Analysis
-
max time kernel
153s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 01:34
Static task
static1
Behavioral task
behavioral1
Sample
93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe
Resource
win10-en-20211208
General
-
Target
93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe
-
Size
122KB
-
MD5
6d5e018e9de53f8c7e5020103292cb99
-
SHA1
47cd7b8ffc9015eb7b9b143d10c2c0f119164ce6
-
SHA256
93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3
-
SHA512
636f4d8ffb65a71069177d0e5cbb583a53eaa304222340e4f0d57ab88d2645f02e44c6bcdae629bf99a57ff66dea8291f9a7f5d3845aba44ef88e506f5c74fc4
Malware Config
Extracted
C:\y720983ua3-readme.txt
ryuk
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/E484F7682B03FDF6
http://decoder.re/E484F7682B03FDF6
https://filehippo.com/download_tor_browser_for_windows/
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies Windows Firewall 1 TTPs
-
Modifies extensions of user files 2 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\GetOut.png => \??\c:\users\admin\pictures\GetOut.png.y720983ua3 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File renamed C:\Users\Admin\Pictures\MeasureEnter.raw => \??\c:\users\admin\pictures\MeasureEnter.raw.y720983ua3 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe -
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\L: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\N: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\O: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\Q: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\S: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\A: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\H: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\I: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\P: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\Z: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\E: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\K: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\M: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\W: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\X: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\J: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\U: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\V: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\R: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\T: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\Y: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\D: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\B: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\F: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened (read-only) \??\G: 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe -
Drops file in Program Files directory 38 IoCs
description ioc Process File opened for modification \??\c:\program files\ConvertFromInvoke.vstm 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\LockClose.xls 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\RestartConvertFrom.search-ms 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\SplitInitialize.aifc 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\UnblockStop.mpeg2 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\EnableReceive.mpv2 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\HideClear.aif 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\RedoStop.M2TS 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\ResetDebug.xps 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\SelectComplete.rtf 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\CompressTrace.vssx 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\EnterTest.mpv2 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\InstallGroup.crw 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\MountEdit.easmx 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\ClearOut.docm 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\RedoExport.ADTS 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File created \??\c:\program files\tmp 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File created \??\c:\program files\y720983ua3-readme.txt 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\ApproveUnregister.xps 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\ExpandLock.bmp 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\PingExit.mpeg 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\SelectSearch.ppt 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\StepRequest.wma 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\UnlockProtect.js 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File created \??\c:\program files (x86)\tmp 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File created \??\c:\program files (x86)\y720983ua3-readme.txt 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\JoinBlock.xlsb 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\NewSave.jpe 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\DisableResolve.mp3 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\SaveSwitch.dwfx 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\SwitchMerge.mht 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\PushRestart.js 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\RemoveDisconnect.dib 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\RepairConnect.au 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\CloseRepair.odp 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\FormatRequest.zip 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\LimitUse.dwg 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe File opened for modification \??\c:\program files\PublishReset.mpg 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe -
Drops file in Windows directory 13 IoCs
description ioc Process File created C:\Windows\rescache\_merged\1476457207\3533431084.pri netsh.exe File created C:\Windows\rescache\_merged\2878165772\1123312451.pri netsh.exe File created C:\Windows\rescache\_merged\423379043\3468251582.pri netsh.exe File created C:\Windows\rescache\_merged\81479705\3092222186.pri netsh.exe File created C:\Windows\rescache\_merged\2483382631\828754195.pri netsh.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri netsh.exe File created C:\Windows\rescache\_merged\1974107395\4149693858.pri netsh.exe File created C:\Windows\rescache\_merged\1301087654\4010849688.pri netsh.exe File created C:\Windows\rescache\_merged\3418783148\3128450559.pri netsh.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri netsh.exe File created C:\Windows\rescache\_merged\4185669309\1202008662.pri netsh.exe File created C:\Windows\rescache\_merged\3623239459\11870838.pri netsh.exe File created C:\Windows\rescache\_merged\4272278488\30062976.pri netsh.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
pid Process 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe Token: SeTakeOwnershipPrivilege 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe Token: SeBackupPrivilege 2608 vssvc.exe Token: SeRestorePrivilege 2608 vssvc.exe Token: SeAuditPrivilege 2608 vssvc.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1628 wrote to memory of 4092 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 68 PID 1628 wrote to memory of 4092 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 68 PID 1628 wrote to memory of 4092 1628 93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe 68
Processes
-
C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe"C:\Users\Admin\AppData\Local\Temp\93536a7a4871779f94f765be681af52a33830c50eebad7fedf33c2e921fce3d3.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Drops file in Windows directory
PID:4092
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:4032
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2608