exe
http://nokd.top/files/penelop/5.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-y7G4t6cSO4 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0217OIWojlj48

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 10 IoCs

Processes:

resource	yara_rule
behavioral1/memory/1920-2-0x0000000001E00000-0x0000000001F1A000-memory.dmp	family_djvu
behavioral1/memory/1920-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/1920-21-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu
behavioral1/memory/1920-22-0x0000000001E00000-0x0000000001F1A000-memory.dmp	family_djvu
behavioral1/memory/1920-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2572-28-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu
behavioral1/memory/2572-41-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu
behavioral1/memory/2572-42-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu
behavioral1/memory/2572-45-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu
behavioral1/memory/1464-67-0x0000000000400000-0x000000000056E000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Executes dropped EXE 1 IoCs

Processes:

90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

pid process

1464 90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2844 icacls.exe

pid	process
1464	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

pid	process
2844	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\08baf615-2088-4109-a6f1-d67dd11d0dca\\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe\" --AutoStart"	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.2ip.ua
9 api.2ip.ua
17 api.2ip.ua
3 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
4	api.2ip.ua
9	api.2ip.ua
17	api.2ip.ua
3	api.2ip.ua

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

pid	process
1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
2572	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
1464	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
1464	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 12 IoCs

Processes:

90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exetaskeng.exe

description	pid	process	target process
PID 1920 wrote to memory of 2844	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	icacls.exe
PID 1920 wrote to memory of 2844	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	icacls.exe
PID 1920 wrote to memory of 2844	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	icacls.exe
PID 1920 wrote to memory of 2844	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	icacls.exe
PID 1920 wrote to memory of 2572	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 1920 wrote to memory of 2572	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 1920 wrote to memory of 2572	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 1920 wrote to memory of 2572	1920	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 668 wrote to memory of 1464	668	taskeng.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 668 wrote to memory of 1464	668	taskeng.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 668 wrote to memory of 1464	668	taskeng.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
PID 668 wrote to memory of 1464	668	taskeng.exe	90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1920

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\08baf615-2088-4109-a6f1-d67dd11d0dca" /deny *S-1-1-0:(OI)(CI)(DE,DC)
2⤵
- Modifies file permissions
PID:2844

C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe" --Admin IsNotAutoStart IsNotTask
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2572

C:\Windows\system32\taskeng.exe
taskeng.exe {071EAAF7-025E-420E-BB77-BEFCA02D5A6E} S-1-5-21-268080393-3149932598-1824759070-1000:UHRQKJCP\Admin:Interactive:[1]
1⤵
- Suspicious use of WriteProcessMemory
PID:668

C:\Users\Admin\AppData\Local\08baf615-2088-4109-a6f1-d67dd11d0dca\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
C:\Users\Admin\AppData\Local\08baf615-2088-4109-a6f1-d67dd11d0dca\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe --Task
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:1464

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
1KB

MD5
0fe896c1fe25eb524a8b49a572503f14

SHA1
244f5ac2e4e56bd4a924814ce4ac3ae4f900f94c

SHA256
057d3ab57e61cf3b84e64d0ed324b5ab2a29b4ad2e81a107a17bb24222474e1f

SHA512
718286f53e834eaf6ba5f844980aa1695f8477262d49dee7279241c466dc118328f1e5979ffc09e76fb52a81a0d5cf1f8a96020f6ecf861c057ef0d487f366f0

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
724B

MD5
8202a1cd02e7d69597995cabbe881a12

SHA1
8858d9d934b7aa9330ee73de6c476acf19929ff6

SHA256
58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

SHA512
97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
Filesize
410B

MD5
223a3da23fe02c153b2058197fa4ba13

SHA1
141ba79dcd257a10228d96e77050a2c4298529e6

SHA256
f4379499f3fe8385468f8cbda792535d0a06755def5dfdcfdc9ff294f9fb24ca

SHA512
a3c9d745ba8cc61ad7bab1a7a95469a71f9b6bdd13045e5708eef693ffdb6ca310d5b1daa952ef0b1159d9d05255e0855ad13233d6970777a5f3b522c0e7dedb

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
344B

MD5
6a9f2a8d602f36bd25eb3eab7d2f0aac

SHA1
fec491741b158889c65b7fa407122b42cdcf7d8f

SHA256
18e63877e96b17fbdb9ec57cd9176f6cc88303f7864d557bb76c4fc9e8369258

SHA512
b4e7a7f9448046d13047d1fa31b943bdbd3ee1900d99aba69260e95c56e87db23155edfb15ffab7e8c3ff5858f3505060f7969f298b50745b9f567f70f5e92fc

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
Filesize
392B

MD5
9f689560dd2daee08d881e622410b9e2

SHA1
fa0e17e9be0055c495db2024cc9bd9b1b96b34a9

SHA256
c418d57f329df862c2267dd09124810761db2d9289123240ee3ed7a3a2b32202

SHA512
1a1d8e15cb28a04750cdcf1a01047875307835299cb9c511cd8608dac7c99b0a6aec9e017d3cdb3c4b3bdd139de1c559329b151078d134252470157f0c8bc280

Download Submit
C:\Users\Admin\AppData\Local\08baf615-2088-4109-a6f1-d67dd11d0dca\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
Filesize
764KB

MD5
90a43c3c9ec31a11ca3bed5e73338844

SHA1
bbe0549e43373e5f6f8c5191074bf2baafff55f6

SHA256
c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c

SHA512
53836136f7eac16f6083f0b20035dd662adc4cf11762444bf11a19b53789fbae77011fd05ea55fb4b715ee4bf46026a96c160c3946bba51d02731fc3aaf71a65

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab1EC7.tmp
Filesize
68KB

MD5
29f65ba8e88c063813cc50a4ea544e93

SHA1
05a7040d5c127e68c25d81cc51271ffb8bef3568

SHA256
1ed81fa8dfb6999a9fedc6e779138ffd99568992e22d300acd181a6d2c8de184

SHA512
e29b2e92c496245bed3372578074407e8ef8882906ce10c35b3c8deebfefe01b5fd7f3030acaa693e175f4b7aca6cd7d8d10ae1c731b09c5fa19035e005de3aa

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar3D5F.tmp
Filesize
177KB

MD5
435a9ac180383f9fa094131b173a2f7b

SHA1
76944ea657a9db94f9a4bef38f88c46ed4166983

SHA256
67dc37ed50b8e63272b49a254a6039ee225974f1d767bb83eb1fd80e759a7c34

SHA512
1a6b277611959720a9c71114957620517ad94541302f164eb872bd322292a952409bafb8bc2ac793b16ad5f25d83f8594ccff2b7834e3c2b2b941e6fc84c009a

Download Submit
memory/1464-67-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/1464-59-0x00000000002B0000-0x0000000000341000-memory.dmp

Filesize
580KB

Download
memory/1920-22-0x0000000001E00000-0x0000000001F1A000-memory.dmp

Filesize
1.1MB

Download
memory/1920-21-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/1920-1-0x0000000001CC0000-0x0000000001D51000-memory.dmp

Filesize
580KB

Download
memory/1920-2-0x0000000001E00000-0x0000000001F1A000-memory.dmp

Filesize
1.1MB

Download
memory/1920-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1920-23-0x0000000001CC0000-0x0000000001D51000-memory.dmp

Filesize
580KB

Download
memory/1920-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/1920-0-0x0000000001CC0000-0x0000000001D51000-memory.dmp

Filesize
580KB

Download
memory/2572-25-0x0000000000310000-0x00000000003A1000-memory.dmp

Filesize
580KB

Download
memory/2572-41-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2572-42-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2572-45-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2572-26-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2572-27-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download
memory/2572-28-0x0000000000400000-0x000000000056E000-memory.dmp

Filesize
1.4MB

Download