Analysis
-
max time kernel
92s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-06-2022 11:33
Static task
static1
Behavioral task
behavioral1
Sample
1.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
1.exe
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
2.exe
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
2.exe
Resource
win10v2004-20220414-en
General
-
Target
1.exe
-
Size
299KB
-
MD5
5995ab21a51618aef0c7aef5b4d82f76
-
SHA1
55da88e2d5dee9134469ddc416b946cd97143c93
-
SHA256
a87536fa66b6840d22b702dd7450f79140e88794fd466ef0320ba3b664964baf
-
SHA512
b6ba33c85899e44a6706a6e2aed756ecff177c15840e4ea715ece45702da31f4aefaa68d560a859456a17d2cc76923049c452a4618c119cbc52d0d4da1126293
Malware Config
Extracted
C:\Users\Admin\Desktop\PopSuspend.txt
ryuk
Extracted
C:\Users\Admin\Downloads\ConfirmDisconnect.txt
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\DenyProtect.png => C:\Users\Admin\Pictures\DenyProtect.png.nigger 1.exe File renamed C:\Users\Admin\Pictures\InstallUnprotect.png => C:\Users\Admin\Pictures\InstallUnprotect.png.nigger 1.exe File renamed C:\Users\Admin\Pictures\OpenConnect.raw => C:\Users\Admin\Pictures\OpenConnect.raw.nigger 1.exe File renamed C:\Users\Admin\Pictures\StartSet.raw => C:\Users\Admin\Pictures\StartSet.raw.nigger 1.exe File renamed C:\Users\Admin\Pictures\StepEdit.tif => C:\Users\Admin\Pictures\StepEdit.tif.nigger 1.exe File renamed C:\Users\Admin\Pictures\UnblockOut.raw => C:\Users\Admin\Pictures\UnblockOut.raw.nigger 1.exe File opened for modification C:\Users\Admin\Pictures\WriteSubmit.tiff 1.exe File renamed C:\Users\Admin\Pictures\WriteSubmit.tiff => C:\Users\Admin\Pictures\WriteSubmit.tiff.nigger 1.exe -
Drops desktop.ini file(s) 38 IoCs
description ioc Process File created C:\Users\Admin\Links\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini 1.exe File created C:\Users\Public\Desktop\desktop.ini 1.exe File created C:\Users\Admin\Searches\desktop.ini 1.exe File created C:\Users\Admin\Videos\desktop.ini 1.exe File created C:\Users\Public\desktop.ini 1.exe File created C:\Users\Public\Pictures\Sample Pictures\desktop.ini 1.exe File created C:\Users\Admin\Contacts\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini 1.exe File created C:\Users\Public\Downloads\desktop.ini 1.exe File created C:\Users\Admin\Desktop\desktop.ini 1.exe File created C:\Users\Admin\Favorites\Links\desktop.ini 1.exe File created C:\Users\Admin\Pictures\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini 1.exe File created C:\Users\Public\Libraries\desktop.ini 1.exe File created C:\Users\Admin\Documents\desktop.ini 1.exe File created C:\Users\Admin\Saved Games\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini 1.exe File created C:\Users\Public\Pictures\desktop.ini 1.exe File created C:\Users\Public\Recorded TV\desktop.ini 1.exe File created C:\Users\Admin\Favorites\Links for United States\desktop.ini 1.exe File created C:\Users\Admin\Music\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Games\Desktop.ini 1.exe File created C:\Users\Public\Documents\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Ringtones\desktop.ini 1.exe File created C:\Users\All Users\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini 1.exe File created C:\Users\Public\Recorded TV\Sample Media\desktop.ini 1.exe File created C:\Users\Admin\Downloads\desktop.ini 1.exe File created C:\Users\Admin\Favorites\desktop.ini 1.exe File created C:\Users\Public\Music\desktop.ini 1.exe File created C:\Users\Public\Music\Sample Music\desktop.ini 1.exe File created C:\Users\Public\Videos\desktop.ini 1.exe File created C:\Users\Public\Videos\Sample Videos\desktop.ini 1.exe