Overview

overview

10

Static

static

3

90a43c3c9e...18.exe

windows7-x64

10

90a43c3c9e...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    144s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03-06-2024 05:12

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe

  • Size

    764KB

  • MD5

    90a43c3c9ec31a11ca3bed5e73338844

  • SHA1

    bbe0549e43373e5f6f8c5191074bf2baafff55f6

  • SHA256

    c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c

  • SHA512

    53836136f7eac16f6083f0b20035dd662adc4cf11762444bf11a19b53789fbae77011fd05ea55fb4b715ee4bf46026a96c160c3946bba51d02731fc3aaf71a65

  • SSDEEP

    12288:8lHDjsrL4TBGqwcLkLxDm1Xsn9JoewipkcjzYiZgj65kJmrCxgsa:TnXqwcgZm189JpkcjzY1jxJmuxgl

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://nokd.top/ydtftysdtyftysdfsdpen3/get.php

Attributes
  • extension

    .mado

  • offline_id

    8TaHEsq5r7cNJKbYdWseLEB2pW1FuZKoKjKg5tt1

  • payload_url

    http://nokd.top/files/penelop/updatewin1.exe

    http://nokd.top/files/penelop/updatewin2.exe

    http://nokd.top/files/penelop/updatewin.exe

    http://nokd.top/files/penelop/3.exe

    http://nokd.top/files/penelop/4.exe

    http://nokd.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-y7G4t6cSO4 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0217OIWojlj48

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 13 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:540
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\624b3f0c-f477-42ec-bc54-4485e03d5ed4" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:4224
    • C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4092
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 540 -s 2140
      2⤵
      • Program crash
      PID:3892
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 540 -ip 540
    1⤵
      PID:412
    • C:\Users\Admin\AppData\Local\624b3f0c-f477-42ec-bc54-4485e03d5ed4\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\624b3f0c-f477-42ec-bc54-4485e03d5ed4\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe --Task
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:1456
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1456 -s 1640
        2⤵
        • Program crash
        PID:3892
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1456 -ip 1456
      1⤵
        PID:1208

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      File and Directory Permissions Modification

      1
      T1222

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        Filesize

        1KB

        MD5

        0fe896c1fe25eb524a8b49a572503f14

        SHA1

        244f5ac2e4e56bd4a924814ce4ac3ae4f900f94c

        SHA256

        057d3ab57e61cf3b84e64d0ed324b5ab2a29b4ad2e81a107a17bb24222474e1f

        SHA512

        718286f53e834eaf6ba5f844980aa1695f8477262d49dee7279241c466dc118328f1e5979ffc09e76fb52a81a0d5cf1f8a96020f6ecf861c057ef0d487f366f0

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        Filesize

        724B

        MD5

        8202a1cd02e7d69597995cabbe881a12

        SHA1

        8858d9d934b7aa9330ee73de6c476acf19929ff6

        SHA256

        58f381c3a0a0ace6321da22e40bd44a597bd98b9c9390ab9258426b5cf75a7a5

        SHA512

        97ba9fceab995d4bef706f8deef99e06862999734ebe6a05832c710104479c6337cbf0a76e1c1e0f91566a61334dc100d837dfd049e20da765fe49def684f9c9

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA
        Filesize

        410B

        MD5

        4b80141b7043aca01f8bdc15a16c354e

        SHA1

        6db0ff07ff909df4c22eea45261aeaa5c91f0011

        SHA256

        2f232acf81e7aee87683800ab1915831664e4df00c425290c20e0c4a559c4e1e

        SHA512

        091fddc1b6a2ef9711d2638015610958c79e1825685ba6b6809c6ad25e60257a0781994998637543eb2d32e9393e404f0ed76f0776b392abdfc7609bd1d4b2dd

        Download Submit
      • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_F2DAF19C1F776537105D08FC8D978464
        Filesize

        392B

        MD5

        55fbff01308b1b708e09e06ee49b1185

        SHA1

        e990241cf26f49414488409652009659fac71bea

        SHA256

        ae0a77b24a5188f4966e02ce6176cf73caed716a44300cb407f846bcbfbb16bf

        SHA512

        d77d9796c364bed44031cb36ffc4cbe6f7a51a9c41860240880b68481d4f829f5951ce1ff791cc51443f4dee8cb69794abf978665e4baf54a6fc001bc377b361

        Download Submit
      • C:\Users\Admin\AppData\Local\624b3f0c-f477-42ec-bc54-4485e03d5ed4\90a43c3c9ec31a11ca3bed5e73338844_JaffaCakes118.exe
        Filesize

        764KB

        MD5

        90a43c3c9ec31a11ca3bed5e73338844

        SHA1

        bbe0549e43373e5f6f8c5191074bf2baafff55f6

        SHA256

        c68ff2b64fe8310e584f0680e62c1283df48af9d09be486feaa820b57090e79c

        SHA512

        53836136f7eac16f6083f0b20035dd662adc4cf11762444bf11a19b53789fbae77011fd05ea55fb4b715ee4bf46026a96c160c3946bba51d02731fc3aaf71a65

        Download Submit
      • memory/540-14-0x0000000000400000-0x0000000000537000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/540-13-0x0000000002290000-0x00000000023AA000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/540-1-0x00000000021F0000-0x0000000002283000-memory.dmp
        Filesize

        588KB

        Download
      • memory/540-12-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/540-3-0x0000000000400000-0x0000000000537000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/540-2-0x0000000002290000-0x00000000023AA000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/1456-41-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1456-43-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/1456-42-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-18-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-26-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-27-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-23-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-17-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download
      • memory/4092-16-0x0000000000400000-0x000000000056E000-memory.dmp
        Filesize

        1.4MB

        Download