Analysis
-
max time kernel
176s -
max time network
37s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 08:30
Static task
static1
Behavioral task
behavioral1
Sample
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe
Resource
win10v2004-en-20220113
General
-
Target
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe
-
Size
170KB
-
MD5
00f926cd4948652e3a80c3994e4ec8be
-
SHA1
61bf4f8d8f9826b70bf730d4f84a584ee199325f
-
SHA256
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c
-
SHA512
d53edde17520f1512aa84dc1bf9d93c456c9cd037edb69c7f34dbbb4d9cad6a952b3a883c518ae70959b7285c930bd7b96b4939156e3e996ce2fad1a8d3fb51b
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
taskhost.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\ffjcext.zip taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk_1.0.300.v20140407-1803.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Samarkand taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vienna taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\delete.avi taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\indxicon.gif taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.text.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-javahelp_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\soniccolorconverter.ax taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setNetworkServerCP taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-compat.xml taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Scoresbysund taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Santarem taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_rtl.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Los_Angeles taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\jvm.lib taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\invalid32x32.gif taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml taskhost.exe File opened for modification C:\Program Files\Microsoft Games\Chess\ja-JP\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Bissau taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-editor-mimelookup.jar taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Wrinkled_Paper.gif taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-output2.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Gaza taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\core\locale\org-openide-filesystems_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-openide-nodes.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kamchatka taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\TextConv\de-DE\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Apia taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Berlin taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\1047x576black.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp_5.5.0.165303\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaBrightDemiItalic.ttf taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Athens taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_LOOP_BG.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Dili taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Vienna taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4-dark_mac.css taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-openide-options.xml taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Kabul taskhost.exe File opened for modification C:\Program Files\Java\jre7\bin\plugin2\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exepid process 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exedescription pid process Token: SeDebugPrivilege 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.execmd.exedescription pid process target process PID 1364 wrote to memory of 676 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe cmd.exe PID 1364 wrote to memory of 676 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe cmd.exe PID 1364 wrote to memory of 676 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe cmd.exe PID 1364 wrote to memory of 1144 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe taskhost.exe PID 1364 wrote to memory of 1236 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe Dwm.exe PID 1364 wrote to memory of 676 1364 094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe cmd.exe PID 676 wrote to memory of 1504 676 cmd.exe reg.exe PID 676 wrote to memory of 1504 676 cmd.exe reg.exe PID 676 wrote to memory of 1504 676 cmd.exe reg.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe"C:\Users\Admin\AppData\Local\Temp\094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\094e91e2ae1cdd89fe7aaf9053e042cabcdb6eaf27789dd331802c08ae29fd1c.exe" /f3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/676-60-0x000000013F840000-0x000000013FBCE000-memory.dmpFilesize
3.6MB
-
memory/1144-55-0x000000013F840000-0x000000013FBCE000-memory.dmpFilesize
3.6MB
-
memory/1144-56-0x000000013F840000-0x000000013FBCE000-memory.dmpFilesize
3.6MB
-
memory/1236-59-0x000000013F840000-0x000000013FBCE000-memory.dmpFilesize
3.6MB
-
memory/1364-54-0x000007FEFC3C1000-0x000007FEFC3C3000-memory.dmpFilesize
8KB