Analysis
-
max time kernel
104s -
max time network
107s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
23-03-2021 15:25
Static task
static1
Behavioral task
behavioral1
Sample
xxx.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
xxx.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
xxx.exe
-
Size
208KB
-
MD5
3c08d1e5233c623bfc854879173544de
-
SHA1
a1add1d1e80d84440fc013abcc754f1bdddf3a20
-
SHA256
956246824d2fb2f5f4738c450e8d222042b08c3e5c67c3ec755bedf641b7b1c5
-
SHA512
01adb468d0318f44532f5222fff6f06eb5128b6b368d2a939b0e5c54da592784e793f97a1a9617f908cf0b2b61c61253ec0157433faf3894cc34e63fbbc5a943
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'UDmHKcEqZ'; $torlink = 'http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1392 uSERelmfNrep.exe 1660 OWwYwRXPWlan.exe 440 thsAdXTlXlan.exe -
Loads dropped DLL 6 IoCs
pid Process 1108 xxx.exe 1108 xxx.exe 1108 xxx.exe 1108 xxx.exe 1108 xxx.exe 1108 xxx.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2624 icacls.exe 2644 icacls.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Tegucigalpa xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.emf.ecore_2.10.1.v20140901-1043.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.registry_3.5.400.v20140428-1507.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui_5.5.0.165303.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\feature.xml xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Godthab xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\feature.properties xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\reflect.png xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_photo_Thumbnail.bmp xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\charsets.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.bidi_0.10.0.v20130327-1442.jar xxx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\InkObj.dll.mui xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\highlight.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Havana xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jerusalem xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME-JAVAFX.txt xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\README.TXT xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.mbeanbrowser_5.5.0.165303.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_ja_4.4.0.v20140623020002.jar xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-back-static.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Martinique xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.ssl_1.1.0.v20140827-1444.jar xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derby.war xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar xxx.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt xxx.exe File opened for modification C:\Program Files\CheckpointUnprotect.3gp xxx.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbjvs.inc xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\play-static.png xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_ButtonGraphic.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\images\cursors\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.commons.codec_1.6.0.v201305230611.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.sun.el_2.2.0.v201303151357.jar xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_buttongraphic.png xxx.exe File opened for modification C:\Program Files\Internet Explorer\en-US\F12.dll.mui xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\dropins\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\UTC xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar xxx.exe File opened for modification C:\Program Files\7-Zip\Lang\ar.txt xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\startNetworkServer xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\1047x576_91n92.png xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pt_BR.jar xxx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\RyukReadMe.html xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Dot.png xxx.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png xxx.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Australia\Broken_Hill xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.eclipse.nl_ja_4.4.0.v20140623020002.jar xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Whitehorse xxx.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\day-of-week-16.png xxx.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui xxx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1108 xxx.exe 1108 xxx.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1392 1108 xxx.exe 29 PID 1108 wrote to memory of 1392 1108 xxx.exe 29 PID 1108 wrote to memory of 1392 1108 xxx.exe 29 PID 1108 wrote to memory of 1392 1108 xxx.exe 29 PID 1108 wrote to memory of 1660 1108 xxx.exe 30 PID 1108 wrote to memory of 1660 1108 xxx.exe 30 PID 1108 wrote to memory of 1660 1108 xxx.exe 30 PID 1108 wrote to memory of 1660 1108 xxx.exe 30 PID 1108 wrote to memory of 440 1108 xxx.exe 31 PID 1108 wrote to memory of 440 1108 xxx.exe 31 PID 1108 wrote to memory of 440 1108 xxx.exe 31 PID 1108 wrote to memory of 440 1108 xxx.exe 31 PID 1108 wrote to memory of 2624 1108 xxx.exe 32 PID 1108 wrote to memory of 2624 1108 xxx.exe 32 PID 1108 wrote to memory of 2624 1108 xxx.exe 32 PID 1108 wrote to memory of 2624 1108 xxx.exe 32 PID 1108 wrote to memory of 2644 1108 xxx.exe 33 PID 1108 wrote to memory of 2644 1108 xxx.exe 33 PID 1108 wrote to memory of 2644 1108 xxx.exe 33 PID 1108 wrote to memory of 2644 1108 xxx.exe 33 PID 1108 wrote to memory of 2756 1108 xxx.exe 37 PID 1108 wrote to memory of 2756 1108 xxx.exe 37 PID 1108 wrote to memory of 2756 1108 xxx.exe 37 PID 1108 wrote to memory of 2756 1108 xxx.exe 37 PID 1108 wrote to memory of 3660 1108 xxx.exe 39 PID 1108 wrote to memory of 3660 1108 xxx.exe 39 PID 1108 wrote to memory of 3660 1108 xxx.exe 39 PID 1108 wrote to memory of 3660 1108 xxx.exe 39 PID 3660 wrote to memory of 3820 3660 net.exe 41 PID 3660 wrote to memory of 3820 3660 net.exe 41 PID 3660 wrote to memory of 3820 3660 net.exe 41 PID 3660 wrote to memory of 3820 3660 net.exe 41 PID 2756 wrote to memory of 3796 2756 net.exe 47 PID 2756 wrote to memory of 3796 2756 net.exe 47 PID 2756 wrote to memory of 3796 2756 net.exe 47 PID 2756 wrote to memory of 3796 2756 net.exe 47 PID 1108 wrote to memory of 2820 1108 xxx.exe 42 PID 1108 wrote to memory of 2820 1108 xxx.exe 42 PID 1108 wrote to memory of 2820 1108 xxx.exe 42 PID 1108 wrote to memory of 2820 1108 xxx.exe 42 PID 1108 wrote to memory of 3612 1108 xxx.exe 43 PID 1108 wrote to memory of 3612 1108 xxx.exe 43 PID 1108 wrote to memory of 3612 1108 xxx.exe 43 PID 1108 wrote to memory of 3612 1108 xxx.exe 43 PID 2820 wrote to memory of 3560 2820 net.exe 46 PID 2820 wrote to memory of 3560 2820 net.exe 46 PID 2820 wrote to memory of 3560 2820 net.exe 46 PID 2820 wrote to memory of 3560 2820 net.exe 46 PID 3612 wrote to memory of 3608 3612 net.exe 48 PID 3612 wrote to memory of 3608 3612 net.exe 48 PID 3612 wrote to memory of 3608 3612 net.exe 48 PID 3612 wrote to memory of 3608 3612 net.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\xxx.exe"C:\Users\Admin\AppData\Local\Temp\xxx.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\uSERelmfNrep.exe"C:\Users\Admin\AppData\Local\Temp\uSERelmfNrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1392
-
-
C:\Users\Admin\AppData\Local\Temp\OWwYwRXPWlan.exe"C:\Users\Admin\AppData\Local\Temp\OWwYwRXPWlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\thsAdXTlXlan.exe"C:\Users\Admin\AppData\Local\Temp\thsAdXTlXlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:440
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2624
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2644
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3796
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3660 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3820
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3560
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3612 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3608
-
-