Analysis
-
max time kernel
300s -
max time network
260s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-04-2021 09:33
Static task
static1
Behavioral task
behavioral1
Sample
amused-watch.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
amused-watch.exe
-
Size
118KB
-
MD5
a31089dc3cafe77c39268273d689193b
-
SHA1
032e0b9a0bf012401507be974ee6bdb3e6726fd7
-
SHA256
ffbf608aaef69e1ee53f8303c685604dd584985f809d19f6cbc914fa86b3ae66
-
SHA512
d92748b34286c21f4781b147000be1b54cf57e14587517638647b8369ccd01b3ecb00545be0d87d44f9dde6b30a404db2740bf06275dea647efc33eafd65d2f4
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'N2QvTsXamJ'; $torlink = 'http://zq6gyokyso6dgsxitjuk2tkq2rl4saq4tkz2idcf6z3tfondtvemshad.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://zq6gyokyso6dgsxitjuk2tkq2rl4saq4tkz2idcf6z3tfondtvemshad.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1576 vOzGaidlNrep.exe 1636 UKgiRTrPtlan.exe 1192 QiaeQznYJlan.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\ReceiveWait.tif.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromStart.crw.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\ProtectWrite.raw.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\SetInstall.tiff.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\AddDebug.crw.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\ExitSelect.tiff.RYK amused-watch.exe File opened for modification C:\Users\Admin\Pictures\HideAdd.tiff.RYK amused-watch.exe -
Loads dropped DLL 6 IoCs
pid Process 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2656 icacls.exe 2668 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI amused-watch.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.swt.nl_ja_4.4.0.v20140623020002.jar amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF.RYK amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar.RYK amused-watch.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Kuching.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR15F.GIF.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\UnreadIconImagesMask.bmp.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14997_.GIF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Sts2.css amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.property.nl_ja_4.4.0.v20140623020002.jar.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\TypeSupport\Unicode\Mappings\win\CP1254.TXT.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGSTORY.XML.RYK amused-watch.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\16_9-frame-highlight.png amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00004_.GIF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART2.BDR amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Visual Studio 8\Common7\IDE\VSTA\ItemTemplates\VisualBasic\1033\Dataset.zip amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE01160_.WMF amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105232.WMF.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152628.WMF.RYK amused-watch.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\OLJRNL.FAE amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\TASKS.ICO.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.es\Proof.XML amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03466_.WMF amused-watch.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Petersburg.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME38.CSS.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\IPOLK.DLL amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0232803.WMF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\diagnostic-command-16.png.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Americana\TAB_ON.GIF.RYK amused-watch.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar amused-watch.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ckb\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0215076.WMF amused-watch.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Certificates\Verisign\Components\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\Swirl.css.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosecolor.gif amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY00170_.WMF.RYK amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\update_tracking\org-netbeans-modules-profiler-selector-api.xml amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00132_.WMF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21338_.GIF amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341559.JPG amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00148_.WMF.RYK amused-watch.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Guam.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01759_.WMF.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Equity.xml.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\messageboxinfo.ico amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\epl-v10.html.RYK amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-util-lookup.jar.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02522_.WMF.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\TimeCard.xltx.RYK amused-watch.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\RyukReadMe.html amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01245_.GIF.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\PACBELL.NET.XML.RYK amused-watch.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Managua.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\CourierStd-BoldOblique.otf.RYK amused-watch.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Stationery\1033\TECHTOOL.GIF.RYK amused-watch.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 6952 SCHTASKS.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe 1096 amused-watch.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1096 wrote to memory of 1576 1096 amused-watch.exe 29 PID 1096 wrote to memory of 1576 1096 amused-watch.exe 29 PID 1096 wrote to memory of 1576 1096 amused-watch.exe 29 PID 1096 wrote to memory of 1576 1096 amused-watch.exe 29 PID 1096 wrote to memory of 1636 1096 amused-watch.exe 30 PID 1096 wrote to memory of 1636 1096 amused-watch.exe 30 PID 1096 wrote to memory of 1636 1096 amused-watch.exe 30 PID 1096 wrote to memory of 1636 1096 amused-watch.exe 30 PID 1096 wrote to memory of 1192 1096 amused-watch.exe 31 PID 1096 wrote to memory of 1192 1096 amused-watch.exe 31 PID 1096 wrote to memory of 1192 1096 amused-watch.exe 31 PID 1096 wrote to memory of 1192 1096 amused-watch.exe 31 PID 1096 wrote to memory of 2656 1096 amused-watch.exe 32 PID 1096 wrote to memory of 2656 1096 amused-watch.exe 32 PID 1096 wrote to memory of 2656 1096 amused-watch.exe 32 PID 1096 wrote to memory of 2656 1096 amused-watch.exe 32 PID 1096 wrote to memory of 2668 1096 amused-watch.exe 33 PID 1096 wrote to memory of 2668 1096 amused-watch.exe 33 PID 1096 wrote to memory of 2668 1096 amused-watch.exe 33 PID 1096 wrote to memory of 2668 1096 amused-watch.exe 33 PID 1096 wrote to memory of 3728 1096 amused-watch.exe 37 PID 1096 wrote to memory of 3728 1096 amused-watch.exe 37 PID 1096 wrote to memory of 3728 1096 amused-watch.exe 37 PID 1096 wrote to memory of 3728 1096 amused-watch.exe 37 PID 1096 wrote to memory of 3704 1096 amused-watch.exe 36 PID 1096 wrote to memory of 3704 1096 amused-watch.exe 36 PID 1096 wrote to memory of 3704 1096 amused-watch.exe 36 PID 1096 wrote to memory of 3704 1096 amused-watch.exe 36 PID 3704 wrote to memory of 3428 3704 net.exe 41 PID 3704 wrote to memory of 3428 3704 net.exe 41 PID 3704 wrote to memory of 3428 3704 net.exe 41 PID 3704 wrote to memory of 3428 3704 net.exe 41 PID 3728 wrote to memory of 3324 3728 net.exe 40 PID 3728 wrote to memory of 3324 3728 net.exe 40 PID 3728 wrote to memory of 3324 3728 net.exe 40 PID 3728 wrote to memory of 3324 3728 net.exe 40 PID 1096 wrote to memory of 3168 1096 amused-watch.exe 43 PID 1096 wrote to memory of 3168 1096 amused-watch.exe 43 PID 1096 wrote to memory of 3168 1096 amused-watch.exe 43 PID 1096 wrote to memory of 3168 1096 amused-watch.exe 43 PID 1096 wrote to memory of 3280 1096 amused-watch.exe 42 PID 1096 wrote to memory of 3280 1096 amused-watch.exe 42 PID 1096 wrote to memory of 3280 1096 amused-watch.exe 42 PID 1096 wrote to memory of 3280 1096 amused-watch.exe 42 PID 3168 wrote to memory of 2908 3168 net.exe 46 PID 3168 wrote to memory of 2908 3168 net.exe 46 PID 3168 wrote to memory of 2908 3168 net.exe 46 PID 3168 wrote to memory of 2908 3168 net.exe 46 PID 3280 wrote to memory of 1920 3280 net.exe 47 PID 3280 wrote to memory of 1920 3280 net.exe 47 PID 3280 wrote to memory of 1920 3280 net.exe 47 PID 3280 wrote to memory of 1920 3280 net.exe 47 PID 1096 wrote to memory of 6900 1096 amused-watch.exe 53 PID 1096 wrote to memory of 6900 1096 amused-watch.exe 53 PID 1096 wrote to memory of 6900 1096 amused-watch.exe 53 PID 1096 wrote to memory of 6900 1096 amused-watch.exe 53 PID 1096 wrote to memory of 6916 1096 amused-watch.exe 54 PID 1096 wrote to memory of 6916 1096 amused-watch.exe 54 PID 1096 wrote to memory of 6916 1096 amused-watch.exe 54 PID 1096 wrote to memory of 6916 1096 amused-watch.exe 54 PID 6900 wrote to memory of 6976 6900 net.exe 58 PID 6900 wrote to memory of 6976 6900 net.exe 58 PID 6900 wrote to memory of 6976 6900 net.exe 58 PID 6900 wrote to memory of 6976 6900 net.exe 58
Processes
-
C:\Users\Admin\AppData\Local\Temp\amused-watch.exe"C:\Users\Admin\AppData\Local\Temp\amused-watch.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\vOzGaidlNrep.exe"C:\Users\Admin\AppData\Local\Temp\vOzGaidlNrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1576
-
-
C:\Users\Admin\AppData\Local\Temp\UKgiRTrPtlan.exe"C:\Users\Admin\AppData\Local\Temp\UKgiRTrPtlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1636
-
-
C:\Users\Admin\AppData\Local\Temp\QiaeQznYJlan.exe"C:\Users\Admin\AppData\Local\Temp\QiaeQznYJlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1192
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2656
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2668
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3704 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3428
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3324
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1920
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2908
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:6900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:6976
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:6916
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:6948
-
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /CREATE /NP /SC DAILY /TN "Print9m" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\hQSad.dll" /ST 10:25 /SD 04/23/2021 /ED 04/30/20212⤵
- Creates scheduled task(s)
PID:6952
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8820
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8864
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8852
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8896
-
-