Overview

overview

10

Static

static

3

bb7b70fcd0...18.exe

windows7-x64

10

bb7b70fcd0...18.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    18-06-2024 10:36

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe

  • Size

    713KB

  • MD5

    bb7b70fcd01eb0903c7ecf2a8a50cbea

  • SHA1

    22694b981fe9c6c9bedd6045299b55e564ebf8e8

  • SHA256

    dacddfaece889da8a311107c5923313c6682acce5c718b5ae49550a1e15b24d0

  • SHA512

    64ac24534d043b01dafad22f79af7649443c5dcd809fadeeac7faa08c04b1e73f33230e9f8d2824dfd90bedb30222c61f8490b7ee307ac753b146978a799c54e

  • SSDEEP

    12288:8d8z9JklKqDlVGzfLPQU4dFC19BqR0o8lPFaV0pJVAyp5tAiRmKz:8Wpgc7yFC19Bs+tpJV5RmK

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cjto.top/nddddhsspen6/get.php

Attributes
  • extension

    .kolz

  • offline_id

    hZcC4PEfaqDNIXxy0ProMPOAk3JS3K1JoUqoq0t1

  • payload_url

    http://cjto.top/files/penelop/updatewin1.exe

    http://cjto.top/files/penelop/updatewin2.exe

    http://cjto.top/files/penelop/updatewin.exe

    http://cjto.top/files/penelop/3.exe

    http://cjto.top/files/penelop/4.exe

    http://cjto.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-18R6r7GGG8 Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0252Ijrfg

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 12 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe
    "C:\Users\Admin\AppData\Local\Temp\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\28cbb7f2-77af-46af-a1cd-559fba4a46f1" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:3936
    • C:\Users\Admin\AppData\Local\Temp\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe
      "C:\Users\Admin\AppData\Local\Temp\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4692
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1240 -s 1584
      2⤵
      • Program crash
      PID:4904
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 1240 -ip 1240
    1⤵
      PID:2588
    • C:\Users\Admin\AppData\Local\28cbb7f2-77af-46af-a1cd-559fba4a46f1\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe
      C:\Users\Admin\AppData\Local\28cbb7f2-77af-46af-a1cd-559fba4a46f1\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe --Task
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4080
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4080 -s 1092
        2⤵
        • Program crash
        PID:2896
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4080 -ip 4080
      1⤵
        PID:3480

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Initial Access

      Execution

      Persistence

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Privilege Escalation

      Boot or Logon Autostart Execution

      1
      T1547

      Registry Run Keys / Startup Folder

      1
      T1547.001

      Defense Evasion

      File and Directory Permissions Modification

      1
      T1222

      Modify Registry

      1
      T1112

      Credential Access

      Discovery

      Query Registry

      1
      T1012

      System Information Discovery

      2
      T1082

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Resource Development

      Reconnaissance

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\28cbb7f2-77af-46af-a1cd-559fba4a46f1\bb7b70fcd01eb0903c7ecf2a8a50cbea_JaffaCakes118.exe
        Filesize

        713KB

        MD5

        bb7b70fcd01eb0903c7ecf2a8a50cbea

        SHA1

        22694b981fe9c6c9bedd6045299b55e564ebf8e8

        SHA256

        dacddfaece889da8a311107c5923313c6682acce5c718b5ae49550a1e15b24d0

        SHA512

        64ac24534d043b01dafad22f79af7649443c5dcd809fadeeac7faa08c04b1e73f33230e9f8d2824dfd90bedb30222c61f8490b7ee307ac753b146978a799c54e

        Download Submit
      • memory/1240-9-0x0000000000400000-0x0000000000537000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/1240-3-0x0000000000400000-0x0000000000537000-memory.dmp
        Filesize

        1.2MB

        Download
      • memory/1240-4-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/1240-2-0x0000000002C10000-0x0000000002D2A000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/1240-8-0x0000000002C10000-0x0000000002D2A000-memory.dmp
        Filesize

        1.1MB

        Download
      • memory/1240-1-0x0000000002940000-0x00000000029D7000-memory.dmp
        Filesize

        604KB

        Download
      • memory/1240-7-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4080-28-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4080-29-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4692-11-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4692-13-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4692-18-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download
      • memory/4692-19-0x0000000000400000-0x0000000002830000-memory.dmp
        Filesize

        36.2MB

        Download