Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-03-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe
Resource
win7-20220223-en
Behavioral task
behavioral2
Sample
937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe
Resource
win10v2004-en-20220112
General
-
Target
937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe
-
Size
118KB
-
MD5
0237b989a2baee892313244ad6376153
-
SHA1
8677b1fa138f908fc791426f681995a1ca462ba9
-
SHA256
937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e
-
SHA512
88ea1dfb64da80834619c4039431cd1051fb00a9f081ff4697b05636f9e7aab83d6351a20437e26c40d7bfb3dc281e5cf55c3fb6b599410902c3c96aca9b2609
Malware Config
Extracted
C:\7a11y7l81h-readme.txt
ryuk
http://dnpscnbaix6nkwvystl3yxglz7nteicqrou3t75tpcc5532cztc46qyd.onion
https://www.coveware.com/blog/2019/7/15/ransomware-amounts-rise-3x-in-q2-as-ryuk-amp-sodinokibi-spread
http://aplebzu47wgazapdqks6vrcv6zcnjppkbxbr6wketf56nf6aq2nmyoyd.onion/80E17E73775A3CB8
http://decryptor.cc/80E17E73775A3CB8
https://filehippo.com/download_tor_browser_for_windows/
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DismountClose.png => \??\c:\users\admin\pictures\DismountClose.png.7a11y7l81h 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File renamed C:\Users\Admin\Pictures\EnableBackup.tif => \??\c:\users\admin\pictures\EnableBackup.tif.7a11y7l81h 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\users\admin\pictures\NewRegister.tiff 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File renamed C:\Users\Admin\Pictures\NewRegister.tiff => \??\c:\users\admin\pictures\NewRegister.tiff.7a11y7l81h 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\users\admin\pictures\ReadPop.tiff 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File renamed C:\Users\Admin\Pictures\ReadPop.tiff => \??\c:\users\admin\pictures\ReadPop.tiff.7a11y7l81h 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File renamed C:\Users\Admin\Pictures\PushMove.crw => \??\c:\users\admin\pictures\PushMove.crw.7a11y7l81h 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Enumerates connected drives 3 TTPs 25 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\L: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\P: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\X: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\Y: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\Z: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\B: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\H: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\K: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\R: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\V: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\D: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\A: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\F: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\G: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\O: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\Q: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\S: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\T: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\U: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\I: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\J: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\M: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\N: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened (read-only) \??\W: 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe -
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0q6x9wu888dn.bmp" 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe -
Drops file in Program Files directory 14 IoCs
description ioc Process File opened for modification \??\c:\program files\GetEnable.ttf 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\OptimizeRedo.ini 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\WatchResume.htm 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\GetSelect.ps1xml 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\CompressStart.WTV 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\ExpandUpdate.avi 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\MountGet.xla 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\UndoOut.htm 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\UndoRestore.odt 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\EnableEdit.tmp 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\FindCompare.raw 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\ProtectConnect.pptm 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\StopUnblock.3gp2 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe File opened for modification \??\c:\program files\SwitchSearch.mpeg 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeTakeOwnershipPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeTakeOwnershipPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeDebugPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeTakeOwnershipPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeDebugPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeTakeOwnershipPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeDebugPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeTakeOwnershipPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeDebugPrivilege 1856 937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe Token: SeBackupPrivilege 3440 vssvc.exe Token: SeRestorePrivilege 3440 vssvc.exe Token: SeAuditPrivilege 3440 vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe"C:\Users\Admin\AppData\Local\Temp\937829f7defd9b3e80bb36d82f2e3421c80ec39cb858756dc647547635821d7e.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:3540
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3440