Analysis
-
max time kernel
300s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
unequal-impact.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
unequal-impact.exe
-
Size
121KB
-
MD5
7364f6222ac58896e8920f32e4d30aac
-
SHA1
915fd6fb4e20909025f876f3bb453ec52e21b7be
-
SHA256
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f
-
SHA512
f5e2b5a17ed04c7edb904e867cec2f66a59b887176bd3e25803e82a390fc36fc47002df747099ca4e6960f020afe1137f4ba24b28613423b5de0b09ff7048026
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'RCCF8gd'; $torlink = 'http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1452 FMmGpAvYHrep.exe 1644 ezdJSzoSSlan.exe 268 xDlhaHqqllan.exe -
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\HideEdit.tif.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\SetSearch.tif.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\PublishWrite.tif.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\UnblockWrite.crw.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\DismountDebug.raw.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\RepairStep.crw.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\SendRedo.tiff.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\SearchInitialize.crw.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\StepPush.tiff.RYK unequal-impact.exe File opened for modification C:\Users\Admin\Pictures\UnpublishUnregister.tiff.RYK unequal-impact.exe -
Loads dropped DLL 6 IoCs
pid Process 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2688 icacls.exe 2700 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI unequal-impact.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_zh_4.4.0.v20140623020002.jar unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-profiler.xml unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02753U.BMP unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14692_.GIF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105600.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309902.WMF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382960.JPG unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightItalic.ttf.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-explorer.xml.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolIcons\StatusOnline.ico.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Jakarta unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-util-enumerations.jar unequal-impact.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\header-background.png unequal-impact.exe File opened for modification C:\Program Files\Java\jre7\lib\charsets.jar unequal-impact.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\IETAG.DLL unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01634_.WMF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\WEB11.POC unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGPQUOT.XML.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\IN00046_.WMF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AD.XML unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00274_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222019.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PSRCHSRN.DAT.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\BORDERS\MSART5.BDR.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Ashgabat unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\CONVERT\RM.DLL unequal-impact.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SLATE\SLATE.INF.RYK unequal-impact.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ach\RyukReadMe.html unequal-impact.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD07831_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\NotifierWindowMask.bmp unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\Pitchbook.potx unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.xml.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\WebToolImages16x16.jpg.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-api-search_zh_CN.jar unequal-impact.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\mr\RyukReadMe.html unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03236_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\BabyBlue\TAB_OFF.GIF.RYK unequal-impact.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\scrapbook.png unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00261_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02077_.GIF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21337_.GIF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\TAB_ON.GIF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00452_.WMF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DISTLSTS.ICO unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FORM.JS unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Author2XML.XSL.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\com.oracle.jmc.executable.win32.win32.x86_64_5.5.0 unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\MEDIA\APPLAUSE.WAV unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02450_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Microsoft.Office.BusinessApplications.RuntimeUi.xml.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02161_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar unequal-impact.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\tesselate.x3d unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01356_.WMF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01219_.GIF.RYK unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00211_.WMF unequal-impact.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsFormTemplate.html unequal-impact.exe File opened for modification C:\Program Files\Java\jre7\lib\management\management.properties.RYK unequal-impact.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-editor-mimelookup.xml.RYK unequal-impact.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 7996 SCHTASKS.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe 452 unequal-impact.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 452 wrote to memory of 1452 452 unequal-impact.exe 29 PID 452 wrote to memory of 1452 452 unequal-impact.exe 29 PID 452 wrote to memory of 1452 452 unequal-impact.exe 29 PID 452 wrote to memory of 1452 452 unequal-impact.exe 29 PID 452 wrote to memory of 1644 452 unequal-impact.exe 30 PID 452 wrote to memory of 1644 452 unequal-impact.exe 30 PID 452 wrote to memory of 1644 452 unequal-impact.exe 30 PID 452 wrote to memory of 1644 452 unequal-impact.exe 30 PID 452 wrote to memory of 268 452 unequal-impact.exe 31 PID 452 wrote to memory of 268 452 unequal-impact.exe 31 PID 452 wrote to memory of 268 452 unequal-impact.exe 31 PID 452 wrote to memory of 268 452 unequal-impact.exe 31 PID 452 wrote to memory of 2688 452 unequal-impact.exe 32 PID 452 wrote to memory of 2688 452 unequal-impact.exe 32 PID 452 wrote to memory of 2688 452 unequal-impact.exe 32 PID 452 wrote to memory of 2688 452 unequal-impact.exe 32 PID 452 wrote to memory of 2700 452 unequal-impact.exe 33 PID 452 wrote to memory of 2700 452 unequal-impact.exe 33 PID 452 wrote to memory of 2700 452 unequal-impact.exe 33 PID 452 wrote to memory of 2700 452 unequal-impact.exe 33 PID 452 wrote to memory of 3488 452 unequal-impact.exe 37 PID 452 wrote to memory of 3488 452 unequal-impact.exe 37 PID 452 wrote to memory of 3488 452 unequal-impact.exe 37 PID 452 wrote to memory of 3488 452 unequal-impact.exe 37 PID 3488 wrote to memory of 3536 3488 net.exe 40 PID 3488 wrote to memory of 3536 3488 net.exe 40 PID 3488 wrote to memory of 3536 3488 net.exe 40 PID 3488 wrote to memory of 3536 3488 net.exe 40 PID 452 wrote to memory of 3556 452 unequal-impact.exe 39 PID 452 wrote to memory of 3556 452 unequal-impact.exe 39 PID 452 wrote to memory of 3556 452 unequal-impact.exe 39 PID 452 wrote to memory of 3556 452 unequal-impact.exe 39 PID 3556 wrote to memory of 3680 3556 net.exe 42 PID 3556 wrote to memory of 3680 3556 net.exe 42 PID 3556 wrote to memory of 3680 3556 net.exe 42 PID 3556 wrote to memory of 3680 3556 net.exe 42 PID 452 wrote to memory of 3736 452 unequal-impact.exe 43 PID 452 wrote to memory of 3736 452 unequal-impact.exe 43 PID 452 wrote to memory of 3736 452 unequal-impact.exe 43 PID 452 wrote to memory of 3736 452 unequal-impact.exe 43 PID 3736 wrote to memory of 3764 3736 net.exe 45 PID 3736 wrote to memory of 3764 3736 net.exe 45 PID 3736 wrote to memory of 3764 3736 net.exe 45 PID 3736 wrote to memory of 3764 3736 net.exe 45 PID 452 wrote to memory of 3796 452 unequal-impact.exe 46 PID 452 wrote to memory of 3796 452 unequal-impact.exe 46 PID 452 wrote to memory of 3796 452 unequal-impact.exe 46 PID 452 wrote to memory of 3796 452 unequal-impact.exe 46 PID 3796 wrote to memory of 3984 3796 net.exe 48 PID 3796 wrote to memory of 3984 3796 net.exe 48 PID 3796 wrote to memory of 3984 3796 net.exe 48 PID 3796 wrote to memory of 3984 3796 net.exe 48 PID 452 wrote to memory of 8168 452 unequal-impact.exe 51 PID 452 wrote to memory of 8168 452 unequal-impact.exe 51 PID 452 wrote to memory of 8168 452 unequal-impact.exe 51 PID 452 wrote to memory of 8168 452 unequal-impact.exe 51 PID 8168 wrote to memory of 7292 8168 net.exe 53 PID 8168 wrote to memory of 7292 8168 net.exe 53 PID 8168 wrote to memory of 7292 8168 net.exe 53 PID 8168 wrote to memory of 7292 8168 net.exe 53 PID 452 wrote to memory of 6352 452 unequal-impact.exe 54 PID 452 wrote to memory of 6352 452 unequal-impact.exe 54 PID 452 wrote to memory of 6352 452 unequal-impact.exe 54 PID 452 wrote to memory of 6352 452 unequal-impact.exe 54
Processes
-
C:\Users\Admin\AppData\Local\Temp\unequal-impact.exe"C:\Users\Admin\AppData\Local\Temp\unequal-impact.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:452 -
C:\Users\Admin\AppData\Local\Temp\FMmGpAvYHrep.exe"C:\Users\Admin\AppData\Local\Temp\FMmGpAvYHrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\ezdJSzoSSlan.exe"C:\Users\Admin\AppData\Local\Temp\ezdJSzoSSlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\xDlhaHqqllan.exe"C:\Users\Admin\AppData\Local\Temp\xDlhaHqqllan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:268
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2688
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2700
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3536
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3556 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3680
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3736 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3764
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3796 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3984
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:8168 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:7292
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:6352
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:7640
-
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /CREATE /NP /SC DAILY /TN "PrintkC" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\jjIVP.dll" /ST 10:25 /SD 04/28/2021 /ED 05/05/20212⤵
- Creates scheduled task(s)
PID:7996
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8848
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8876
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:8896
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:8924
-
-