Overview

overview

10

Static

static

3

744ec52f48...51.exe

windows7-x64

10

744ec52f48...51.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    147s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-06-2024 09:08

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe

  • Size

    780KB

  • MD5

    9bd737b220a4040dbcaf17f48be54a98

  • SHA1

    9a64f521040e7250e8ae523cf2cc8f75753e4cf7

  • SHA256

    744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751

  • SHA512

    135e292c99e65ad22b20d446130f4a96e1de896a642eb5cf262957ad5fe78f867cc980270d8e8b636615ecbf4f539f8330bf1664aea2a1c0005a441d0f838d68

  • SSDEEP

    24576:cOrc1njeVCf3GFh6h8PXzUaoeu9Qdzw9pTG:Zc1jqC4JzUae9m2pG

Score
10/10
djvudiscoverypersistenceransomware

Malware Config

Extracted

Family

djvu

C2

http://cjto.top/sgfjsgdfgsgddagdpen4/get.php

Attributes
  • extension

    .maas

  • offline_id

    lhxqPpWFK0CiFzpfdXBaKGsuOjwIW2Jm623TOft1

  • payload_url

    http://cjto.top/files/penelop/updatewin1.exe

    http://cjto.top/files/penelop/updatewin2.exe

    http://cjto.top/files/penelop/updatewin.exe

    http://cjto.top/files/penelop/3.exe

    http://cjto.top/files/penelop/4.exe

    http://cjto.top/files/penelop/5.exe

  • ransomnote

    ATTENTION! Don't worry, you can return all your files! All your files like photos, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-9fpnK9F5nP Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: [email protected] Reserve e-mail address to contact us: [email protected] Your personal ID: 0239yjnkjddrt

rsa_pubkey.plain

Signatures

  • Detected Djvu ransomware 12 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

    ransomwaredjvu
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe
    "C:\Users\Admin\AppData\Local\Temp\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Users\Admin\AppData\Local\6a7aaa14-f3db-4080-af8a-72bf03964c79" /deny *S-1-1-0:(OI)(CI)(DE,DC)
      2⤵
      • Modifies file permissions
      PID:2804
    • C:\Users\Admin\AppData\Local\Temp\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe
      "C:\Users\Admin\AppData\Local\Temp\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe" --Admin IsNotAutoStart IsNotTask
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      PID:4188
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1568 -s 1592
      2⤵
      • Program crash
      PID:4964
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 1568 -ip 1568
    1⤵
      PID:1784
    • C:\Users\Admin\AppData\Local\6a7aaa14-f3db-4080-af8a-72bf03964c79\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe
      C:\Users\Admin\AppData\Local\6a7aaa14-f3db-4080-af8a-72bf03964c79\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe --Task
      1⤵
      • Executes dropped EXE
      PID:1788

    Network

    MITRE ATT&CK Matrix ATT&CK v13

    Initial Access

    Execution

    Persistence

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Privilege Escalation

    Boot or Logon Autostart Execution

    1
    T1547

    Registry Run Keys / Startup Folder

    1
    T1547.001

    Defense Evasion

    File and Directory Permissions Modification

    1
    T1222

    Modify Registry

    1
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Resource Development

    Reconnaissance

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\6a7aaa14-f3db-4080-af8a-72bf03964c79\744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751.exe
      Filesize

      780KB

      MD5

      9bd737b220a4040dbcaf17f48be54a98

      SHA1

      9a64f521040e7250e8ae523cf2cc8f75753e4cf7

      SHA256

      744ec52f480cb86b7e84fbbfe4b1880f57219dae5683b746f88d6ee4ba394751

      SHA512

      135e292c99e65ad22b20d446130f4a96e1de896a642eb5cf262957ad5fe78f867cc980270d8e8b636615ecbf4f539f8330bf1664aea2a1c0005a441d0f838d68

      Download Submit
    • memory/1568-11-0x00000000029F0000-0x0000000002B0A000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/1568-12-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/1568-4-0x0000000000400000-0x0000000000537000-memory.dmp
      Filesize

      1.2MB

      Download
    • memory/1568-5-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/1568-10-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/1568-2-0x0000000002950000-0x00000000029E5000-memory.dmp
      Filesize

      596KB

      Download
    • memory/1568-3-0x00000000029F0000-0x0000000002B0A000-memory.dmp
      Filesize

      1.1MB

      Download
    • memory/1568-0-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/1788-31-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/1788-34-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-8-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-14-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-15-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-17-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-21-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download
    • memory/4188-22-0x0000000000400000-0x0000000000D09000-memory.dmp
      Filesize

      9.0MB

      Download