Analysis
-
max time kernel
175s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 08:17
Static task
static1
Behavioral task
behavioral1
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
-
Size
219KB
-
MD5
c4d162f04eb0464adc841390f42431ed
-
SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045
-
SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
-
SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
Family
ryuk
Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������
Emails
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
Family
ryuk
Ransom Note
[email protected]
balance of shadow universe
Ryuk
Emails
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
pid Process 1392 FOABCWP.exe -
Loads dropped DLL 2 IoCs
pid Process 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe Token: SeBackupPrivilege 1392 FOABCWP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 27 PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 27 PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 27 PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 27 PID 1392 wrote to memory of 2072 1392 FOABCWP.exe 28 PID 1392 wrote to memory of 2072 1392 FOABCWP.exe 28 PID 1392 wrote to memory of 2072 1392 FOABCWP.exe 28 PID 1392 wrote to memory of 2072 1392 FOABCWP.exe 28 PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 29 PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 29 PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 29 PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 29 PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 31 PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 31 PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 31 PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 31 PID 1392 wrote to memory of 2184 1392 FOABCWP.exe 36 PID 1392 wrote to memory of 2184 1392 FOABCWP.exe 36 PID 1392 wrote to memory of 2184 1392 FOABCWP.exe 36 PID 1392 wrote to memory of 2184 1392 FOABCWP.exe 36 PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 35 PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 35 PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 35 PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 35 PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 39 PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 39 PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 39 PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 39 PID 2072 wrote to memory of 2388 2072 net.exe 42 PID 2072 wrote to memory of 2388 2072 net.exe 42 PID 2072 wrote to memory of 2388 2072 net.exe 42 PID 2072 wrote to memory of 2388 2072 net.exe 42 PID 2264 wrote to memory of 2404 2264 net.exe 46 PID 2264 wrote to memory of 2404 2264 net.exe 46 PID 2264 wrote to memory of 2404 2264 net.exe 46 PID 2264 wrote to memory of 2404 2264 net.exe 46 PID 2184 wrote to memory of 2396 2184 net.exe 44 PID 2184 wrote to memory of 2396 2184 net.exe 44 PID 2184 wrote to memory of 2396 2184 net.exe 44 PID 2184 wrote to memory of 2396 2184 net.exe 44 PID 2080 wrote to memory of 2380 2080 net.exe 43 PID 2080 wrote to memory of 2380 2080 net.exe 43 PID 2080 wrote to memory of 2380 2080 net.exe 43 PID 2080 wrote to memory of 2380 2080 net.exe 43 PID 2196 wrote to memory of 2372 2196 net.exe 45 PID 2196 wrote to memory of 2372 2196 net.exe 45 PID 2196 wrote to memory of 2372 2196 net.exe 45 PID 2196 wrote to memory of 2372 2196 net.exe 45 PID 2144 wrote to memory of 2412 2144 net.exe 47 PID 2144 wrote to memory of 2412 2144 net.exe 47 PID 2144 wrote to memory of 2412 2144 net.exe 47 PID 2144 wrote to memory of 2412 2144 net.exe 47 PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 48 PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 48 PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 48 PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 48 PID 1392 wrote to memory of 36808 1392 FOABCWP.exe 49 PID 1392 wrote to memory of 36808 1392 FOABCWP.exe 49 PID 1392 wrote to memory of 36808 1392 FOABCWP.exe 49 PID 1392 wrote to memory of 36808 1392 FOABCWP.exe 49 PID 36800 wrote to memory of 36848 36800 net.exe 52 PID 36800 wrote to memory of 36848 36800 net.exe 52 PID 36800 wrote to memory of 36848 36800 net.exe 52 PID 36800 wrote to memory of 36848 36800 net.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe"C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵PID:2388
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:2184 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:2396
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵PID:36808
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:36856
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2380
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2412
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2372
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2404
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:36800 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:36848
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:35844
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:35868
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:53176
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:53068
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:52744
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:52736
-
-