Overview
overview
10Static
static
10ransomware...3n.exe
windows7-x64
ransomware...3n.exe
windows10-2004-x64
ransomware...le.exe
windows7-x64
ransomware...le.exe
windows10-2004-x64
ransomware...it.exe
windows7-x64
10ransomware...it.exe
windows10-2004-x64
10ransomware...le.exe
windows10-2004-x64
10ransomware... 5.exe
windows7-x64
10ransomware... 5.exe
windows10-2004-x64
10ransomware...de.exe
windows7-x64
10ransomware...de.exe
windows10-2004-x64
10ransomware...ck.exe
windows7-x64
7ransomware...ck.exe
windows10-2004-x64
7ransomware...ye.exe
windows7-x64
6ransomware...ye.exe
windows10-2004-x64
6ransomware...ap.exe
windows7-x64
6ransomware...ap.exe
windows10-2004-x64
6ransomware...ya.exe
windows7-x64
6ransomware...ya.exe
windows10-2004-x64
6ransomware...om.exe
windows7-x64
10ransomware...om.exe
windows10-2004-x64
10ransomware...ab.exe
windows7-x64
10ransomware...ab.exe
windows10-2004-x64
10ransomware...ye.exe
windows7-x64
10ransomware...ye.exe
windows10-2004-x64
10ransomware...ni.exe
windows7-x64
10ransomware...ni.exe
windows10-2004-x64
10ransomware...pt.exe
windows7-x64
10ransomware...pt.exe
windows10-2004-x64
10ransomware...ya.exe
windows7-x64
7ransomware...ya.exe
windows10-2004-x64
7ransomware...en.exe
windows7-x64
8Resubmissions
05/02/2025, 08:55
250205-kvkxmayrcz1005/02/2025, 06:37
250205-hdsvsswldm1017/03/2024, 04:49
240317-ffz1saef6510Analysis
- max time kernel
138s - max time network
160s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
17/03/2024, 04:49
Static task
static1
Behavioral task
behavioral1
Sample
ransomwares/7ev3n/7ev3n.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral2
Sample
ransomwares/7ev3n/7ev3n.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral3
Sample
ransomwares/Annabelle/Annabelle.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral4
Sample
ransomwares/Annabelle/Annabelle.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral5
Sample
ransomwares/BadRabbit/BadRabbit.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral6
Sample
ransomwares/BadRabbit/BadRabbit.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral7
Sample
ransomwares/Birele/Birele.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral8
Sample
ransomwares/Cerber 5/Cerber 5.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral9
Sample
ransomwares/Cerber 5/Cerber 5.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral10
Sample
ransomwares/Darkside/Darkside.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral11
Sample
ransomwares/Darkside/Darkside.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral12
Sample
ransomwares/DeriaLock/DeriaLock.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral13
Sample
ransomwares/DeriaLock/DeriaLock.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral14
Sample
ransomwares/Fake GoldenEye/FakeGoldenEye.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral15
Sample
ransomwares/Fake GoldenEye/FakeGoldenEye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral16
Sample
ransomwares/Fake PetrWrap/FakePetrWrap.exe
Resource
win7-20231129-en
windows7-x64
Behavioral task
behavioral17
Sample
ransomwares/Fake PetrWrap/FakePetrWrap.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral18
Sample
ransomwares/FakePetya/FakePetya.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral19
Sample
ransomwares/FakePetya/FakePetya.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral20
Sample
ransomwares/Fantom/Fantom.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral21
Sample
ransomwares/Fantom/Fantom.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral22
Sample
ransomwares/GandCrab/GandCrab.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral23
Sample
ransomwares/GandCrab/GandCrab.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral24
Sample
ransomwares/GoldenEye/GoldenEye.exe
Resource
win7-20240215-en
windows7-x64
Behavioral task
behavioral25
Sample
ransomwares/GoldenEye/GoldenEye.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral26
Sample
ransomwares/Huzuni/Huzuni.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral27
Sample
ransomwares/Huzuni/Huzuni.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral28
Sample
ransomwares/InfinityCrypt/InfinityCrypt.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral29
Sample
ransomwares/InfinityCrypt/InfinityCrypt.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
Behavioral task
behavioral30
Sample
ransomwares/JanusPetya/JanusPetya.exe
Resource
win7-20240221-en
windows7-x64
Behavioral task
behavioral31
Sample
ransomwares/JanusPetya/JanusPetya.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
Behavioral task
behavioral32
Sample
ransomwares/Krotten/Krotten.exe
Resource
win7-20240220-en
windows7-x64
General
- Target ransomwares/Huzuni/Huzuni.exe
- Size 65KB
- Sample240317-ffz1saef65
- SHA256 06b8827fc8494e0e7b284a8dcb704e38169347fb857e4114813a2b8db206ec2c
- MD5 e988915eb5706f5eeea7b684eec41a85
- SHA1 05d11b2d393e68af9200fd23eee1ccc0f5850289
- SHA512 2b8a784fb2333c1b2313eb557dd0bc551403ff0ce9be5422241e5274ae2028487f1a4386fb098cb93bcb633cdefedc8bade80501ac919248455d53c974ab3e22
- SSDEEP 1536:rmFEdOkJa9HLSQyzboPGRyfbYPstUKEMzL0HPV1vsHTV1:zwpi/5yFuKEM30HP7vsHT7
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" Huzuni.exe - Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
- Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" Huzuni.exe - Disables Task Manager via registry modification
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation Huzuni.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation Huzuni.exe - Executes dropped EXE 1 IoCs
pid Process 1572 Huzuni.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Pictures\Camera Roll\desktop.ini Huzuni.exe - Enumerates connected drives 3 TTPs 16 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Interacts with shadow copies 2 TTPs 14 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 4400 vssadmin.exe 1588 vssadmin.exe 4116 vssadmin.exe 1528 vssadmin.exe 4100 vssadmin.exe 3096 vssadmin.exe 660 vssadmin.exe 4032 vssadmin.exe 4212 vssadmin.exe 4048 vssadmin.exe 5116 vssadmin.exe 2784 vssadmin.exe 5044 vssadmin.exe 4936 vssadmin.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe 1572 Huzuni.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 3984 vssvc.exe Token: SeRestorePrivilege 3984 vssvc.exe Token: SeAuditPrivilege 3984 vssvc.exe Token: SeDebugPrivilege 1572 Huzuni.exe - Suspicious use of WriteProcessMemory 34 IoCs
description pid Process procid_target PID 332 wrote to memory of 1572 332 Huzuni.exe 87 PID 332 wrote to memory of 1572 332 Huzuni.exe 87 PID 332 wrote to memory of 3588 332 Huzuni.exe 88 PID 332 wrote to memory of 3588 332 Huzuni.exe 88 PID 3588 wrote to memory of 5044 3588 cmd.exe 90 PID 3588 wrote to memory of 5044 3588 cmd.exe 90 PID 1572 wrote to memory of 932 1572 Huzuni.exe 93 PID 1572 wrote to memory of 932 1572 Huzuni.exe 93 PID 3588 wrote to memory of 4936 3588 cmd.exe 95 PID 3588 wrote to memory of 4936 3588 cmd.exe 95 PID 3588 wrote to memory of 1588 3588 cmd.exe 96 PID 3588 wrote to memory of 1588 3588 cmd.exe 96 PID 3588 wrote to memory of 4100 3588 cmd.exe 97 PID 3588 wrote to memory of 4100 3588 cmd.exe 97 PID 3588 wrote to memory of 3096 3588 cmd.exe 98 PID 3588 wrote to memory of 3096 3588 cmd.exe 98 PID 3588 wrote to memory of 4048 3588 cmd.exe 100 PID 3588 wrote to memory of 4048 3588 cmd.exe 100 PID 3588 wrote to memory of 5116 3588 cmd.exe 102 PID 3588 wrote to memory of 5116 3588 cmd.exe 102 PID 3588 wrote to memory of 1528 3588 cmd.exe 103 PID 3588 wrote to memory of 1528 3588 cmd.exe 103 PID 3588 wrote to memory of 660 3588 cmd.exe 104 PID 3588 wrote to memory of 660 3588 cmd.exe 104 PID 3588 wrote to memory of 4116 3588 cmd.exe 105 PID 3588 wrote to memory of 4116 3588 cmd.exe 105 PID 3588 wrote to memory of 4032 3588 cmd.exe 106 PID 3588 wrote to memory of 4032 3588 cmd.exe 106 PID 3588 wrote to memory of 4400 3588 cmd.exe 107 PID 3588 wrote to memory of 4400 3588 cmd.exe 107 PID 3588 wrote to memory of 4212 3588 cmd.exe 108 PID 3588 wrote to memory of 4212 3588 cmd.exe 108 PID 3588 wrote to memory of 2784 3588 cmd.exe 109 PID 3588 wrote to memory of 2784 3588 cmd.exe 109 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\ransomwares\Huzuni\Huzuni.exe"C:\Users\Admin\AppData\Local\Temp\ransomwares\Huzuni\Huzuni.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:332 -
C:\Huzuni.exe"C:\Huzuni.exe"2⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /takeown /f C:\Windows\System32\Taskmgr.exe && icacls C:\Windows\System32\Taskmgr.exe /grant %username%:F && del C:\Windows\System32\Taskmgr.exe && exit3⤵PID:932
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\window.bat""2⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\system32\vssadmin.exevssadmin Delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:5044
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB3⤵
- Interacts with shadow copies
PID:4936
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded3⤵
- Interacts with shadow copies
PID:1588
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=d: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4100
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=d: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:3096
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=e: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4048
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=e: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:5116
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=f: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:1528
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=f: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:660
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=g: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4116
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=g: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4032
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=h: /maxsize=401MB3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4400
-
-
C:\Windows\system32\vssadmin.exevssadmin resize shadowstorage /for=c: /on=h: /maxsize=unbounded3⤵
- Enumerates connected drives
- Interacts with shadow copies
PID:4212
-
-
C:\Windows\system32\vssadmin.exevssadmin Delete shadows /all /quiet3⤵
- Interacts with shadow copies
PID:2784
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Huzuni.exe
- Size 52KB
- SHA256 0ce2f58a1b2c0d87c054ef212914d84ffeac59243b4a8a3a9c615c876638d87d
- MD5 ea9c5fca65378fe641a1b708187a582f
- SHA1 c7dba2587ffd02071fe12fdec646d70cf86d7f9e
- SHA512 1006b532ad2df8532be3fe651d24908e0b83240bf5af4ef52ba6341d56eac93fc35d75ae499b0f473354e3fc100d629a22daae206e4d05124842135559ca64ec
- SSDEEP 1536:yFEdOkJa9HLSQyzboPGRyfbYPstUKEMzL0HPV1:rwpi/5yFuKEM30HP7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\window.bat
- Size 1KB
- SHA256 0e79efbeae919d458e637000c20e4e71ddb916903527c593248038a78358f57d
- MD5 9dba906094ee0f15f38e0640e5923270
- SHA1 0118a885480cd04c5a4310fd3d39251dd769a3a5
- SHA512 e6985edc821486ce4ef0f467f348734ccab4aa1bacf961c4168de4e881960954a2c2c503824c9cc9f639ad9fff2e2df79241a75bf84cae99028082bdceee28e9
- MD5 SHA1 SHA512