Analysis
-
max time kernel
171s -
max time network
142s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 07:47
Static task
static1
Behavioral task
behavioral1
Sample
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe
Resource
win10v2004-en-20220112
General
-
Target
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe
-
Size
170KB
-
MD5
552ad0a68c4a1fe2ff797269dd0a577c
-
SHA1
bd88287ed069606d736603432099a687dd556942
-
SHA256
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642
-
SHA512
7e064b91d5cb4fa0c66d5ab8d4df936580faa42fe9e477e51b8f341d7e37c0c0465de9700a6f8b0b22ea05c556a62d6c572f58fdead790be05fbdf97a92827c0
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
taskhost.exedescription ioc process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SceneButtonInset_Alpha1.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\Filters.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\auxpad.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruklm.dat taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_notes-txt-background.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\descript.ion taskhost.exe File opened for modification C:\Program Files\7-Zip\readme.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_leftarrow.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain_PAL.wmv taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tiki.gif taskhost.exe File opened for modification C:\Program Files\DismountSkip.js taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationRight_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsjpn.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\Parity.fx taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\keypad.xml taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado27.tlb taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\NextMenuButtonIcon.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\720x480blacksquare.png taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipskor.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\VSTOInstaller.config taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\travel.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\sonicsptransform.ax taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\decorative_rule.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\numbase.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\shadowonlyframe_selectionsubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\ParentMenuButtonIcon.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat taskhost.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_content-background.png taskhost.exe File opened for modification C:\Program Files\7-Zip\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_ca.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipssrb.xml taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-imageMask.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-highlight.png taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exepid process 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exedescription pid process Token: SeDebugPrivilege 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.execmd.exedescription pid process target process PID 612 wrote to memory of 1720 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe cmd.exe PID 612 wrote to memory of 1720 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe cmd.exe PID 612 wrote to memory of 1720 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe cmd.exe PID 612 wrote to memory of 1256 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe taskhost.exe PID 612 wrote to memory of 1344 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe Dwm.exe PID 612 wrote to memory of 1720 612 47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe cmd.exe PID 1720 wrote to memory of 1408 1720 cmd.exe reg.exe PID 1720 wrote to memory of 1408 1720 cmd.exe reg.exe PID 1720 wrote to memory of 1408 1720 cmd.exe reg.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe"C:\Users\Admin\AppData\Local\Temp\47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\47618ca96047204dadb4207f4c7f304687ae4164a13d54e2f9805279e58b1642.exe" /f3⤵
- Adds Run key to start application