Analysis
-
max time kernel
270s -
max time network
177s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
gigantic-western.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
gigantic-western.exe
-
Size
143KB
-
MD5
b77cc8a1ede23a80a4a4c9d0a8b40735
-
SHA1
254c97abab837687c779b57c7ef1bec4c1e2351a
-
SHA256
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581
-
SHA512
f94546161808210ada027d03465f88336de4f2d24581801566f7ff17a9641b389c43946a98275ed637759a0205b8d09f9028d26bb75ab44e3f7038c5b4667ffd
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
Wallets
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 1 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\PushProtect.tiff gigantic-western.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\gigantic-western.exe" reg.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsStyles\OliveGreen.css gigantic-western.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationUp_ButtonGraphic.png gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8 gigantic-western.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\vlc.mo gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00648_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\MP00646_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02041_.WMF gigantic-western.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-api.jar gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\GMT gigantic-western.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ta\RyukReadMe.txt gigantic-western.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Soft Blue.htm gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090779.WMF gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.databinding.nl_ja_4.4.0.v20140623020002.jar gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152556.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD10358_.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOC.CFG gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\license.html gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\security\blacklist gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00167_.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01680_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_TexturedBlue.gif gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\CIEXYZ.pf gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vevay gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR27F.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00126_.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsVersion1Warning.htm gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\MAIN.XML gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Yekaterinburg gigantic-western.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.ITS gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0390072.JPG gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO01905_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB01741L.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Urban.xml gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12 gigantic-western.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\THMBNAIL.PNG gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02749G.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0221903.WMF gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\RyukReadMe.txt gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-favorites_zh_CN.jar gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD19582_.GIF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTFORM.DAT gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\NOTEL.ICO gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00919_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\WINWORD.DEV_COL.HXC gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Access\DataType\RyukReadMe.txt gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\blacklist gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\javafx.properties gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD15020_.GIF gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Vostok gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02957_.WMF gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_choosefont.gif gigantic-western.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar gigantic-western.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Krasnoyarsk gigantic-western.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\RyukReadMe.txt gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Document Parts\1033\14\Built-In Building Blocks.dotx gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\bg_OliveGreen.gif gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\SIGN98.POC gigantic-western.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\GREETING.DPV gigantic-western.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 70044 vssadmin.exe 70080 vssadmin.exe 70212 vssadmin.exe 69876 vssadmin.exe 69944 vssadmin.exe 70012 vssadmin.exe 70180 vssadmin.exe 70340 vssadmin.exe 70404 vssadmin.exe 70276 vssadmin.exe 70372 vssadmin.exe 69980 vssadmin.exe 70244 vssadmin.exe 70308 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1104 gigantic-western.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1104 gigantic-western.exe Token: SeBackupPrivilege 69904 vssvc.exe Token: SeRestorePrivilege 69904 vssvc.exe Token: SeAuditPrivilege 69904 vssvc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1308 1104 gigantic-western.exe 29 PID 1104 wrote to memory of 1308 1104 gigantic-western.exe 29 PID 1104 wrote to memory of 1308 1104 gigantic-western.exe 29 PID 1104 wrote to memory of 1308 1104 gigantic-western.exe 29 PID 1104 wrote to memory of 1128 1104 gigantic-western.exe 15 PID 1308 wrote to memory of 1552 1308 cmd.exe 31 PID 1308 wrote to memory of 1552 1308 cmd.exe 31 PID 1308 wrote to memory of 1552 1308 cmd.exe 31 PID 1308 wrote to memory of 1552 1308 cmd.exe 31 PID 1104 wrote to memory of 1188 1104 gigantic-western.exe 11 PID 1104 wrote to memory of 69840 1104 gigantic-western.exe 33 PID 1104 wrote to memory of 69840 1104 gigantic-western.exe 33 PID 1104 wrote to memory of 69840 1104 gigantic-western.exe 33 PID 1104 wrote to memory of 69840 1104 gigantic-western.exe 33 PID 69840 wrote to memory of 69876 69840 cmd.exe 35 PID 69840 wrote to memory of 69876 69840 cmd.exe 35 PID 69840 wrote to memory of 69876 69840 cmd.exe 35 PID 69840 wrote to memory of 69876 69840 cmd.exe 35 PID 69840 wrote to memory of 69944 69840 cmd.exe 37 PID 69840 wrote to memory of 69944 69840 cmd.exe 37 PID 69840 wrote to memory of 69944 69840 cmd.exe 37 PID 69840 wrote to memory of 69944 69840 cmd.exe 37 PID 69840 wrote to memory of 69980 69840 cmd.exe 38 PID 69840 wrote to memory of 69980 69840 cmd.exe 38 PID 69840 wrote to memory of 69980 69840 cmd.exe 38 PID 69840 wrote to memory of 69980 69840 cmd.exe 38 PID 69840 wrote to memory of 70012 69840 cmd.exe 39 PID 69840 wrote to memory of 70012 69840 cmd.exe 39 PID 69840 wrote to memory of 70012 69840 cmd.exe 39 PID 69840 wrote to memory of 70012 69840 cmd.exe 39 PID 69840 wrote to memory of 70044 69840 cmd.exe 40 PID 69840 wrote to memory of 70044 69840 cmd.exe 40 PID 69840 wrote to memory of 70044 69840 cmd.exe 40 PID 69840 wrote to memory of 70044 69840 cmd.exe 40 PID 69840 wrote to memory of 70080 69840 cmd.exe 41 PID 69840 wrote to memory of 70080 69840 cmd.exe 41 PID 69840 wrote to memory of 70080 69840 cmd.exe 41 PID 69840 wrote to memory of 70080 69840 cmd.exe 41 PID 69840 wrote to memory of 70180 69840 cmd.exe 43 PID 69840 wrote to memory of 70180 69840 cmd.exe 43 PID 69840 wrote to memory of 70180 69840 cmd.exe 43 PID 69840 wrote to memory of 70180 69840 cmd.exe 43 PID 69840 wrote to memory of 70212 69840 cmd.exe 44 PID 69840 wrote to memory of 70212 69840 cmd.exe 44 PID 69840 wrote to memory of 70212 69840 cmd.exe 44 PID 69840 wrote to memory of 70212 69840 cmd.exe 44 PID 69840 wrote to memory of 70244 69840 cmd.exe 45 PID 69840 wrote to memory of 70244 69840 cmd.exe 45 PID 69840 wrote to memory of 70244 69840 cmd.exe 45 PID 69840 wrote to memory of 70244 69840 cmd.exe 45 PID 69840 wrote to memory of 70276 69840 cmd.exe 46 PID 69840 wrote to memory of 70276 69840 cmd.exe 46 PID 69840 wrote to memory of 70276 69840 cmd.exe 46 PID 69840 wrote to memory of 70276 69840 cmd.exe 46 PID 69840 wrote to memory of 70308 69840 cmd.exe 47 PID 69840 wrote to memory of 70308 69840 cmd.exe 47 PID 69840 wrote to memory of 70308 69840 cmd.exe 47 PID 69840 wrote to memory of 70308 69840 cmd.exe 47 PID 69840 wrote to memory of 70340 69840 cmd.exe 48 PID 69840 wrote to memory of 70340 69840 cmd.exe 48 PID 69840 wrote to memory of 70340 69840 cmd.exe 48 PID 69840 wrote to memory of 70340 69840 cmd.exe 48 PID 69840 wrote to memory of 70372 69840 cmd.exe 49 PID 69840 wrote to memory of 70372 69840 cmd.exe 49
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Users\Admin\AppData\Local\Temp\gigantic-western.exe"C:\Users\Admin\AppData\Local\Temp\gigantic-western.exe"1⤵
- Modifies extensions of user files
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\gigantic-western.exe" /f /reg:642⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\gigantic-western.exe" /f /reg:643⤵
- Adds Run key to start application
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"2⤵
- Suspicious use of WriteProcessMemory
PID:69840 -
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:69876
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:69944
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:69980
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70012
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70044
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70080
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70180
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70212
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70244
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70276
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70308
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70340
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:70372
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:70404
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:69904