Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
167s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe
Resource
win10v2004-en-20220113
General
-
Target
5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe
-
Size
150KB
-
MD5
e78cd758ff117ff26e2c333b484b03b1
-
SHA1
a477b3fc1c8f9c571e1dcfda0c84606fb7d34d93
-
SHA256
5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28
-
SHA512
a9bec103ecda3c0faca8868a46790787697d0c28ae849fb6857850a378c2812671ec3f2f96d4b9711d74cc3549e909bafb65ad82ab2bd86052f1d24b995e0708
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
1Kx9TT76PHwk8sw7Ur6PsMWyEtaogX7wWY
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" reg.exe -
Drops desktop.ini file(s) 4 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Program Files\desktop.ini taskhost.exe File opened for modification C:\Program Files\desktop.ini 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_altgr.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-next-static.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\title_trans_notes.wmv 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonIcon.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqloledb.rll.mui taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\pushplaysubpicture.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Content.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat taskhost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_glass.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_SelectionSubpicture.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\huemainsubpicture2.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\es-ES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\cs-CZ\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_heb.xml 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_item.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\7-Zip\Lang\mr.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureA.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-previous-static.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground.wmv 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\16_9-frame-overlay.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationLeft_ButtonGraphic.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\System\en-US\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\RyukReadMe.txt 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ea-sym.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Title_Page_Ref.wmv 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationUp_SelectionSubpicture.png 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\15x15dot.png taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1660 wrote to memory of 652 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 27 PID 1660 wrote to memory of 652 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 27 PID 1660 wrote to memory of 652 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 27 PID 1660 wrote to memory of 1220 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 8 PID 1660 wrote to memory of 1312 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 7 PID 1660 wrote to memory of 652 1660 5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe 27 PID 652 wrote to memory of 1468 652 cmd.exe 29 PID 652 wrote to memory of 1468 652 cmd.exe 29 PID 652 wrote to memory of 1468 652 cmd.exe 29
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1312
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
PID:1220
-
C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe"C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5e4160a133d44a1cf90d72eedd5e6084543521fecbf070d550c6012d294ccb28.exe" /f3⤵
- Adds Run key to start application
PID:1468
-
-