Analysis

  • max time kernel
    167s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    08-05-2022 06:19

General

  • Target

    b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe

  • Size

    976KB

  • MD5

    f3699b7b1bab29788fa470cd38c4c70e

  • SHA1

    563eb07031dd1d697d6ff932904c0930ca6ce5f9

  • SHA256

    b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4

  • SHA512

    eb30d1d66788681d7d2bad7af50c0695460e6571a99c023d2424cfd5410de7ab7fda386d2551bb2314c0abebcc97a0b084345db7ab01077558deaf861a8180c2

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\History_E.txt

Family

ryuk

Ransom Note
History /////////////////////////////////////////////////////// /// The sentence was got with translation software. /// /////////////////////////////////////////////////////// 10/14/2007 v0.97 Addition: --------- Change: ------- Revision: --------- -Correct a AVI output. ================================================================================ 9/17/2007 v0.96 Addition: --------- Change: ------- Revision: --------- -Correct a FDS. -Correct a menu of Disksystem. ================================================================================ 08/12/2007 v0.95 A language plugin is changed. Please pay attention. Addition: --------- -There was ON/OFF by indication of time in movie playback. -Were usable to four pieces of disks (8 sides) by a disk system. Change: ------- Revision: --------- -A bank loaded in a state road in MMC5 corrects a problem to change. -Correct a FDS. ================================================================================ 06/01/2006 v0.93 Addition: --------- -Several automatic correspondence or addition of a family BASIC keyboard. -Add a Mapper164/165/167.(Thanks TPU) -It supports Supor Keyborad.(Thanks TPU) -Coped with a voice synthesis of Moero!! Pro-Tennis. Change: ------- Revision: -------- -Support a logical change application of a Caps key and a Ctrl key. -Correct movement of a frame counter. -A remainder of DMA_cycles corrects a few problems than request_cycle. -Cope in Mapper2 in Shanghai (PRG CRC:b20c1030). -Support a version other than DBZ2. -Correct the number of clock of NES for PAL. -A family BASIC keyboard connection 2P side controller corrects the problem that does not work. -Be revisions scantily. ================================================================================ 04/09/2004 v0.92 Addition: --------- -Add a correspondence pattern to simple virus checkers. (WORM_NETSKY.Q) Change: ------- Revision: --------- -Correct a reset parameter of $4017 in NSF. -Corrent Mapper19. (Wagan Land 2) ================================================================================ 03/25/2004 v0.91c Addition: --------- Change: ------- -Stopped extension distinction of ".zip". Revision: --------- -Correct a triangle wave. -Correct a reset parameter of $4017 in NSF. ================================================================================ 02/20/2004 v0.91b Addition: --------- -Tried to link "VirtuaNES.exe.manifest" for WindowsXP. Change: ------- Revision: --------- -Correct an operation of the ZIP file which doesn't include IPS in "Auto IPS patch". -Correct that be removed a pause by DIALOG indication of a launcher. ================================================================================ 02/12/2004 v0.91a Addition: --------- Change: ------- Revision: --------- -Correct that there is the case that simple virus checkers detects by mistake. (MYDOOM.A) ================================================================================ 02/07/2004 v0.91 Addition: --------- -Add a correspondence pattern to simple virus checkers. Change: ------- -A list view update method of Cheat support is changed. Revision: --------- -Correct IRQ of MMC3. (Rockman 3) -Correct a triangle wave. ================================================================================ 01/27/2004 v0.90d Addition: --------- Change: ------- Revision: --------- -Correct a triangle wave. (pikes of DQ3) ================================================================================ 01/21/2004 v0.90c Addition: --------- Change: ------- -Change it to admit the UP/DOWN simultaneous input of a pad. (diabolical pitch exclusive use:D) Revision: --------- -Correct algorithm of a triangle wave. ================================================================================ 01/21/2004 v0.90b Addition: --------- Change: ------- -Put back a patch of "Some speedup". Revision: --------- -Correct an operation of a "Prohibition of double activate" option. -Correct an operation of Holdnote of a triangle wave. (some BGM of Dungeon of Zelda were strange) ================================================================================ 01/13/2004 v0.90a Addition: --------- Change: ------- -Remade an IPS patch routine. An IPS file name didn't need to be the same in case of bundling in a thing of a ZIP archive. Reinforced it than a thing of an error check, and the IPS patch with a change of size ignored a size outside part. -Correct that malfunction can go with a patch of speedup to some extent. Revision: --------- -A color corrects a monochrome bug in a total color change by AVI conversion. ================================================================================ 01/11/2004 v0.90 A language plugin is changed. Please pay attention. Addition: --------- -Add an IPS patch function.(Thanks Feather) -Add Mapper27.(Thanks tpu) -Add a hq2x/lq2x filter. -Add an AVI conversion function. Please refer to AVIconv.txt in detail. Change: ------- -Change a font of language plugin. -Some speedup.(Thanks Feather) -When the right button of a mouse is pushed in use in Zapper, it is a change a screen to become the same as the time that pushed the left button outside. (Thanks Father) Revision: --------- -Increased a queue buffer for sound. -Correct an IRQ timing of DPCM. -Correct it to take damage in Gun Sight(J) rightly. -Correct that a color didn't change by a monochromatic / whole color change in a full-screen /8bit color. -An option of "Using Sleep" corrects what isn't saved. -Correct a problem of a snapshot in a monochromatic mode. -Correct Mapper16. -Correct Mapper33. ================================================================================ 11/03/2003 v0.86a Addition: --------- -Add the option that doesn't use joystick ID. Note) Even if joystick connection is "OK" with control panel, when you cannot use at all by VirtuaNES, please add "NoJoystickID=1" to [General] section of INI file. -Add Mapper61. Change: ------- -Didn't support slider of a joystick. Note) Provisional measures Revision: --------- -Correct a label of POV of a joystick. -Correct updating timing of NES controller. -Correct Mapper4. -Correct Mapper60. ================================================================================ 10/26/2003 v0.86 Addition: --------- -Add an option to do a pause of an emulation at active time of a launcher. Note) Add "ActivePause=1" to a [Launcher] section of INI. -Add Mapper200,201,202. (Thanks CaH4e3) Change: ------- -Support POV and SLIDER of a joystick. Revision: --------- -Correct Mapper4. -Correct Mapper189. -Correct that tape/barcode was strange. Note) Enbugging was carried out from 0.85. ================================================================================ 10/19/2003 v0.85d Addition: --------- -Add VS Mach Rider(Japan, Fighting Course) to VS-Unisystem. Change: ------- -Support mouse wheel in MemoryViewer. Revision: --------- -Correct Mapper69. ================================================================================ 10/13/2003 v0.85c Addition: --------- -Adds VS Raid on Bungaling Bay(J)/VS Mighty Bomb Jack(J) to VS-Unisystem. Change: ------- Revision: --------- -Corrects surface drawing process. -Corrects Mapper74. ================================================================================ 10/11/2003 v0.85b Addition: --------- Change: ------- Revision: --------- -Corrects Mapper20(FDS). -Corrects that an effect sound doesn't sound in Sangokushi2(KOEI version). ================================================================================ 10/11/2003 v0.85a Addition: --------- Change: ------- Revision: --------- -Corrects an indication of FPS. -Corrects screen simulation of Mother. -Corrects a bug of version information DIALOG. ================================================================================ 10/09/2003 v0.85 Because a mail address wasn't usable, the mail address was changed by a virus.:( A language plugin is changed. Please pay attention. Addition: --------- -Add file name representation in an emulation to a window title bar. -Add starting and an option starting a launcher simultaneously. -Add a quick load / save. Note) Choose a slot directly, and there is load / save. -Add a pallet edit function. -Add a bank changing function to a turbo file. -Add various graphics filter functions. (required MMX) Note)2xSaI/Super2xSaI/SuperEagle/Scale2x is usable. A supporting screen mode is referred to as follows. | 8bpp 16bpp 24bpp 32bpp -----------+------------------------------ 2xSaI | No Yes No Yes Super2xSaI | No Yes No Yes SuperEagle | No Yes No Yes Scale2x | No Yes No Yes -Add the option that does Sleep of an option of "Sync drawing" in activity to graphic setting DIALOG. -Add the option that resolution except 4:3 can choose in a full screen. -Add VS-Unisystem. -Add automatic distinction of NTSC/PAL to a NSF player mode. -Add Mapper12. Change: ------- -Change internal surface drawing process. Note) May be accelerate, and may become heavy.:) -Change it so that there is monochromatic / background color modification in a line unit. Note) Because a pallet isn't enough with a 8bit color, can't reproduce a color precisely. Please use more than 16bit color if possible. -Change an approach of interrupt handling. -Change it to set a PAL mode automatically when a file name includes "(E)". -Change it so that a snapshot can make even PNG. Note) Please choose it in Emulator setting DIALOG. -Change it so that there is a multiple selection in a launcher list. -Change it not to update a list after Folder setting of a launcher. Note) Because a complement was able to save a list. Revision: --------- -Correct fault of action at the time of focus movement. -Correct malfunction of a triangular wave. -Correct a mapper in various ways. -Correct the bug that isn't saved after header editing with a launcher. -When choosing file on WAVE recording / tape operation / movie and extension is omitted, correct so that extension may be attached. -Correct other in various ways. ================================================================================ 08/25/2003 v0.82 Addition: --------- -Add a correspondence pattern to simple virus checkers. (Sobig.F has been sent to me by terrible force. Have been sent around 2000-3000 in a day....) Change: ------- -Changed cheat code folder of a default in ".\cheatcode\" from ".\code\". Revision: --------- -Correct Mapper20(FDS). -Correct focus and there can be the thing that place it, and shortcut key has worked in one of movement of short cut malfunction. -Corrected the malfunction that had worked without relation in setting of background movement when minimized it with a click of task bar. ================================================================================ 08/07/2003 v0.81 Addition: --------- Change: ------- -Invalidated operation with a keyboard when turned a chat window in net play into an active window. Note) Can operate it in joystick. Revision: --------- -Corrected that a general conservation error went when it started when DirectX7.0 or higher was not installed. -Corrected setting to SRAM check box of Cheat support. -Correct Mapper112. ================================================================================ 06/23/2003 v0.80 Addition: --------- Change: ------- -Set a start music number of NSF in an initial value. Revision: --------- -SRAM save corrects the malfunction that there isn't by some games of Mapper1. -Correct Mapper45. ================================================================================ 06/01/2003 v0.79 Addition: --------- -Add indication of a sort state to a save and a header part of a sort state in Launcher. Change: ------- Revision: --------- -Correct behavior of an APU register. -Correct Mapper90. ================================================================================ 05/24/2003 v0.78 Addition: --------- -Add some equivalence patterns to simple virus checkers. Change: ------- -Saved a state of a source emulation part by a state save. Think that the phenomenon that a sound becomes strange almost disappears in state load. Note) Don't store VRC7. Revision: --------- -Shortcut key processing a few revision. ================================================================================ 05/06/2003 v0.77 Addition: --------- -Add an option doing Sleep when uses an option of "Sync drawing". Please add "SyncNoSleep=1" to a [Graphics] section when uses it. Default off. A frame rate depends on monitor frequency when turns this option into ON. Note) Please do not use it when can't select monitor frequency in full-screen with Windows9x(Include Me) series. -Displayed a key of VRC7 with a NSF player mode. Note) Display a musical scale of a channel in key-on. Change: ------- Revision: --------- -Correct that FPS and shortcut key processing become too fast when it makes the number of frame skip increasing between pauses of emulation. -Correct Mapper83. ================================================================================ 04/21/2003 v0.76a Addition: --------- Change: ------- Revision: --------- -Correct that then can have returned by a full-screen change with shortcut key in the cause. ================================================================================ 04/20/2003 v0.76 Addition: --------- -Add following Mapper(there is Mapper which doesn't work.) 044,045,046,047,050,051,057,058,060,062,074,105,108,109,110,112, 114,115,116,117,133,134,135,140,142,160,182,183,190,191,193,194, 198,222,225,226,227,228,229,230,231,232,233,234,235,236,240,241, 242,244,245,246,248,249,251,252,254,255 Change: ------- Revision: --------- -Correct that Shougi Meikan '92 didn't move. ================================================================================ 03/21?/2003 v0.75e (Don't release it formally.) Sorry... Addition: --------- Change: ------- Revision: --------- -A debugging code is left, and correct that was very heavy. ================================================================================ 03/21/2003 v0.75d Sorry... Addition: --------- Change: ------- Revision: --------- -A debugging code is left, and correct that was very heavy. ================================================================================ 03/21/2003 v0.75c Addition: --------- Change: ------- Revision: --------- -Correct a very stupid bug of NMI. :( -Correct behavior of special NMI. ================================================================================ 03/21/2003 v0.75b Addition: --------- Change: ------- Revision: --------- -Correct the bug that FDS can't save. ================================================================================ 03/20/2003 v0.75a Addition: --------- Change: ------- Revision: --------- -Only DISKSYSTEM was the same as v0.74, and steeped NMI. ================================================================================ 03/19/2003 v0.75 -Because revises plug-in, please pay attention. Addition: ------

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
    "C:\Users\Admin\AppData\Local\Temp\b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1036
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\game.bat" "
      2⤵
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1544
      • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe
        VirtualNES.exe Adventure Island 3.nes
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: GetForegroundWindowSpam
        • Suspicious use of SetWindowsHookEx
        PID:1412
  • C:\Windows\system32\AUDIODG.EXE
    C:\Windows\system32\AUDIODG.EXE 0x568
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:364

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Adventure Island 3.nes

    Filesize

    256KB

    MD5

    cb461ebe2ca2c9f6e89b9502abaf648e

    SHA1

    6463127b4c9c31e6a0f5a068b6f283a9f03dd5e9

    SHA256

    63741ae44731d285cd1fc499178b64e960e64d7f1445f41ddc76bb5b71bd1899

    SHA512

    73d03931ad368142cdfc3242278373cd2e805b35edacef88a7da41158dedbdf1a2f3a1da327cdcc6358a6d67929cdb07277175890f90eea7ac73db4387e16109

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\English.vlp

    Filesize

    72KB

    MD5

    2c8aea8253301911c5d3972fdbe253b9

    SHA1

    baac1a411ddc736392feefad97903f0cafa44f00

    SHA256

    7a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39

    SHA512

    1decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtuaNES.ini

    Filesize

    9KB

    MD5

    0d2170d18c07b87b9d471c99b454c7d0

    SHA1

    6648b10cbb22426d1a27627dc6314ed764c84160

    SHA256

    fb319571e7e12fdbbd9dabb5dd8460ab18f0dfc6a98ccc403f4eeb750240bb6e

    SHA512

    a39a2b031fc2ee76386320b8126ee8e463a125fc854cee48c5e46229ba91e37031fe286a493fd33cba88ecf8c4efbead54258d538891ba257cab4862268c5e8a

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe

    Filesize

    744KB

    MD5

    f9c7c80681ac40d1836c8ec1bf59dc24

    SHA1

    25fa98ae13be80b9f7c996b10adbca9232a73b92

    SHA256

    8039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20

    SHA512

    cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe

    Filesize

    744KB

    MD5

    f9c7c80681ac40d1836c8ec1bf59dc24

    SHA1

    25fa98ae13be80b9f7c996b10adbca9232a73b92

    SHA256

    8039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20

    SHA512

    cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a

  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\game.bat

    Filesize

    37B

    MD5

    52280031a0d63a26de344b293a64ace3

    SHA1

    c9a33575c01b7904f5bab228d0597da4fe5c4ef6

    SHA256

    fb1c1bb62f5f11824c306bc6d70798ed4c73b954e9d898e73e422c6fd86c3adb

    SHA512

    c5a3cc523c8657dd274296c4d0573d69d0d3a44ccc283677074626818dbc09b6551d5f577a65c9fe61c99485c27af1a694860ba2305f7c4bd415e9377de56a26

  • \Users\Admin\AppData\Local\Temp\RarSFX0\English.vlp

    Filesize

    72KB

    MD5

    2c8aea8253301911c5d3972fdbe253b9

    SHA1

    baac1a411ddc736392feefad97903f0cafa44f00

    SHA256

    7a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39

    SHA512

    1decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d

  • \Users\Admin\AppData\Local\Temp\RarSFX0\English.vlp

    Filesize

    72KB

    MD5

    2c8aea8253301911c5d3972fdbe253b9

    SHA1

    baac1a411ddc736392feefad97903f0cafa44f00

    SHA256

    7a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39

    SHA512

    1decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d

  • \Users\Admin\AppData\Local\Temp\RarSFX0\English.vlp

    Filesize

    72KB

    MD5

    2c8aea8253301911c5d3972fdbe253b9

    SHA1

    baac1a411ddc736392feefad97903f0cafa44f00

    SHA256

    7a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39

    SHA512

    1decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d

  • \Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe

    Filesize

    744KB

    MD5

    f9c7c80681ac40d1836c8ec1bf59dc24

    SHA1

    25fa98ae13be80b9f7c996b10adbca9232a73b92

    SHA256

    8039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20

    SHA512

    cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a

  • \Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exe

    Filesize

    744KB

    MD5

    f9c7c80681ac40d1836c8ec1bf59dc24

    SHA1

    25fa98ae13be80b9f7c996b10adbca9232a73b92

    SHA256

    8039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20

    SHA512

    cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a

  • memory/1036-54-0x0000000075AE1000-0x0000000075AE3000-memory.dmp

    Filesize

    8KB

  • memory/1412-60-0x0000000000000000-mapping.dmp

  • memory/1544-55-0x0000000000000000-mapping.dmp