Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
178s -
max time network
145s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 09:18
Static task
static1
Behavioral task
behavioral1
Sample
23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe
Resource
win10v2004-en-20220112
General
-
Target
23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe
-
Size
150KB
-
MD5
b490d304dae26ddc3af849ec4a820abd
-
SHA1
1a66f0ade41ae203217177c1be1cea0017d33aec
-
SHA256
23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c
-
SHA512
6a849674fbc350f4f5ebefb5ee39483b5cdac93e3b81c5b5c098ad6a78bbcaafa27de668a31bb227a91407ea01712776405cb7c8b16fc3633c53a4def088d809
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
1FRNVupsCyTjUvF36GxHZrvLaPtY6hgkTm
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_travel_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\scene_button_style_default_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Soft Blue.htm taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\osknumpadbase.xml taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-image-mask.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrfrash.dat taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pine_Lumber.jpg taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenalm.dat taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_VideoInset.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialoccasion.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP.bat taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Johannesburg taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationUp_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-back-static.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_performance_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VC\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop_PAL.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground_PAL.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\NavigationRight_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\vistabg.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsfra.xml taskhost.exe File opened for modification C:\Program Files\Common Files\System\msadc\handsafe.reg taskhost.exe File opened for modification C:\Program Files\DVD Maker\directshowtap.ax taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\shatter.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\mainscroll.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\dblook.bat taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\snmp.acl.template taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\Common.fxh taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\audiodepthconverter.ax taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\4to3Squareframe_Buttongraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop_PAL.wmv taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_buttongraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_plain_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbynet.jar taskhost.exe File opened for modification C:\Program Files\Common Files\System\ado\msado25.tlb taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-next-static.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\203x8subpicture.png taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Month_Calendar.emf taskhost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Notes_btn-back-static.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\1047x576black.png taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 956 wrote to memory of 900 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 27 PID 956 wrote to memory of 900 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 27 PID 956 wrote to memory of 900 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 27 PID 956 wrote to memory of 1252 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 17 PID 956 wrote to memory of 1360 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 16 PID 956 wrote to memory of 900 956 23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe 27 PID 900 wrote to memory of 540 900 cmd.exe 29 PID 900 wrote to memory of 540 900 cmd.exe 29 PID 900 wrote to memory of 540 900 cmd.exe 29
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1360
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
PID:1252
-
C:\Users\Admin\AppData\Local\Temp\23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe"C:\Users\Admin\AppData\Local\Temp\23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:956 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:900 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\23bc676a012c7fda532cbfc0d41ecd0bdda9b1cdd261e2923a03a7303bc1f33c.exe" /f3⤵
- Adds Run key to start application
PID:540
-
-