Analysis
-
max time kernel
144s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
03-05-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe
Resource
win10v2004-20220414-en
General
-
Target
627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe
-
Size
220KB
-
MD5
adc3438992114c797a33b0a2ed415185
-
SHA1
568979d0548bef3a113fd03f75b6d1c64aa4e0d9
-
SHA256
627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb
-
SHA512
1f3d7551ee1621641b98da20dbc6444e6845af5fdc63f04339c5ab4a5d57fe12465e328edc91fd57c87c9ce64da89a0c8cbf155d0a3214d9a03c395812bfebf0
Malware Config
Extracted
C:\Restore_My_Files.txt
http://vbfqeh5nugm6r2u2qvghsdxm3fotf5wbxb5ltv6vw77vus5frdpuaiid.onion*
Extracted
C:\Users\Admin\Downloads\EnableTrace.mht
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 12 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\EnableSplit.tiff 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\OptimizePush.raw => C:\Users\Admin\Pictures\OptimizePush.raw.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\SkipGroup.crw => C:\Users\Admin\Pictures\SkipGroup.crw.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\UnregisterWrite.tif => C:\Users\Admin\Pictures\UnregisterWrite.tif.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened for modification C:\Users\Admin\Pictures\WatchInitialize.tiff 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\WatchInitialize.tiff => C:\Users\Admin\Pictures\WatchInitialize.tiff.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened for modification C:\Users\Admin\Pictures\GetHide.tiff 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\ConvertToShow.raw => C:\Users\Admin\Pictures\ConvertToShow.raw.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\EnableSplit.tiff => C:\Users\Admin\Pictures\EnableSplit.tiff.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\GetHide.tiff => C:\Users\Admin\Pictures\GetHide.tiff.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\PublishWatch.tif => C:\Users\Admin\Pictures\PublishWatch.tif.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File renamed C:\Users\Admin\Pictures\SplitInitialize.png => C:\Users\Admin\Pictures\SplitInitialize.png.pandora 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Q: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\E: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\O: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\P: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\L: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\I: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\S: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\G: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\K: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\X: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\V: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\B: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\W: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\T: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\U: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\M: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\N: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\R: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\Y: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\A: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\F: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\H: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\J: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe File opened (read-only) \??\Z: 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4912 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 30 IoCs
pid Process 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe Token: SeBackupPrivilege 4920 vssvc.exe Token: SeRestorePrivilege 4920 vssvc.exe Token: SeAuditPrivilege 4920 vssvc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 3524 wrote to memory of 1572 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 83 PID 3524 wrote to memory of 1572 3524 627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe 83 PID 1572 wrote to memory of 4912 1572 cmd.exe 86 PID 1572 wrote to memory of 4912 1572 cmd.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe"C:\Users\Admin\AppData\Local\Temp\627ede421ee51a7153ee896f657169665c1e9f79ef0ba4af1f6450d816900cbb.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3524 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:4912
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4812