Analysis
-
max time kernel
167s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-05-2022 06:19
Static task
static1
Behavioral task
behavioral1
Sample
b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
Resource
win10v2004-20220414-en
General
-
Target
b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe
-
Size
976KB
-
MD5
f3699b7b1bab29788fa470cd38c4c70e
-
SHA1
563eb07031dd1d697d6ff932904c0930ca6ce5f9
-
SHA256
b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4
-
SHA512
eb30d1d66788681d7d2bad7af50c0695460e6571a99c023d2424cfd5410de7ab7fda386d2551bb2314c0abebcc97a0b084345db7ab01077558deaf861a8180c2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RarSFX0\Doc\History_E.txt
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
VirtualNES.exepid process 1412 VirtualNES.exe -
Loads dropped DLL 5 IoCs
Processes:
cmd.exeVirtualNES.exepid process 1544 cmd.exe 1544 cmd.exe 1412 VirtualNES.exe 1412 VirtualNES.exe 1412 VirtualNES.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
VirtualNES.exepid process 1412 VirtualNES.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
AUDIODG.EXEdescription pid process Token: 33 364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 364 AUDIODG.EXE Token: 33 364 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 364 AUDIODG.EXE -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
VirtualNES.exepid process 1412 VirtualNES.exe 1412 VirtualNES.exe 1412 VirtualNES.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.execmd.exedescription pid process target process PID 1036 wrote to memory of 1544 1036 b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe cmd.exe PID 1036 wrote to memory of 1544 1036 b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe cmd.exe PID 1036 wrote to memory of 1544 1036 b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe cmd.exe PID 1036 wrote to memory of 1544 1036 b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe cmd.exe PID 1544 wrote to memory of 1412 1544 cmd.exe VirtualNES.exe PID 1544 wrote to memory of 1412 1544 cmd.exe VirtualNES.exe PID 1544 wrote to memory of 1412 1544 cmd.exe VirtualNES.exe PID 1544 wrote to memory of 1412 1544 cmd.exe VirtualNES.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe"C:\Users\Admin\AppData\Local\Temp\b5941db3b04e8ddfbc5b8f52a12862e8203a54eda666b6ad685b566b0b1faba4.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RarSFX0\game.bat" "2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1544 -
C:\Users\Admin\AppData\Local\Temp\RarSFX0\VirtualNES.exeVirtualNES.exe Adventure Island 3.nes3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1412
-
-
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5681⤵
- Suspicious use of AdjustPrivilegeToken
PID:364
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
256KB
MD5cb461ebe2ca2c9f6e89b9502abaf648e
SHA16463127b4c9c31e6a0f5a068b6f283a9f03dd5e9
SHA25663741ae44731d285cd1fc499178b64e960e64d7f1445f41ddc76bb5b71bd1899
SHA51273d03931ad368142cdfc3242278373cd2e805b35edacef88a7da41158dedbdf1a2f3a1da327cdcc6358a6d67929cdb07277175890f90eea7ac73db4387e16109
-
Filesize
72KB
MD52c8aea8253301911c5d3972fdbe253b9
SHA1baac1a411ddc736392feefad97903f0cafa44f00
SHA2567a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39
SHA5121decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d
-
Filesize
9KB
MD50d2170d18c07b87b9d471c99b454c7d0
SHA16648b10cbb22426d1a27627dc6314ed764c84160
SHA256fb319571e7e12fdbbd9dabb5dd8460ab18f0dfc6a98ccc403f4eeb750240bb6e
SHA512a39a2b031fc2ee76386320b8126ee8e463a125fc854cee48c5e46229ba91e37031fe286a493fd33cba88ecf8c4efbead54258d538891ba257cab4862268c5e8a
-
Filesize
744KB
MD5f9c7c80681ac40d1836c8ec1bf59dc24
SHA125fa98ae13be80b9f7c996b10adbca9232a73b92
SHA2568039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20
SHA512cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a
-
Filesize
744KB
MD5f9c7c80681ac40d1836c8ec1bf59dc24
SHA125fa98ae13be80b9f7c996b10adbca9232a73b92
SHA2568039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20
SHA512cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a
-
Filesize
37B
MD552280031a0d63a26de344b293a64ace3
SHA1c9a33575c01b7904f5bab228d0597da4fe5c4ef6
SHA256fb1c1bb62f5f11824c306bc6d70798ed4c73b954e9d898e73e422c6fd86c3adb
SHA512c5a3cc523c8657dd274296c4d0573d69d0d3a44ccc283677074626818dbc09b6551d5f577a65c9fe61c99485c27af1a694860ba2305f7c4bd415e9377de56a26
-
Filesize
72KB
MD52c8aea8253301911c5d3972fdbe253b9
SHA1baac1a411ddc736392feefad97903f0cafa44f00
SHA2567a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39
SHA5121decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d
-
Filesize
72KB
MD52c8aea8253301911c5d3972fdbe253b9
SHA1baac1a411ddc736392feefad97903f0cafa44f00
SHA2567a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39
SHA5121decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d
-
Filesize
72KB
MD52c8aea8253301911c5d3972fdbe253b9
SHA1baac1a411ddc736392feefad97903f0cafa44f00
SHA2567a3f0ac7aa2b277de15eb935162c0ef096c157468e79c42ce94736289c7a7c39
SHA5121decde58f5bdd4a9a4b0b910283a2968c586e6ee7a8f759eb93eb0915323b5c1c48bf7c380e275c34f7df28c30ee8588d94db16d98b8d8fe93d600343156b67d
-
Filesize
744KB
MD5f9c7c80681ac40d1836c8ec1bf59dc24
SHA125fa98ae13be80b9f7c996b10adbca9232a73b92
SHA2568039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20
SHA512cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a
-
Filesize
744KB
MD5f9c7c80681ac40d1836c8ec1bf59dc24
SHA125fa98ae13be80b9f7c996b10adbca9232a73b92
SHA2568039687a5274b46763677deb477d00b22466824d93d52db1306efaf05aa80f20
SHA512cc4e0a68b3a29a2fb9b9c29a5bf1aca6fc85684ff5b5b83dd2fcaebe02863b6eb47891d0b817721ebe9c0c2e896bb008da663d7a0401604e75a256d4f176309a