Analysis
-
max time kernel
178s -
max time network
26s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 08:21
Static task
static1
Behavioral task
behavioral1
Sample
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe
Resource
win10v2004-en-20220113
General
-
Target
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe
-
Size
385KB
-
MD5
ab9efa39a5aecf383c095401c1b6c658
-
SHA1
f72409d3048d4c62cc12ceee280750f44e7eb3fc
-
SHA256
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794
-
SHA512
f4ff7547104c9de4c018daa36e7d60612691c4e07573a2bfe7fdf7dbdad9380251dad76a44a97d4c1eb81c1cc4584ce8c41888c892cd4b947061b5fc90964bb2
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
PiSpf.exepid process 1152 PiSpf.exe -
Deletes itself 1 IoCs
Processes:
PiSpf.exepid process 1152 PiSpf.exe -
Loads dropped DLL 1 IoCs
Processes:
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exepid process 524 3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\users\\Public\\PiSpf.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
taskhost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-search.jar taskhost.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\mc.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.equinox.simpleconfigurator\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\ja-jp.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\da-DK\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_ja.jar taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\de\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Australia\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\ja-JP\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Montreal taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.rcp.zh_CN_5.5.0.165303\feature.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\help.gif taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-settings.xml taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\trusted.libraries taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-7 taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\javafx.policy taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.attach_5.5.0.165303.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.net.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaSansRegular.ttf taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-ui.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Antarctica\Davis taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hong_Kong taskhost.exe File opened for modification C:\Program Files\Microsoft Games\SpiderSolitaire\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-charts.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Anadyr taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.databinding.observable.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\notes-static.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hr-HR\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.net.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core_zh_CN.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\feature.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-spi-quicksearch.xml taskhost.exe File opened for modification C:\Program Files\Microsoft Games\Hearts\HeartsMCE.png taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\profileRegistry\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-api-caching.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.natives.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Kwajalein taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
PiSpf.exepid process 1152 PiSpf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
PiSpf.exedescription pid process Token: SeDebugPrivilege 1152 PiSpf.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exePiSpf.execmd.exedescription pid process target process PID 524 wrote to memory of 1152 524 3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe PiSpf.exe PID 524 wrote to memory of 1152 524 3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe PiSpf.exe PID 524 wrote to memory of 1152 524 3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe PiSpf.exe PID 524 wrote to memory of 1152 524 3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe PiSpf.exe PID 1152 wrote to memory of 1676 1152 PiSpf.exe cmd.exe PID 1152 wrote to memory of 1676 1152 PiSpf.exe cmd.exe PID 1152 wrote to memory of 1676 1152 PiSpf.exe cmd.exe PID 1152 wrote to memory of 1248 1152 PiSpf.exe taskhost.exe PID 1152 wrote to memory of 1356 1152 PiSpf.exe Dwm.exe PID 1676 wrote to memory of 1120 1676 cmd.exe reg.exe PID 1676 wrote to memory of 1120 1676 cmd.exe reg.exe PID 1676 wrote to memory of 1120 1676 cmd.exe reg.exe PID 1152 wrote to memory of 1676 1152 PiSpf.exe cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe"C:\Users\Admin\AppData\Local\Temp\3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\users\Public\PiSpf.exe"C:\users\Public\PiSpf.exe" C:\Users\Admin\AppData\Local\Temp\3af6d8ae486dc533fdbb81ca77b33765b9652d173c490862b9b7ea9d42f46794.exe2⤵
- Executes dropped EXE
- Deletes itself
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\PiSpf.exe" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\PiSpf.exe" /f4⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\PiSpf.exeMD5
31bd0f224e7e74eee2847f43aae23974
SHA192e331e1e8ad30538f38dd7ba31386afafa14a58
SHA2568b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d
SHA512a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249
-
\Users\Public\PiSpf.exeMD5
31bd0f224e7e74eee2847f43aae23974
SHA192e331e1e8ad30538f38dd7ba31386afafa14a58
SHA2568b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d
SHA512a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249
-
memory/524-54-0x0000000074F01000-0x0000000074F03000-memory.dmpFilesize
8KB
-
memory/1152-57-0x000007FEFB7E1000-0x000007FEFB7E3000-memory.dmpFilesize
8KB
-
memory/1248-58-0x000000013FD40000-0x00000001400CE000-memory.dmpFilesize
3.6MB
-
memory/1248-62-0x000000013FD40000-0x00000001400CE000-memory.dmpFilesize
3.6MB
-
memory/1676-61-0x000000013FD40000-0x00000001400CE000-memory.dmpFilesize
3.6MB