Analysis
-
max time kernel
165s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe
-
Size
152KB
-
MD5
40492c178079e65dfd5449bf899413b6
-
SHA1
f3fa5d5942e5085586d7fcc496d3fad7804abcc2
-
SHA256
fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b
-
SHA512
986881496dcdfefc0b0cd20e2f0700368caec03a4f93889b5d3b8d345bffb0562c5d3e8584b96443e5e83eb3844d8f0851299986cb8c8b1c0b51e5e1970cf67a
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation.
More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder.
No decryption software is available in the public.
Antiviruse companies, researchers, IT specialists, and no other persons cant help you encrypt the data.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT DELETE readme files.
To confirm our honest intentions.Send 2 different random files and you will get it decrypted.
It can be from different computers on your network to be sure that one key decrypts everything.
2 files we unlock for free
To get info (decrypt your files) contact us at
[email protected]
or
[email protected]
You will receive btc address for payment in the reply letter
Ryuk
No system is safe
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1620 fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1620 fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe Token: SeBackupPrivilege 1124 taskhost.exe Token: SeBackupPrivilege 1620 fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 1620 wrote to memory of 1124 1620 fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe 16 PID 1620 wrote to memory of 1212 1620 fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe 15
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1212
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:1124
-
C:\Users\Admin\AppData\Local\Temp\fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe"C:\Users\Admin\AppData\Local\Temp\fe909d18cf0fde089594689f9a69fbc6d57b69291a09f3b9df1e9b1fb724222b.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1620