Analysis
-
max time kernel
27s -
max time network
32s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
19-04-2023 19:07
Behavioral task
behavioral1
Sample
rook.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
rook.exe
Resource
win10v2004-20230220-en
General
-
Target
rook.exe
-
Size
5.4MB
-
MD5
4f7adc32ec67c1a55853ef828fe58707
-
SHA1
36de7997949ac3b9b456023fb072b9a8cd84ade8
-
SHA256
96f7df1c984c1753289600f7f373f3a98a4f09f82acc1be8ecfd5790763a355b
-
SHA512
a45e4a20133c842037789157c3ed845afdefbb0d2fe3958d75f0cb3cdfeee106262f9de0e0aca92ac84a0211432cd19773e0f769b970ddb8a80e5f7855676f74
-
SSDEEP
98304:HMIyl5cyXqgUVcIIsuwHW2doNtUIXmUIHWnS3f1sISlIf9FxefJMb:pyzcyrUVxhB2hXk2nStsHl4VyJ
Malware Config
Extracted
C:\PerfLogs\Admin\HowToRestoreYourFiles.txt
rook
Signatures
-
Rook
Rook is a ransomware which copies from NightSky ransomware.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 8 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\SubmitBlock.png.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\SplitUnblock.raw.Rook rook.exe File renamed C:\Users\Admin\Pictures\AddSet.png => C:\Users\Admin\Pictures\AddSet.png.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\AddSet.png.Rook rook.exe File renamed C:\Users\Admin\Pictures\SplitUnblock.raw => C:\Users\Admin\Pictures\SplitUnblock.raw.Rook rook.exe File renamed C:\Users\Admin\Pictures\StartUninstall.png => C:\Users\Admin\Pictures\StartUninstall.png.Rook rook.exe File renamed C:\Users\Admin\Pictures\SubmitBlock.png => C:\Users\Admin\Pictures\SubmitBlock.png.Rook rook.exe File opened for modification C:\Users\Admin\Pictures\StartUninstall.png.Rook rook.exe -
resource yara_rule behavioral1/memory/920-57-0x000000013F0B0000-0x000000013F9CD000-memory.dmp vmprotect -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: rook.exe File opened (read-only) \??\K: rook.exe File opened (read-only) \??\X: rook.exe File opened (read-only) \??\V: rook.exe File opened (read-only) \??\B: rook.exe File opened (read-only) \??\M: rook.exe File opened (read-only) \??\O: rook.exe File opened (read-only) \??\S: rook.exe File opened (read-only) \??\I: rook.exe File opened (read-only) \??\P: rook.exe File opened (read-only) \??\G: rook.exe File opened (read-only) \??\Z: rook.exe File opened (read-only) \??\N: rook.exe File opened (read-only) \??\T: rook.exe File opened (read-only) \??\Y: rook.exe File opened (read-only) \??\H: rook.exe File opened (read-only) \??\E: rook.exe File opened (read-only) \??\R: rook.exe File opened (read-only) \??\U: rook.exe File opened (read-only) \??\A: rook.exe File opened (read-only) \??\F: rook.exe File opened (read-only) \??\L: rook.exe File opened (read-only) \??\Q: rook.exe File opened (read-only) \??\W: rook.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 568 vssadmin.exe 1748 vssadmin.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 920 rook.exe 920 rook.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeBackupPrivilege 320 vssvc.exe Token: SeRestorePrivilege 320 vssvc.exe Token: SeAuditPrivilege 320 vssvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 920 wrote to memory of 1604 920 rook.exe 27 PID 920 wrote to memory of 1604 920 rook.exe 27 PID 920 wrote to memory of 1604 920 rook.exe 27 PID 1604 wrote to memory of 568 1604 cmd.exe 29 PID 1604 wrote to memory of 568 1604 cmd.exe 29 PID 1604 wrote to memory of 568 1604 cmd.exe 29 PID 920 wrote to memory of 664 920 rook.exe 34 PID 920 wrote to memory of 664 920 rook.exe 34 PID 920 wrote to memory of 664 920 rook.exe 34 PID 664 wrote to memory of 1748 664 cmd.exe 36 PID 664 wrote to memory of 1748 664 cmd.exe 36 PID 664 wrote to memory of 1748 664 cmd.exe 36 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\rook.exe"C:\Users\Admin\AppData\Local\Temp\rook.exe"1⤵
- Modifies extensions of user files
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:1604 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:568
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin.exe delete shadows /all /quiet2⤵
- Suspicious use of WriteProcessMemory
PID:664 -
C:\Windows\system32\vssadmin.exevssadmin.exe delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1748
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD500f71cde522689585eaa9c62385afa22
SHA1350e319806f7a71267a5e4a749eb190ead38dbb0
SHA256b14ec2fcccac5059464e800edf56049c0277124abd60ee49c1f726861df925bf
SHA51247442d335f16e259c4593370467c741ac2b41f329330afdd649b89b44c4233edd7d2af70883403993d6022c617235c20b89ae667ca4b3f82d678836adc34f4df