djvu | cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240611-en
resource tags

arch:x64arch:x86image:win7-20240611-enlocale:en-usos:windows7-x64system
submitted
17-06-2024 01:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
Size

1.1MB
MD5

5230bc2f8f129c1cdcaa87821ef38b6d
SHA1

94c4e81a6d6ed0bc98ed7448cf60c3d2142ef32e
SHA256

cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e
SHA512

817b0ce33b9c4f1f944048f10226295664636ddce01190041c7660652ab054b6fb43a940c4d39ee06ac7ba0dc57b47ba9e0e757aa83dce1c07ab38afed8d1663
SSDEEP

24576:ZBUIKn/vwOXGUXAjCymYZiVtElVIBT2roqnTSSxWeT/dRPOO8WWQHUq7:F0dwAYZt6C31WeTVRPOhW7Uq7

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.watz
offline_id
Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0874PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 1 IoCs

Processes:

resource yara_rule

C:\Users\Admin\AppData\Local\ea76ff88-87e9-4b11-8f02-2b836c339866\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe family_djvu
Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

2744 icacls.exe

resource	yara_rule
C:\Users\Admin\AppData\Local\ea76ff88-87e9-4b11-8f02-2b836c339866\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	family_djvu

pid	process
2744	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2812790648-3157963462-487717889-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\ea76ff88-87e9-4b11-8f02-2b836c339866\\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe\" --AutoStart"	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

4 api.2ip.ua
9 api.2ip.ua
3 api.2ip.ua
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 2 IoCs

Processes:

cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.execbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

pid process

2988 cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
2692 cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

flow	ioc
4	api.2ip.ua
9	api.2ip.ua
3	api.2ip.ua

pid	process
2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
2692	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

Suspicious use of WriteProcessMemory 8 IoCs

Processes:

cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

description	pid	process	target process
PID 2988 wrote to memory of 2744	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	icacls.exe
PID 2988 wrote to memory of 2744	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	icacls.exe
PID 2988 wrote to memory of 2744	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	icacls.exe
PID 2988 wrote to memory of 2744	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	icacls.exe
PID 2988 wrote to memory of 2692	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
PID 2988 wrote to memory of 2692	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
PID 2988 wrote to memory of 2692	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
PID 2988 wrote to memory of 2692	2988	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe	cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe

C:\Users\Admin\AppData\Local\Temp\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
"C:\Users\Admin\AppData\Local\Temp\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe"
1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2988

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\ea76ff88-87e9-4b11-8f02-2b836c339866" /deny *S-1-1-0:(OI)(CI)(DE,DC)
2⤵
- Modifies file permissions
PID:2744

C:\Users\Admin\AppData\Local\Temp\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
"C:\Users\Admin\AppData\Local\Temp\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe" --Admin IsNotAutoStart IsNotTask
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2692

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
1KB

MD5
2365869258df7a66a2121b802ca4afd9

SHA1
73acc30a2edeb9d6830de559bb8a74f35168135d

SHA256
d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

SHA512
795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
174B

MD5
89c966efbed8189ca7af76e903ad5524

SHA1
cafc309b344269291d0a22258c9fd034c9313d26

SHA256
96affdec405427e7d910a2264f97b774f8885146e58592ab8b0a465d0af7b3fc

SHA512
6abdab5d8061f8ffc97ddcc2dbfbda58ec5b4c507b6ccb904f36a4be4f93a272847995e5e91485f90418d3db2c0db6e5cc00419d26dfcb089a1eee2d36560a5d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\94308059B57B3142E455B38A6EB92015
Filesize
342B

MD5
31bb94b43324ac33aa657997d8fe9395

SHA1
3bf4c8de2bbbd1b8eb01c7cb90f10ab2783e63b6

SHA256
0b3c5ec9374ed71373c55ee2eaf533c1629e1619b2fce4b8514438c5a5d3f35e

SHA512
fcc41cf891741ffe22aaf0e171bfd97a86a1126648c84482629a9ec496c4e59a26e12676d8d5733df263a568c189210ff3493df86902e3c24cd10f507caf6a10

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize
170B

MD5
8c4c620f315acfbfd587040be3d945c0

SHA1
dce9d32d557b4a98519457a75909422220950fd9

SHA256
cbf8a9bc42a06ff98e3e644d75aed35137c2c6535df823d20fe3d7ea60326dba

SHA512
1b9d089144f68ba68bcc8699cf0632a527b32d04b3c7a74a7bd598a05d9c8a035288c32e40b1cce6d1903e0920ef6f49164cc293d29910d171445f25aa95738b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Cab15F1.tmp
Filesize
67KB

MD5
2d3dcf90f6c99f47e7593ea250c9e749

SHA1
51be82be4a272669983313565b4940d4b1385237

SHA256
8714e7be9f9b6de26673d9d09bd4c9f41b1b27ae10b1d56a7ad83abd7430ebd4

SHA512
9c11dd7d448ffebe2167acde37be77d42175edacf5aaf6fb31d3bdfe6bb1f63f5fdbc9a0a2125ed9d5ce0529b6b548818c8021532e1ea6b324717cc9bec0aaa5

Download Submit
C:\Users\Admin\AppData\Local\ea76ff88-87e9-4b11-8f02-2b836c339866\cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e.exe
Filesize
1.1MB

MD5
5230bc2f8f129c1cdcaa87821ef38b6d

SHA1
94c4e81a6d6ed0bc98ed7448cf60c3d2142ef32e

SHA256
cbeb7eeb2ba0e370efa87676217c68f0de0067a465d4d0b422d78ddb3168ec1e

SHA512
817b0ce33b9c4f1f944048f10226295664636ddce01190041c7660652ab054b6fb43a940c4d39ee06ac7ba0dc57b47ba9e0e757aa83dce1c07ab38afed8d1663

Download Submit