Analysis
-
max time kernel
210s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 08:45
Static task
static1
Behavioral task
behavioral1
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
Resource
win10v2004-en-20220113
General
-
Target
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe
-
Size
170KB
-
MD5
dd72a10cf4ee779c179d23ed6f4fdb01
-
SHA1
adc7691b97f34a9d55a3f7ca8a60e1c8756e3631
-
SHA256
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781
-
SHA512
e63d0a3a3bad2a0899d2e815ef2bf13b2e9c7fa5fcf79194b58438120d8096d894905c63ca4eeb1ebe0d47a6b1b5a085d0936445a8a00e34e07f22b494d4c41e
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
taskhost.exedescription ioc process File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Postage_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\San_Juan taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Mexico_City taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-utilities_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.model.workbench_1.1.0.v20140512-1820.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\security\US_export_policy.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Danmarkshavn taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.felix.gogo.command_0.10.0.v201209301215.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-modules-spi-actions.xml_hidden taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Puerto_Rico taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Chicago taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Baku taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\feature.properties taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-ui.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-ui_ja.jar taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\PassportMask_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\management\jmxremote.password.template taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Canary taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.zh_CN_5.5.0.165303.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring_ja.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Hermosillo taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\configuration\org.eclipse.update\platform.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-bootstrap.xml taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\ext\sunmscapi.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Matamoros taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-selector-api.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Bissau taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\Center taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\meta-index taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hebron taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_zh_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Whitehorse taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-core-multiview.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\deploy\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Argentina\La_Rioja taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Shorthand.emf taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationUp_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\SportsMainToScenesBackground.wmv taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jetty.util_8.1.14.v20131031.jar taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\jfr\profile.jfc taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Paramaribo taskhost.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\1047x576black.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\THIRDPARTYLICENSEREADME.txt taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\jvm.hprof.txt taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\fr-FR\RyukReadMe.txt taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_ButtonGraphic.png taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationUp_SelectionSubpicture.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.artifact.repository.prefs taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.widgets.nl_ja_4.4.0.v20140623020002.jar taskhost.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circleround_videoinset.png taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Lima taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\RyukReadMe.txt taskhost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exepid process 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exedescription pid process Token: SeDebugPrivilege 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.execmd.exedescription pid process target process PID 1000 wrote to memory of 1632 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe cmd.exe PID 1000 wrote to memory of 1632 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe cmd.exe PID 1000 wrote to memory of 1632 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe cmd.exe PID 1000 wrote to memory of 1116 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe taskhost.exe PID 1632 wrote to memory of 1280 1632 cmd.exe reg.exe PID 1632 wrote to memory of 1280 1632 cmd.exe reg.exe PID 1632 wrote to memory of 1280 1632 cmd.exe reg.exe PID 1000 wrote to memory of 1172 1000 30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe Dwm.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Program Files directory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe"C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\30f62448ef138b7f9ed3662205421a97d15f5ffb36eae1a81e8c56053b128781.exe" /f3⤵
- Adds Run key to start application