Analysis
-
max time kernel
166s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
24-01-2022 02:10
Static task
static1
Behavioral task
behavioral1
Sample
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
Resource
win10-en-20211208
General
-
Target
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe
-
Size
118KB
-
MD5
f3f5d30242ae83e62457845b4b874155
-
SHA1
4ff1007d56fd2a4d2fbad33278a72a8cc89a9c8c
-
SHA256
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8
-
SHA512
c7169d2ba271a81456cce290074e45a6e0646c6d2abe82b027688a76a675f6617b08408dbd234bb77f2ed2b973a55200e2a40e11403030830bdf01d7675f5682
Malware Config
Extracted
C:\1375724bn-readme.txt
ryuk
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/B27A10886534E466
http://decryptor.cc/B27A10886534E466
https://filehippo.com/download_tor_browser_for_windows/
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exedescription ioc process File opened (read-only) \??\G: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\I: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\K: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\N: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\P: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\S: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\E: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\F: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Z: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\M: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\T: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\U: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Y: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\B: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\J: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\R: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\V: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\H: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\L: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\Q: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\W: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\X: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\A: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened (read-only) \??\O: 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Drops file in Program Files directory 30 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exedescription ioc process File opened for modification \??\c:\program files\UnlockMount.TTS 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\DebugRestore.DVR 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\NewSearch.M2V 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SkipBackup.jpg 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SubmitStop.php 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\RenameConvert.png 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SendInvoke.inf 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\UpdateRestore.rm 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ConnectUnlock.temp 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\FindTest.ps1xml 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\PingImport.js 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ReadStep.inf 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SetSearch.rtf 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\UpdateLock.xml 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ConnectRevoke.emz 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SearchWatch.mov 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\WatchResize.ini 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\DisconnectSplit.jpe 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\OptimizeSplit.jtx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SelectConvert.vbe 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\CheckpointOut.emz 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\ClearConvertFrom.aif 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\FindDisable.avi 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\StopEnable.xltx 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\TraceInitialize.vb 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\UnpublishWrite.xlsb 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\CheckpointWatch.midi 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\MoveUnlock.ods 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\RequestConvertFrom.vdw 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe File opened for modification \??\c:\program files\SearchEdit.xlt 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exepid process 2464 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe 2464 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exevssvc.exedescription pid process Token: SeDebugPrivilege 2464 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe Token: SeTakeOwnershipPrivilege 2464 46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe Token: SeBackupPrivilege 956 vssvc.exe Token: SeRestorePrivilege 956 vssvc.exe Token: SeAuditPrivilege 956 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"C:\Users\Admin\AppData\Local\Temp\46fa5e8d0b26f4f94aa0d84610beb7c619216590ec3c7072885421c9a316f6d8.exe"1⤵
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2464
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:1180
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:956