Analysis
-
max time kernel
135s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12-04-2023 19:23
Behavioral task
behavioral1
Sample
rook.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rook.exe
Resource
win10v2004-20230220-en
General
-
Target
rook.exe
-
Size
5.4MB
-
MD5
4f7adc32ec67c1a55853ef828fe58707
-
SHA1
36de7997949ac3b9b456023fb072b9a8cd84ade8
-
SHA256
96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
-
SHA512
a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
-
SSDEEP
98304:HMIyl5cyXqgUVcIIsuwHW2doNtUIXmUIHWnS3f1sISlIf9FxefJMb:pyzcyrUVxhB2hXk2nStsHl4VyJ
Malware Config
Extracted
C:\Recovery\WindowsRE\HowToRestoreYourFiles.txt
rook
Signatures
-
Rook
Rook is a ransomware which copies from NightSky ransomware.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 19 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
rook.exedescription ioc process File opened for modification C:\Users\Admin\Pictures\PublishMount.tif.Rook rook.exe File renamed C:\Users\Admin\Pictures\MoveEnter.png => C:\Users\Admin\Pictures\MoveEnter.png.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\OpenRename.crw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromSwitch.raw.Rook rook.exe File renamed C:\Users\Admin\Pictures\OpenUnpublish.tif => C:\Users\Admin\Pictures\OpenUnpublish.tif.Rook rook.exe File renamed C:\Users\Admin\Pictures\OpenRename.crw => C:\Users\Admin\Pictures\OpenRename.crw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\OpenUnpublish.tif.Rook rook.exe File renamed C:\Users\Admin\Pictures\MergeStop.tiff => C:\Users\Admin\Pictures\MergeStop.tiff.Rook rook.exe File renamed C:\Users\Admin\Pictures\JoinResolve.crw => C:\Users\Admin\Pictures\JoinResolve.crw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\JoinResolve.crw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\LockClear.raw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\MoveEnter.png.Rook rook.exe File renamed C:\Users\Admin\Pictures\PublishMount.tif => C:\Users\Admin\Pictures\PublishMount.tif.Rook rook.exe File renamed C:\Users\Admin\Pictures\FindGet.tif => C:\Users\Admin\Pictures\FindGet.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\MergeStop.tiff.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\MergeStop.tiff rook.exe File renamed C:\Users\Admin\Pictures\ConvertFromSwitch.raw => C:\Users\Admin\Pictures\ConvertFromSwitch.raw.Rook rook.exe File renamed C:\Users\Admin\Pictures\LockClear.raw => C:\Users\Admin\Pictures\LockClear.raw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\FindGet.tif.Rook rook.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
rook.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-144354903-2550862337-1367551827-1000\Control Panel\International\Geo\Nation rook.exe -
Processes:
resource yara_rule behavioral2/memory/2416-134-0x00007FF624420000-0x00007FF624D3D000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
rook.exedescription ioc process File opened (read-only) \??\Q: rook.exe File opened (read-only) \??\T: rook.exe File opened (read-only) \??\V: rook.exe File opened (read-only) \??\R: rook.exe File opened (read-only) \??\Y: rook.exe File opened (read-only) \??\U: rook.exe File opened (read-only) \??\O: rook.exe File opened (read-only) \??\J: rook.exe File opened (read-only) \??\L: rook.exe File opened (read-only) \??\X: rook.exe File opened (read-only) \??\P: rook.exe File opened (read-only) \??\A: rook.exe File opened (read-only) \??\F: rook.exe File opened (read-only) \??\H: rook.exe File opened (read-only) \??\B: rook.exe File opened (read-only) \??\N: rook.exe File opened (read-only) \??\W: rook.exe File opened (read-only) \??\E: rook.exe File opened (read-only) \??\I: rook.exe File opened (read-only) \??\S: rook.exe File opened (read-only) \??\G: rook.exe File opened (read-only) \??\K: rook.exe File opened (read-only) \??\Z: rook.exe File opened (read-only) \??\M: rook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exevssadmin.exepid process 3360 vssadmin.exe 5088 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rook.exepid process 2416 rook.exe 2416 rook.exe 2416 rook.exe 2416 rook.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 2732 vssvc.exe Token: SeRestorePrivilege 2732 vssvc.exe Token: SeAuditPrivilege 2732 vssvc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
rook.execmd.execmd.exedescription pid process target process PID 2416 wrote to memory of 2156 2416 rook.exe cmd.exe PID 2416 wrote to memory of 2156 2416 rook.exe cmd.exe PID 2156 wrote to memory of 3360 2156 cmd.exe vssadmin.exe PID 2156 wrote to memory of 3360 2156 cmd.exe vssadmin.exe PID 2416 wrote to memory of 2924 2416 rook.exe cmd.exe PID 2416 wrote to memory of 2924 2416 rook.exe cmd.exe PID 2924 wrote to memory of 5088 2924 cmd.exe vssadmin.exe PID 2924 wrote to memory of 5088 2924 cmd.exe vssadmin.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rook.exe"C:\Users\Admin\AppData\Local\Temp\rook.exe"1⤵
- Modifies extensions of user files
- Checks computer location settings
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2416 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2156 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:3360 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5088
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD500f71cde522689585eaa9c62385afa22
SHA1350e319806f7a71267a5e4a749eb190ead38dbb0
SHA256b14ec2fcccac5059464e800edf56049c0277124abd60ee49c1f726861df925bf
SHA51247442d335f16e259c4593370467c741ac2b41f329330afdd649b89b44c4233edd7d2af70883403993d6022c617235c20b89ae667ca4b3f82d678836adc34f4df