Analysis
-
max time kernel
145s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 02:10
Static task
static1
Behavioral task
behavioral1
Sample
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
Resource
win10-en-20211208
General
-
Target
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
-
Size
118KB
-
MD5
f3f5d30242ae83e62457845b4b874155
-
SHA1
4ff1007d56fd2a4d2fbad33278a72a8cc89a9c8c
-
SHA256
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8
-
SHA512
c7169d2ba271a81456cce290074e45a6e0646c6d2abe82b027688a76a675f6617b08408dbd234bb77f2ed2b973a55200e2a40e11403030830bdf01d7675f5682
Malware Config
Extracted
C:\01x7n11eo3-readme.txt
ryuk
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/CA0F81BABD219E86
http://decryptor.cc/CA0F81BABD219E86
https://filehippo.com/download_tor_browser_for_windows/
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies extensions of user files 5 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exedescription ioc process File renamed C:\Users\Admin\Pictures\DenyMerge.png => \??\c:\users\admin\pictures\DenyMerge.png.01x7n11eo3 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File renamed C:\Users\Admin\Pictures\EnterCheckpoint.raw => \??\c:\users\admin\pictures\EnterCheckpoint.raw.01x7n11eo3 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File renamed C:\Users\Admin\Pictures\NewRename.raw => \??\c:\users\admin\pictures\NewRename.raw.01x7n11eo3 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File renamed C:\Users\Admin\Pictures\RequestExport.tif => \??\c:\users\admin\pictures\RequestExport.tif.01x7n11eo3 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File renamed C:\Users\Admin\Pictures\UnblockConvertFrom.tif => \??\c:\users\admin\pictures\UnblockConvertFrom.tif.01x7n11eo3 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exedescription ioc process File opened (read-only) \??\J: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\K: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Q: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\R: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\X: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Z: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\B: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\F: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\T: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\U: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Y: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\A: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\L: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\M: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\N: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\O: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\P: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\V: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\E: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\G: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\S: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\W: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\H: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\I: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Drops file in Program Files directory 34 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exedescription ioc process File opened for modification \??\c:\program files\ConvertFromCompare.mpeg2 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\DebugSync.dwfx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ExitUninstall.3g2 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\GroupMount.wav 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ConvertApprove.rtf 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ReadDisable.eps 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\WatchStart.mp2v 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\LockUninstall.xls 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\RequestClear.dotx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SetSubmit.m4a 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\WaitMount.xlsx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\desktop\01x7n11eo3-readme.txt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ClearGrant.rm 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\NewPush.xltx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\UnblockRename.easmx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\WriteUpdate.TTS 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\v3.5\01x7n11eo3-readme.txt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\CloseNew.xlsb 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\DisconnectExit.tiff 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ExpandCopy.ppt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SearchRegister.eps 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SendJoin.wax 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\UnregisterInstall.xsl 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\CompareSync.wmv 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ExitResume.potm 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\MoveSearch.txt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\RequestSync.aif 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SubmitRepair.zip 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\BlockMerge.wav 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\GetCompare.pptx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SendGroup.xlsx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SyncDeny.tmp 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File created \??\c:\program files (x86)\microsoft sql server compact edition\01x7n11eo3-readme.txt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ConvertToShow.xlsb 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exepid process 1064 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exevssvc.exedescription pid process Token: SeDebugPrivilege 1064 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe Token: SeTakeOwnershipPrivilege 1064 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe Token: SeBackupPrivilege 1896 vssvc.exe Token: SeRestorePrivilege 1896 vssvc.exe Token: SeAuditPrivilege 1896 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1676
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1896