Overview

overview

10

Static

static

3

78E.tmp.exe

windows7-x64

10

78E.tmp.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    592s
  • max time network
    451s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-06-2024 19:47

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    78E.tmp.exe

  • Size

    466KB

  • MD5

    246d6fa957bd9bd9bd444ba8a6c38457

  • SHA1

    fb90a2e9e3f3d4bf350a5c8d475c843f072bc1f5

  • SHA256

    9c17cc38feddc8aec42f4d7e84ff85260e0e5d955c38e42573a21c18836c7a59

  • SHA512

    95e3135f417fdfd91c8e57545c246c5a0f5efc40fe1e3ef745b8283c35b156d7814934be5983dd5532b7fb789a4032a3e1d619281d0e4e1b465b86f2a036e3bb

  • SSDEEP

    6144:agBl9KO2wSlnYlm8px3b3RY+F2q9QgW6jw5oJ48ph1nt2EuqAs00:aEKOZSlnbE3b3RiqW6jw5o6831/A

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://root.ug/Asjdhfiughdhhjbdfh45687husdfhipenelop8/Asdhuage7386/get.php

Attributes
  • extension

    .sarut

  • offline_id

    pQseAIqgTVhPujMMiqH1ILPNUg3soGVim0NAnkt1

  • payload_url

    http://pool.ug/tesptc/penelop/updatewin1.exe

    http://pool.ug/tesptc/penelop/updatewin2.exe

    http://pool.ug/tesptc/penelop/updatewin.exe

    http://pool.ug/tesptc/penelop/3.exe

    http://pool.ug/tesptc/penelop/4.exe

    http://pool.ug/tesptc/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry my friend, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-1aTCryfzhK Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Our Telegram account: @datarestore Your personal ID: 078AKsudu438fyasfs

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 15 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Renames multiple (168) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 6 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 8 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\78E.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\78E.tmp.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1500
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:3892
    • C:\Users\Admin\AppData\Local\Temp\78E.tmp.exe
      "C:\Users\Admin\AppData\Local\Temp\78E.tmp.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:5044
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 5044 -s 1604
        3⤵
        • Program crash
        PID:1676
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1500 -s 2128
      2⤵
      • Program crash
      PID:1128
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 1500 -ip 1500
    1⤵
      PID:2248
    • C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe\78E.tmp.exe
      C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe\78E.tmp.exe --Task
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      PID:4312
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4312 -s 1628
        2⤵
        • Program crash
        PID:4348
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4312 -ip 4312
      1⤵
        PID:116
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 5044 -ip 5044
        1⤵
          PID:4416
        • C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe\78E.tmp.exe
          C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe\78E.tmp.exe --Task
          1⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          PID:3020

        Network

        MITRE ATT&CK Matrix ATT&CK v13

        Initial Access

        Execution

        Persistence

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Privilege Escalation

        Boot or Logon Autostart Execution

        1
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Defense Evasion

        File and Directory Permissions Modification

        1
        T1222

        Modify Registry

        1
        T1112

        Credential Access

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Resource Development

        Reconnaissance

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\SystemID\PersonalID.txt
          Filesize

          42B

          MD5

          045d3b6dd6c139389c8dfe8a570c126e

          SHA1

          10845462e28486787f33d39ee3af98058c43c5ee

          SHA256

          92e4f4d6985ed6cbb2594576eb14961b2af1d29ec3a52200fae084c04c0744f7

          SHA512

          ebf2ca8828ddf9a3ecb3cdf5f0b6d5d63341ae947c6e5ea7d6a15480be6a4b2a8bc4472a0404ec2b4123cb97879a66dbc744f1b9d7f9ff4f139ac3d9d1ffd969

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          1KB

          MD5

          2365869258df7a66a2121b802ca4afd9

          SHA1

          73acc30a2edeb9d6830de559bb8a74f35168135d

          SHA256

          d6b1932822bbd72a8e78c771717d992142348f67d625a42393719fefbe59b0ed

          SHA512

          795004bab536e128dbd81c188976d37c7b650efbfa5a80374df4c65a1049c27658f4620b7605583928eb167fcb69b4c99e4c8730c507b824a7bde9c7fb0e21f4

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          436B

          MD5

          1bfe0a81db078ea084ff82fe545176fe

          SHA1

          50b116f578bd272922fa8eae94f7b02fd3b88384

          SHA256

          5ba8817f13eee00e75158bad93076ab474a068c6b52686579e0f728fda68499f

          SHA512

          37c582f3f09f8d80529608c09041295d1644bcc9de6fb8c4669b05339b0dd870f9525abc5eed53ad06a94b51441275504bc943c336c5beb63b53460ba836ca8d

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
          Filesize

          174B

          MD5

          d094e3835e4aef06988b9bbd6d8980ea

          SHA1

          daae075e75839e59556db6b25816fde2f29686fb

          SHA256

          1aec2438468abf7cf87129a26736d5b31f2199ee16b0583e536edba8f98e4c85

          SHA512

          c20a6604f6e1591c668d6b233487e72702d25eda489d8570b081cf65031459cd7351cba3bd2f078372e00b368b3ac90cace2565c404b105e0a8b79469c97ce47

          Download Submit
        • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
          Filesize

          170B

          MD5

          bb20761bc526df9f0786010fef08ebe3

          SHA1

          2a2b085dd4f685ef0bf1b568e82d7c79cb4e6dbd

          SHA256

          e803a3d7eb1597d2c0a4491eee32674804e1f4298035041e5d741ae37d455d8c

          SHA512

          df8d72048f5cc565a82ae9a7569bd98624e202373370f3095d799999ec9791e55d85e94e406a852520db3c8288f07c91e3590444413ce2a3bf17d6fed5d72eb1

          Download Submit
        • C:\Users\Admin\AppData\Local\4469bbd3-ca13-46c4-a992-aa57423b56fe\78E.tmp.exe
          Filesize

          466KB

          MD5

          246d6fa957bd9bd9bd444ba8a6c38457

          SHA1

          fb90a2e9e3f3d4bf350a5c8d475c843f072bc1f5

          SHA256

          9c17cc38feddc8aec42f4d7e84ff85260e0e5d955c38e42573a21c18836c7a59

          SHA512

          95e3135f417fdfd91c8e57545c246c5a0f5efc40fe1e3ef745b8283c35b156d7814934be5983dd5532b7fb789a4032a3e1d619281d0e4e1b465b86f2a036e3bb

          Download Submit
        • memory/1500-24-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/1500-25-0x0000000000400000-0x000000000047A000-memory.dmp
          Filesize

          488KB

          Download
        • memory/1500-1-0x0000000000640000-0x0000000000740000-memory.dmp
          Filesize

          1024KB

          Download
        • memory/1500-2-0x0000000000400000-0x000000000047A000-memory.dmp
          Filesize

          488KB

          Download
        • memory/3020-379-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/3020-383-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/3020-382-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/4312-32-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/4312-33-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/4312-36-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-37-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-376-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-17-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-28-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-26-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download
        • memory/5044-16-0x0000000000400000-0x00000000004BC000-memory.dmp
          Filesize

          752KB

          Download