Analysis
-
max time kernel
278s -
max time network
172s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
hellish-database.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
hellish-database.exe
-
Size
117KB
-
MD5
31db87c5d3b970b42cb577611f851c7a
-
SHA1
8cc6a1f94514033ad8b15c3c4c720fb0eac249f1
-
SHA256
703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f
-
SHA512
d00d566f7385accd173669c9f8f6868626287e0ed4a6a08b174af9f6d054b70aed3babfa91450caa085134a2e75db42802a9cc11790c923ece3a4042d161be4a
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'PrWUilDMFi'; $torlink = 'http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1220 KXpCwHQxErep.exe 1904 snQIiwixrlan.exe 680 pAWhjCELGlan.exe -
Modifies extensions of user files 3 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\MergeUpdate.tiff.RYK hellish-database.exe File opened for modification C:\Users\Admin\Pictures\RevokeEnter.crw.RYK hellish-database.exe File opened for modification C:\Users\Admin\Pictures\UnblockComplete.crw.RYK hellish-database.exe -
Loads dropped DLL 6 IoCs
pid Process 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2676 icacls.exe 2664 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI hellish-database.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_ja_4.4.0.v20140623020002.jar hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\Oasis\TAB_OFF.GIF.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignleft.gif hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PPTIRM.XML hellish-database.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Icons\XDPFile_8.ico.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\RECS.ICO.RYK hellish-database.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Green Bubbles.htm hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kolkata hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\AccessWeb\CLNTWRAP.HTM hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\VIEW.JS hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Library\RyukReadMe.html hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Ulaanbaatar hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPHandle.png hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\CALENDAR.GIF.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveProjectToolset\BriefcaseIconMask.bmp.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Thimphu hellish-database.exe File opened for modification C:\Program Files\Microsoft Office\Office14\ONLNTCOMLIB.DLL hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0183172.WMF hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\CreateSpaceImage.jpg hellish-database.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.ELM.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01637_.WMF.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar hellish-database.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\LC_MESSAGES\vlc.mo hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Campo_Grande.RYK hellish-database.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Sync Framework\v1.0\Runtime\x86\resources\1033\Synchronization.rll hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21519_.GIF.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Xlate_Complete.xsn.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR14F.GIF.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\J0115866.GIF hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SOCIALCONNECTOR.DLL hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Singapore.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PRRT.WMF.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT-14 hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-options-keymap.xml_hidden hellish-database.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Folders\RyukReadMe.html hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Boise.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\feature.properties.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME46.CSS.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.flightrecorder.controlpanel.ui.configuration_5.5.0.165303.jar hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196354.WMF.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01747_.GIF.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0292278.WMF hellish-database.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\server_lg.gif hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\RyukReadMe.html hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18248_.WMF.RYK hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02285_.WMF hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPUNCT.XML hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.addons.swt_1.1.1.v20140903-0821.jar hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Guayaquil hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_justify.gif hellish-database.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Marquesas.RYK hellish-database.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv hellish-database.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.fr\RyukReadMe.html hellish-database.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Web Server Extensions\14\BIN\FPWEC.DLL hellish-database.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Makassar.RYK hellish-database.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Urumqi.RYK hellish-database.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 5324 SCHTASKS.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe 2036 hellish-database.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2036 wrote to memory of 1220 2036 hellish-database.exe 29 PID 2036 wrote to memory of 1220 2036 hellish-database.exe 29 PID 2036 wrote to memory of 1220 2036 hellish-database.exe 29 PID 2036 wrote to memory of 1220 2036 hellish-database.exe 29 PID 2036 wrote to memory of 1904 2036 hellish-database.exe 30 PID 2036 wrote to memory of 1904 2036 hellish-database.exe 30 PID 2036 wrote to memory of 1904 2036 hellish-database.exe 30 PID 2036 wrote to memory of 1904 2036 hellish-database.exe 30 PID 2036 wrote to memory of 680 2036 hellish-database.exe 31 PID 2036 wrote to memory of 680 2036 hellish-database.exe 31 PID 2036 wrote to memory of 680 2036 hellish-database.exe 31 PID 2036 wrote to memory of 680 2036 hellish-database.exe 31 PID 2036 wrote to memory of 2664 2036 hellish-database.exe 32 PID 2036 wrote to memory of 2664 2036 hellish-database.exe 32 PID 2036 wrote to memory of 2664 2036 hellish-database.exe 32 PID 2036 wrote to memory of 2664 2036 hellish-database.exe 32 PID 2036 wrote to memory of 2676 2036 hellish-database.exe 33 PID 2036 wrote to memory of 2676 2036 hellish-database.exe 33 PID 2036 wrote to memory of 2676 2036 hellish-database.exe 33 PID 2036 wrote to memory of 2676 2036 hellish-database.exe 33 PID 2036 wrote to memory of 3632 2036 hellish-database.exe 37 PID 2036 wrote to memory of 3632 2036 hellish-database.exe 37 PID 2036 wrote to memory of 3632 2036 hellish-database.exe 37 PID 2036 wrote to memory of 3632 2036 hellish-database.exe 37 PID 3632 wrote to memory of 3844 3632 net.exe 39 PID 3632 wrote to memory of 3844 3632 net.exe 39 PID 3632 wrote to memory of 3844 3632 net.exe 39 PID 3632 wrote to memory of 3844 3632 net.exe 39 PID 2036 wrote to memory of 3908 2036 hellish-database.exe 40 PID 2036 wrote to memory of 3908 2036 hellish-database.exe 40 PID 2036 wrote to memory of 3908 2036 hellish-database.exe 40 PID 2036 wrote to memory of 3908 2036 hellish-database.exe 40 PID 3908 wrote to memory of 3732 3908 net.exe 42 PID 3908 wrote to memory of 3732 3908 net.exe 42 PID 3908 wrote to memory of 3732 3908 net.exe 42 PID 3908 wrote to memory of 3732 3908 net.exe 42 PID 2036 wrote to memory of 4056 2036 hellish-database.exe 43 PID 2036 wrote to memory of 4056 2036 hellish-database.exe 43 PID 2036 wrote to memory of 4056 2036 hellish-database.exe 43 PID 2036 wrote to memory of 4056 2036 hellish-database.exe 43 PID 4056 wrote to memory of 2920 4056 net.exe 45 PID 4056 wrote to memory of 2920 4056 net.exe 45 PID 4056 wrote to memory of 2920 4056 net.exe 45 PID 4056 wrote to memory of 2920 4056 net.exe 45 PID 2036 wrote to memory of 2836 2036 hellish-database.exe 46 PID 2036 wrote to memory of 2836 2036 hellish-database.exe 46 PID 2036 wrote to memory of 2836 2036 hellish-database.exe 46 PID 2036 wrote to memory of 2836 2036 hellish-database.exe 46 PID 2836 wrote to memory of 3144 2836 net.exe 48 PID 2836 wrote to memory of 3144 2836 net.exe 48 PID 2836 wrote to memory of 3144 2836 net.exe 48 PID 2836 wrote to memory of 3144 2836 net.exe 48 PID 2036 wrote to memory of 3856 2036 hellish-database.exe 51 PID 2036 wrote to memory of 3856 2036 hellish-database.exe 51 PID 2036 wrote to memory of 3856 2036 hellish-database.exe 51 PID 2036 wrote to memory of 3856 2036 hellish-database.exe 51 PID 3856 wrote to memory of 8160 3856 net.exe 53 PID 3856 wrote to memory of 8160 3856 net.exe 53 PID 3856 wrote to memory of 8160 3856 net.exe 53 PID 3856 wrote to memory of 8160 3856 net.exe 53 PID 2036 wrote to memory of 7440 2036 hellish-database.exe 54 PID 2036 wrote to memory of 7440 2036 hellish-database.exe 54 PID 2036 wrote to memory of 7440 2036 hellish-database.exe 54 PID 2036 wrote to memory of 7440 2036 hellish-database.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\hellish-database.exe"C:\Users\Admin\AppData\Local\Temp\hellish-database.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2036 -
C:\Users\Admin\AppData\Local\Temp\KXpCwHQxErep.exe"C:\Users\Admin\AppData\Local\Temp\KXpCwHQxErep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1220
-
-
C:\Users\Admin\AppData\Local\Temp\snQIiwixrlan.exe"C:\Users\Admin\AppData\Local\Temp\snQIiwixrlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\pAWhjCELGlan.exe"C:\Users\Admin\AppData\Local\Temp\pAWhjCELGlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:680
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2664
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2676
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3632 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3844
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3732
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2920
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2836 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3144
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8160
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:7440
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:7504
-
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /CREATE /NP /SC DAILY /TN "Print56" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\k6a5I.dll" /ST 10:25 /SD 04/28/2021 /ED 05/05/20212⤵
- Creates scheduled task(s)
PID:5324
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8912
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8928
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8956
-
-