Analysis
-
max time kernel
133s -
max time network
136s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-03-2021 07:50
Static task
static1
Behavioral task
behavioral1
Sample
457714230.bin.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
457714230.bin.exe
Resource
win10v20201028
General
-
Target
457714230.bin.exe
-
Size
585KB
-
MD5
ecc067775610688181f629bdb695933f
-
SHA1
aafa461e75167de03424f1fec735747da39ec31b
-
SHA256
b0840f04d3b97ae3c5873249a3a2f6393be99c73b38bbafbb0c7e749d8cb9a9b
-
SHA512
0d6b95be375e1d20a49a28630fa70954d0a2f1991fb5d55915c93586bd9147905456c1f43fba32aa725fe9d80a3784fe1b97d76f2c578398ea1a51af4f94534c
Malware Config
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\osetup.dll.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\OWOW64WW.cab.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPlusWW.msi.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW.cab.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\ProPsWW2.cab.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelLR.cab.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0016-0409-0000-0000000FF1CE}-C\ExcelMUI.msi.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PowerPointMUI.msi.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0018-0409-0000-0000000FF1CE}-C\PptLR.cab.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
C:\MSOCache\All Users\{90140000-0019-0409-0000-0000000FF1CE}-C\PublisherMUI.msi.txt
ryuk
http://diehard4uty2z5cs.onion
Extracted
Protocol: smtp- Host:
smtp.ionos.fr - Port:
587 - Username:
[email protected] - Password:
8p<@MrL3
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\houma.js 457714230.bin.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1684 457714230.bin.exe