Analysis
-
max time kernel
168s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 10:02
Static task
static1
Behavioral task
behavioral1
Sample
13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe
-
Size
153KB
-
MD5
71d5ee75766497e2c37b20503cf02f53
-
SHA1
d78c955173c447cb79fb559de122563d90d5358d
-
SHA256
13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6
-
SHA512
c365d9dd353a326814dce42cbbaf7c159b605725365dd99efcd3870ff2af31d908bc534a43e2c3c8849808736183f9bb2fbd83785bc3e42123e5847004a5f6eb
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each network host have been encrypted with a strong algorithm.
Backups were encrypted too.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
Only we have exclusive decryption software, suitable for your situation.
More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder.
No decryption software is available in the public.
Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data.
Decryption takes from ten minutes up to several hours.
It is performed automatically and doesn't require from you any actions except decoder launching.
DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged.
DO NOT DELETE readme files.
To confirm our honest intentions. Send 2 different random files and you will get them back decrypted.
It can be from different computers on your network to be sure that one key decrypts everything.
We will unlock 2 files for free.
To get info (decrypt your files) contact us a
[email protected]
or
[email protected]
You will receive btc address for payment in the reply letter
Ryuk
No system is safe
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 61 IoCs
description ioc Process File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini taskhost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 836 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 836 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe Token: SeBackupPrivilege 836 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe Token: SeBackupPrivilege 1256 taskhost.exe -
Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 836 wrote to memory of 1256 836 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe 13 PID 836 wrote to memory of 1344 836 13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe 12
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1344
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of AdjustPrivilegeToken
PID:1256
-
C:\Users\Admin\AppData\Local\Temp\13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe"C:\Users\Admin\AppData\Local\Temp\13a1fbb9c303f2789f2d2d55e6b915f4d731b70f0ea6b4453364cd65f9cfa8d6.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836