djvu | 5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073

Analysis

max time kernel
143s
max time network
135s
platform
windows10-1703_x64
resource
win10-20240404-en
resource tags

arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
submitted
15-06-2024 12:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
Size

769KB
MD5

6b3c3b621f4964f232d23c7b32a2e486
SHA1

dc7a1111a7fa4380b42dfa8e6d1b22b338aa10fc
SHA256

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073
SHA512

78b0b893295e5c8c811618638bfb9fcca2daef20b209ef4f0aeb400372b9827ff8b01325427ee41091dfb9d6b3c334510a6f2b4cccf407970cf72adb0bb2b293
SSDEEP

24576:nAVmJoIjqT53ve6LT/8EMuuV1y5SYVWuQWJb:AoJ/Q5XHz+7yA5E

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://habrafa.com/test1/get.php

Attributes

extension
.cdpo
offline_id
Bn3q97hwLouKbhkQRNO4SeV07gjdEQVm8NKhg0t1
payload_url
http://brusuax.com/dl/build2.exe
http://habrafa.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-FCWSCsjEWS Price of private key and decrypt software is $1999. Discount 50% available if you contact us first 72 hours, that's price for you is $999. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0844OSkw

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 17 IoCs

Processes:

resource	yara_rule
behavioral2/memory/2912-2-0x0000000002280000-0x000000000239B000-memory.dmp	family_djvu
behavioral2/memory/4788-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4788-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4788-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4788-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/4788-21-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-25-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-28-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-37-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-39-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-42-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-41-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral2/memory/216-44-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

4740 icacls.exe

pid	process
4740	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-160447019-1232603106-4168707212-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\c9622b60-20b2-4ba6-84a5-29101b9c0f16\\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe\" --AutoStart"	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

1 api.2ip.ua
2 api.2ip.ua
10 api.2ip.ua

flow	ioc
1	api.2ip.ua
2	api.2ip.ua
10	api.2ip.ua

Suspicious use of SetThreadContext 2 IoCs

Processes:

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

description	pid	process	target process
PID 2912 set thread context of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 set thread context of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

pid	process
4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
216	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
216	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe

C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
"C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2912

C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
"C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4788

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\c9622b60-20b2-4ba6-84a5-29101b9c0f16" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:4740

C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
"C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4244

C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
"C:\Users\Admin\AppData\Local\Temp\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
1KB

MD5
2365869258df7a66a2121b802ca4afd9

SHA1
73acc30a2edeb9d6830de559bb8a74f35168135d

SHA256
d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

SHA512
795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
174B

MD5
129092967c85c111a275f80166d4bacc

SHA1
c00115d81332158d6b434322f196979c0359a3d3

SHA256
6de209ee48e8a3efce1112964b8ef599986dd94e7034d78afb7ad2e4f310b9e4

SHA512
b58e168aa3603c8c84b31bb07b6ed30cc1b580e4f938147281216518919679540f2ca57440863b4efeda54505ffea91bba3bedf481d577b58ee6859307babc86

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize
170B

MD5
09e1b9ce7aa182ad2b1199ce5fe232c0

SHA1
852311246c9fb6c5441247a5e9773eeea11e37d7

SHA256
492835e161f415f696491a3d73a76fa20ae719648eedbb182fa446368b010bc4

SHA512
89beda8309f913a816643ebdc2e6883dddc4ed1964a9c7267aea2b7fbc22196d15fa7ae35fbb5683297bc0e6d6d321a8f8f43d304d51fff928163666b9ac3741

Download Submit
C:\Users\Admin\AppData\Local\c9622b60-20b2-4ba6-84a5-29101b9c0f16\5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
Filesize
769KB

MD5
6b3c3b621f4964f232d23c7b32a2e486

SHA1
dc7a1111a7fa4380b42dfa8e6d1b22b338aa10fc

SHA256
5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073

SHA512
78b0b893295e5c8c811618638bfb9fcca2daef20b209ef4f0aeb400372b9827ff8b01325427ee41091dfb9d6b3c334510a6f2b4cccf407970cf72adb0bb2b293

Download Submit
memory/216-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-44-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-43-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-25-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-28-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-41-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-42-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-39-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-37-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/216-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2912-1-0x00000000021E0000-0x000000000227A000-memory.dmp

Filesize
616KB

Download
memory/2912-2-0x0000000002280000-0x000000000239B000-memory.dmp

Filesize
1.1MB

Download
memory/4244-27-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4244-23-0x0000000000400000-0x00000000004C4000-memory.dmp

Filesize
784KB

Download
memory/4788-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4788-21-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download

description	pid	process	target process
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 2912 wrote to memory of 4788	2912	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4788 wrote to memory of 4740	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	icacls.exe
PID 4788 wrote to memory of 4740	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	icacls.exe
PID 4788 wrote to memory of 4740	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	icacls.exe
PID 4788 wrote to memory of 4244	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4788 wrote to memory of 4244	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4788 wrote to memory of 4244	4788	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe
PID 4244 wrote to memory of 216	4244	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe	5e19952acedb1da68215069d44ce1f3d48da10491151003148f1cceab03f1073.exe