Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2023 18:13
Behavioral task
behavioral1
Sample
rook.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rook.exe
Resource
win10v2004-20230220-en
General
-
Target
rook.exe
-
Size
5.4MB
-
MD5
4f7adc32ec67c1a55853ef828fe58707
-
SHA1
36de7997949ac3b9b456023fb072b9a8cd84ade8
-
SHA256
96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
-
SHA512
a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
-
SSDEEP
98304:HMIyl5cyXqgUVcIIsuwHW2doNtUIXmUIHWnS3f1sISlIf9FxefJMb:pyzcyrUVxhB2hXk2nStsHl4VyJ
Malware Config
Extracted
C:\Recovery\d2ce1482-b192-11ed-8622-cee1c2fbb193\HowToRestoreYourFiles.txt
rook
Signatures
-
Rook
Rook is a ransomware which copies from NightSky ransomware.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 11 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File renamed C:\Users\Admin\Pictures\UnlockRename.tif => C:\Users\Admin\Pictures\UnlockRename.tif.Rook rook.exe File renamed C:\Users\Admin\Pictures\UnregisterPublish.tif => C:\Users\Admin\Pictures\UnregisterPublish.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\UnregisterPublish.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\ConvertMerge.tiff.Rook rook.exe File renamed C:\Users\Admin\Pictures\MeasureRemove.crw => C:\Users\Admin\Pictures\MeasureRemove.crw.Rook rook.exe File renamed C:\Users\Admin\Pictures\ReceiveEnable.tif => C:\Users\Admin\Pictures\ReceiveEnable.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\MeasureRemove.crw.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\ReceiveEnable.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\UnlockRename.tif.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\ConvertMerge.tiff rook.exe File renamed C:\Users\Admin\Pictures\ConvertMerge.tiff => C:\Users\Admin\Pictures\ConvertMerge.tiff.Rook rook.exe -
resource yara_rule behavioral1/memory/2016-57-0x000000013FFB0000-0x00000001408CD000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\U: rook.exe File opened (read-only) \??\P: rook.exe File opened (read-only) \??\N: rook.exe File opened (read-only) \??\W: rook.exe File opened (read-only) \??\R: rook.exe File opened (read-only) \??\O: rook.exe File opened (read-only) \??\A: rook.exe File opened (read-only) \??\G: rook.exe File opened (read-only) \??\H: rook.exe File opened (read-only) \??\K: rook.exe File opened (read-only) \??\V: rook.exe File opened (read-only) \??\E: rook.exe File opened (read-only) \??\Y: rook.exe File opened (read-only) \??\M: rook.exe File opened (read-only) \??\L: rook.exe File opened (read-only) \??\X: rook.exe File opened (read-only) \??\I: rook.exe File opened (read-only) \??\S: rook.exe File opened (read-only) \??\F: rook.exe File opened (read-only) \??\J: rook.exe File opened (read-only) \??\Z: rook.exe File opened (read-only) \??\B: rook.exe File opened (read-only) \??\Q: rook.exe File opened (read-only) \??\T: rook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1516 vssadmin.exe 1532 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2016 rook.exe 2016 rook.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 632 vssvc.exe Token: SeRestorePrivilege 632 vssvc.exe Token: SeAuditPrivilege 632 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2016 wrote to memory of 1704 2016 rook.exe 29 PID 2016 wrote to memory of 1704 2016 rook.exe 29 PID 2016 wrote to memory of 1704 2016 rook.exe 29 PID 1704 wrote to memory of 1516 1704 cmd.exe 31 PID 1704 wrote to memory of 1516 1704 cmd.exe 31 PID 1704 wrote to memory of 1516 1704 cmd.exe 31 PID 2016 wrote to memory of 832 2016 rook.exe 35 PID 2016 wrote to memory of 832 2016 rook.exe 35 PID 2016 wrote to memory of 832 2016 rook.exe 35 PID 832 wrote to memory of 1532 832 cmd.exe 37 PID 832 wrote to memory of 1532 832 cmd.exe 37 PID 832 wrote to memory of 1532 832 cmd.exe 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rook.exe"C:\Users\Admin\AppData\Local\Temp\rook.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2016 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1516
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:832 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1532
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:632
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD500f71cde522689585eaa9c62385afa22
SHA1350e319806f7a71267a5e4a749eb190ead38dbb0
SHA256b14ec2fcccac5059464e800edf56049c0277124abd60ee49c1f726861df925bf
SHA51247442d335f16e259c4593370467c741ac2b41f329330afdd649b89b44c4233edd7d2af70883403993d6022c617235c20b89ae667ca4b3f82d678836adc34f4df