Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
161s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 00:20
Static task
static1
Behavioral task
behavioral1
Sample
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
Resource
win10v2004-en-20220113
General
-
Target
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe
-
Size
151KB
-
MD5
a0a2c05256ee2727a2dfade4dc7544d6
-
SHA1
fba2fbb09c96de73c903ab40894225cc235bdcfe
-
SHA256
f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421
-
SHA512
48c10e276f2455a29b352db81e72fa1b7bbbe3ef46e8998e1e44900e97cc3fa5682e424fbb0680594dcc45b2003c20bae15fc46f2822001d7669d7b1b7335ddf
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
1ET85GTps8eFbgF1MvVhFVZQeNp2a6LeGw
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui.ja_5.5.0.165303.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-util-lookup.xml taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\Lindeman taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Dotted_Lines.emf taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\sysinfo taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-keyring.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-sampler.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-attach_ja.jar taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein taskhost.exe File opened for modification C:\Program Files\Microsoft Games\More Games\de-DE\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Indian\Kerguelen taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.components.ui.ja_5.5.0.165303.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Khandyga taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml taskhost.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\en-US\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-templates.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-loaders.xml taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Rainy_River taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\GMT+1 taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\dicjp.bin taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-options-keymap_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Mendoza taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.contenttype_3.4.200.v20140207-1251.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.css.core_0.10.100.v20140424-2042.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\.lastModified taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Internet Explorer\ja-JP\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Microsoft Games\Minesweeper\ja-JP\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\EST taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.filetransfer_5.0.0.v20140827-1444.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.win32.win32.x86_64_1.1.200.v20141007-2033\launcher.win32.win32.x86_64.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-tools.xml taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Inuvik taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\HST taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Prague taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_kor.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-snaptracer.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\plugin.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-io-ui.xml taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\win32\bridge\AccessBridgePackages.h taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.feature_3.9.1.v20140827-1444\META-INF\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-core-windows.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-io-ui.jar taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1888 wrote to memory of 1224 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 27 PID 1888 wrote to memory of 1224 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 27 PID 1888 wrote to memory of 1224 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 27 PID 1888 wrote to memory of 1140 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 18 PID 1224 wrote to memory of 544 1224 cmd.exe 29 PID 1224 wrote to memory of 544 1224 cmd.exe 29 PID 1224 wrote to memory of 544 1224 cmd.exe 29 PID 1888 wrote to memory of 1252 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 17 PID 1888 wrote to memory of 1224 1888 f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe 27
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1252
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
PID:1140
-
C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe"C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f48c52b820c7ec36afb411dc052d83ced667db46d5b9b729748e73fb70cb1421.exe" /f3⤵
- Adds Run key to start application
PID:544
-
-