djvu | b005b4efdf934a10fe8c0db13792ebd4f98eac1a92cea6ff45515f8b07684aec

Analysis

max time kernel
205s
max time network
178s
platform
windows11-21h2_x64
resource
win11-20240611-en
resource tags

arch:x64arch:x86image:win11-20240611-enlocale:en-usos:windows11-21h2-x64system
submitted
21-06-2024 14:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

buildz.exe
Size

820KB
MD5

2ec07fb2b4b8511cc61beab303b67f2e
SHA1

d6709a93d5d92e978c49fba1744b4707937c2cb8
SHA256

b005b4efdf934a10fe8c0db13792ebd4f98eac1a92cea6ff45515f8b07684aec
SHA512

55d6ed9faf60c787561d29088288fca23cc23a18758940f351ee750f036f81e7041101f5a78f362a085e89898f8f312f9df558eeca406abb152db57defcd384e
SSDEEP

24576:2hpkfViWtBiEDDtrsd23ejJX5fMzhSOparLO:2EVbiEDYKejfoh1par

Score

10^/10

djvu discovery persistence ransomware

Malware Config

Extracted

Family

djvu

http://cajgtus.com/test1/get.php

Attributes

extension
.watz
offline_id
Lc3VTezPWbMhuVAQFzJUdeA68PwI7UDpc5aKHYt1
payload_url
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. Do not ask assistants from youtube and recovery data sites for help in recovering your data. They can use your free decryption quota and scam you. Our contact is emails in this text document only. You can get and look video overview decrypt tool: https://wetransfer.com/downloads/abe121434ad837dd5bdd03878a14485820240531135509/34284d Price of private key and decrypt software is $999. Discount 50% available if you contact us first 72 hours, that's price for you is $499. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0874PsawqS

rsa_pubkey.plain

Signatures

Detected Djvu ransomware 18 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4496-2-0x0000000002310000-0x000000000242B000-memory.dmp	family_djvu
behavioral1/memory/4972-3-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-5-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-4-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-6-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/4972-19-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-23-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-24-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-26-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-34-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-35-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-33-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-36-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-38-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-41-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-40-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-42-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu
behavioral1/memory/2836-43-0x0000000000400000-0x0000000000537000-memory.dmp	family_djvu

Djvu Ransomware
Ransomware which is a variant of the STOP family.
ransomware djvu
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

1620 icacls.exe

pid	process
1620	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

buildz.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-952492217-3293592999-1071733403-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\65b7237f-72a5-4c6d-8b48-6f97854ac462\\buildz.exe\" --AutoStart"	buildz.exe

Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

3 api.2ip.ua
7 api.2ip.ua
10 api.2ip.ua
Suspicious use of SetThreadContext 2 IoCs

Processes:

buildz.exebuildz.exe

description pid process target process

PID 4496 set thread context of 4972 4496 buildz.exe buildz.exe
PID 3400 set thread context of 2836 3400 buildz.exe buildz.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

buildz.exebuildz.exe

pid process

4972 buildz.exe
4972 buildz.exe
2836 buildz.exe
2836 buildz.exe

flow	ioc
3	api.2ip.ua
7	api.2ip.ua
10	api.2ip.ua

description	pid	process	target process
PID 4496 set thread context of 4972	4496	buildz.exe	buildz.exe
PID 3400 set thread context of 2836	3400	buildz.exe	buildz.exe

pid	process
4972	buildz.exe
4972	buildz.exe
2836	buildz.exe
2836	buildz.exe

Suspicious use of WriteProcessMemory 26 IoCs

Processes:

buildz.exebuildz.exebuildz.exe

description	pid	process	target process
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4496 wrote to memory of 4972	4496	buildz.exe	buildz.exe
PID 4972 wrote to memory of 1620	4972	buildz.exe	icacls.exe
PID 4972 wrote to memory of 1620	4972	buildz.exe	icacls.exe
PID 4972 wrote to memory of 1620	4972	buildz.exe	icacls.exe
PID 4972 wrote to memory of 3400	4972	buildz.exe	buildz.exe
PID 4972 wrote to memory of 3400	4972	buildz.exe	buildz.exe
PID 4972 wrote to memory of 3400	4972	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe
PID 3400 wrote to memory of 2836	3400	buildz.exe	buildz.exe

C:\Users\Admin\AppData\Local\Temp\buildz.exe
"C:\Users\Admin\AppData\Local\Temp\buildz.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4496

C:\Users\Admin\AppData\Local\Temp\buildz.exe
"C:\Users\Admin\AppData\Local\Temp\buildz.exe"
2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4972

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Users\Admin\AppData\Local\65b7237f-72a5-4c6d-8b48-6f97854ac462" /deny *S-1-1-0:(OI)(CI)(DE,DC)
3⤵
- Modifies file permissions
PID:1620

C:\Users\Admin\AppData\Local\Temp\buildz.exe
"C:\Users\Admin\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3400

C:\Users\Admin\AppData\Local\Temp\buildz.exe
"C:\Users\Admin\AppData\Local\Temp\buildz.exe" --Admin IsNotAutoStart IsNotTask
4⤵
- Suspicious behavior: EnumeratesProcesses
PID:2836

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
1KB

MD5
2365869258df7a66a2121b802ca4afd9

SHA1
73acc30a2edeb9d6830de559bb8a74f35168135d

SHA256
d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

SHA512
795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Filesize
436B

MD5
1bfe0a81db078ea084ff82fe545176fe

SHA1
50b116f578bd272922fa8eae94f7b02fd3b88384

SHA256
5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

SHA512
37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Filesize
174B

MD5
d5f815687aa8a317edb167c0ac0d91ad

SHA1
9d73e8f332b72d7b407daa6ded3c996972ca9a19

SHA256
328a2854c7617f524c26481e7bf476fab7a4d08871a27612307d0435a110c2af

SHA512
751158ebc04726aed0f45a338316e6fb27dfc217c154e105613075907f47aafcb52f75f4323b398ac1f7a3091c8a7c9da4501a8002c9b25c8bc334117d7805c8

Download Submit
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Filesize
170B

MD5
97b4bc57d780a66708f9ab716d583393

SHA1
4d26947bff4da65b39283a1a56b640cf8a0e2989

SHA256
51dc5535730600a9666fdf11b052633928a6cce5b55e04a0ab6419db40b91e16

SHA512
bf030f0bda0af0e2b98b65ab56145f601242ee9b509606237047f4b2ddd32045201214cd0b3531e02d0d01cf59ed8feb3c421fd16e17fa29dd3a5efb81978d48

Download Submit
C:\Users\Admin\AppData\Local\65b7237f-72a5-4c6d-8b48-6f97854ac462\buildz.exe
Filesize
820KB

MD5
2ec07fb2b4b8511cc61beab303b67f2e

SHA1
d6709a93d5d92e978c49fba1744b4707937c2cb8

SHA256
b005b4efdf934a10fe8c0db13792ebd4f98eac1a92cea6ff45515f8b07684aec

SHA512
55d6ed9faf60c787561d29088288fca23cc23a18758940f351ee750f036f81e7041101f5a78f362a085e89898f8f312f9df558eeca406abb152db57defcd384e

Download Submit
memory/2836-26-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-34-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-43-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-42-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-23-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-24-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-40-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-41-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-38-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-36-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-33-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/2836-35-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/3400-25-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/3400-21-0x0000000000400000-0x00000000004DD000-memory.dmp

Filesize
884KB

Download
memory/4496-2-0x0000000002310000-0x000000000242B000-memory.dmp

Filesize
1.1MB

Download
memory/4496-1-0x0000000000810000-0x00000000008AD000-memory.dmp

Filesize
628KB

Download
memory/4972-3-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4972-5-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4972-4-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4972-6-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download
memory/4972-19-0x0000000000400000-0x0000000000537000-memory.dmp

Filesize
1.2MB

Download