Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

ff90b93b8b...a2.exe

windows7_x64

10

ff90b93b8b...a2.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    131s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    19/02/2022, 23:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2.exe

  • Size

    114KB

  • MD5

    a9b7b3af239126f1ec4e1549076b6f6a

  • SHA1

    d26ae4e7aac4529370583bb9e401152746d88a41

  • SHA256

    ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2

  • SHA512

    572587a2a5ef1fb275c9059e32191399780311dac2d064a211303f87a768c1acdc903a8d966723ff9b2375ec31a985a55f3623a2631d4dcf83d564e6eb7280ce

Score
10/10
ryukdiscoverypersistenceransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] balance of shadow universe Ryuk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

    ransomware
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 6 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Interacts with shadow copies 2 TTPs 1 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

    ransomware
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 40 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1348
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
        PID:1224
      • C:\Users\Admin\AppData\Local\Temp\ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2.exe
        "C:\Users\Admin\AppData\Local\Temp\ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2.exe"
        1⤵
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of WriteProcessMemory
        PID:1620
        • C:\Users\Admin\AppData\Local\Temp\XaeZJwIEalan.exe
          "C:\Users\Admin\AppData\Local\Temp\XaeZJwIEalan.exe" 8 LAN
          2⤵
          • Executes dropped EXE
          PID:460
        • C:\Users\Admin\AppData\Local\Temp\HQxuGcGkelan.exe
          "C:\Users\Admin\AppData\Local\Temp\HQxuGcGkelan.exe" 8 LAN
          2⤵
          • Executes dropped EXE
          PID:1308
        • C:\Users\Admin\AppData\Local\Temp\cfdGvSuZOlan.exe
          "C:\Users\Admin\AppData\Local\Temp\cfdGvSuZOlan.exe" 8 LAN
          2⤵
          • Executes dropped EXE
          PID:1476
        • C:\Windows\SysWOW64\SCHTASKS.exe
          SCHTASKS /CREATE /NP /SC DAILY /TN "PrintZ0" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\7MUMg.dll" /ST 10:25 /SD 02/21/2022 /ED 02/28/2022
          2⤵
          • Creates scheduled task(s)
          PID:964
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "WMIC.exe shadowcopy delete"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:664
          • C:\Windows\SysWOW64\Wbem\WMIC.exe
            WMIC.exe shadowcopy delete
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:1948
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "vssadmin.exe Delete Shadows /all /quiet"
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:1832
          • C:\Windows\SysWOW64\vssadmin.exe
            vssadmin.exe Delete Shadows /all /quiet
            3⤵
            • Interacts with shadow copies
            PID:1900
        • C:\Windows\SysWOW64\cmd.exe
          cmd.exe /c "bcdedit /set {default} recoveryenabled No & bcdedit /set {default}"
          2⤵
            PID:1060
          • C:\Windows\SysWOW64\cmd.exe
            cmd.exe /c "bootstatuspolicy ignoreallfailures"
            2⤵
              PID:812
            • C:\Windows\SysWOW64\icacls.exe
              icacls "C:\*" /grant Everyone:F /T /C /Q
              2⤵
              • Modifies file permissions
              PID:1500
            • C:\Windows\SysWOW64\icacls.exe
              icacls "D:\*" /grant Everyone:F /T /C /Q
              2⤵
              • Modifies file permissions
              PID:1552
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "￾C:\Users\Admin\AppData\Local\Temp\ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2.exe" /f /reg:64
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:1544
              • C:\Windows\SysWOW64\reg.exe
                REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "￾C:\Users\Admin\AppData\Local\Temp\ff90b93b8b79c8fb881b489263d53dd69dd5b98211507a2956885d7c71e086a2.exe" /f /reg:64
                3⤵
                • Adds Run key to start application
                PID:1744
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
              2⤵
                PID:984
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                  3⤵
                    PID:1504
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                  2⤵
                    PID:1544
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                      3⤵
                        PID:604
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop "samss" /y
                      2⤵
                        PID:612
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop "samss" /y
                          3⤵
                            PID:1956
                        • C:\Windows\SysWOW64\net.exe
                          "C:\Windows\System32\net.exe" stop "samss" /y
                          2⤵
                            PID:1172
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "samss" /y
                              3⤵
                                PID:1256
                          • C:\Windows\system32\vssvc.exe
                            C:\Windows\system32\vssvc.exe
                            1⤵
                              PID:1316

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/1224-65-0x0000000035000000-0x000000003515D000-memory.dmp

                              Filesize

                              1.4MB

                              Download

                            • memory/1620-55-0x0000000076641000-0x0000000076643000-memory.dmp

                              Filesize

                              8KB

                              Download