Analysis
-
max time kernel
128s -
max time network
158s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 01:28
Static task
static1
Behavioral task
behavioral1
Sample
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe
Resource
win10-en-20211208
General
-
Target
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe
-
Size
117KB
-
MD5
db9c42ae065b906bd4c3d3ca3eebf3a8
-
SHA1
e4eb7de6f678f95a2fe41cab237507136a4e9ce3
-
SHA256
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e
-
SHA512
7bba3974182da431e4f7f0adc0f891b1a1c3efe65df1c68a96d4c4b97541b3661fb71eb2addc001b70a61d318e6ee22d103428cd83235d95fc8a039741849ca5
Malware Config
Extracted
C:\m63fy-readme.txt
ryuk
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/A7C8D97C76B4B85E
http://decryptor.cc/A7C8D97C76B4B85E
https://filehippo.com/download_tor_browser_for_windows/
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exedescription ioc process File renamed C:\Users\Admin\Pictures\ProtectDeny.raw => \??\c:\users\admin\pictures\ProtectDeny.raw.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\ReadSwitch.crw => \??\c:\users\admin\pictures\ReadSwitch.crw.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\UninstallExpand.tif => \??\c:\users\admin\pictures\UninstallExpand.tif.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\users\admin\pictures\InvokeExit.tiff 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\ConvertFromRename.png => \??\c:\users\admin\pictures\ConvertFromRename.png.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\ConvertStop.raw => \??\c:\users\admin\pictures\ConvertStop.raw.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\DisconnectUpdate.raw => \??\c:\users\admin\pictures\DisconnectUpdate.raw.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File renamed C:\Users\Admin\Pictures\InvokeExit.tiff => \??\c:\users\admin\pictures\InvokeExit.tiff.m63fy 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exedescription ioc process File opened (read-only) \??\B: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\L: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\M: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\S: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\T: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\H: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\P: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\Q: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\W: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\X: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\D: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\E: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\G: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\K: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\N: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\O: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\U: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\Y: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\Z: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\A: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\F: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\I: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\J: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\R: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened (read-only) \??\V: 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Drops file in System32 directory 1 IoCs
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exedescription ioc process File opened for modification C:\Windows\System32\CatRoot2\dberr.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\489u6.bmp" 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Drops file in Program Files directory 23 IoCs
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exedescription ioc process File opened for modification \??\c:\program files\PingHide.xltm 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\UnregisterBlock.pub 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\WriteUnpublish.cr2 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File created \??\c:\program files\m63fy-readme.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\CompressAssert.iso 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\DisableSearch.3gpp 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\DisconnectGrant.ttf 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\InstallConvertFrom.mp4v 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\SubmitWatch.vdx 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\m63fy-readme.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File created \??\c:\program files (x86)\m63fy-readme.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\AssertUse.tif 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\PushOpen.3gp2 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\PushTrace.gif 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\SaveExpand.wpl 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\m63fy-readme.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\m63fy-readme.txt 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\DisableRequest.cr2 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\FindRemove.vdx 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\MergeUnlock.nfo 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\SwitchStep.scf 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\UpdateFind.dwfx 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe File opened for modification \??\c:\program files\ReadPop.doc 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exepid process 1452 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe 1452 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exevssvc.exedescription pid process Token: SeDebugPrivilege 1452 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe Token: SeTakeOwnershipPrivilege 1452 9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe Token: SeBackupPrivilege 1988 vssvc.exe Token: SeRestorePrivilege 1988 vssvc.exe Token: SeAuditPrivilege 1988 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe"C:\Users\Admin\AppData\Local\Temp\9e0e558814feed54ba998b6f8ed57b6ed6a540745138bd0954b67a830119ac2e.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in System32 directory
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1452
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:576
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1988