Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
29/05/2024, 06:44
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe
Resource
win7-20240508-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
3 signatures
150 seconds
General
- Target 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe
- Size 501KB
- Sample240529-hhpzpsef45
- SHA256 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51
- MD5 bf55c921b638ddf41a5120c90fe5f211
- SHA1 6a96dd8be36381d71eb7dac5f7a053064b546487
- SHA512 a3d91c51eb3bd59792f6cca32def989b4d069e489dcb74263f5f629fe300f4074b1a7d8a7a64410d7efc992e1d332108147aa0b2611e0777358749d7adfac166
- SSDEEP 12288:bGlEhiu/o/eXUG8nfBG5K92Qg+fgFfwjUKWXNDtn0lF620D4JNuq6JFcP:bGei/mUNaK9259wjU3dt0lF6264JArJs
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Path
-
C:\Program Files (x86)\!nissenvelten!HOW_TO_RESTORE.log
-
rook
Ransom Note
- Hello! We warned you, but you even didn't replied Forced shutdown of devices can lead to the loss of all data. Do not forcibly disconnect storage volumes from hosts, don't interrupt process. Damaged information cannot be recovered. All data is properly protected against unauthorized access by steady encryption technology. We have downloaded essential data of company: - Huge amount of files, including: HR,Financial,Accounting,... - Large amounts of personal records of your employees and residents. - about 1TB (!!!) of data! In case if you refuse to cooperate with us, all essential data will be sold or published at dark marketplace. Full details and proofs will be provided in case of contacting us by following emails. [email protected] [email protected] It's just a business. We can help you to quickly recover all your files. We will explain what kind of vulnerability was used to hack your network. If you will not cooperate with us, you will never know how your network was compromised. We guarantee this will happen again. We can decrypt 2 small files (up to 1MB) for free. Send files by email. Register new email account at secure mail service like mailfence, protonmail to be sure that outgoing email not blocked by spam filter. Don't use gmail! WARNING! Don't report to police. They will suspend financial activity of company and negotiation process. �
Signatures
- Rook
Rook is a ransomware which copies from NightSky ransomware.
- Renames multiple (6455) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
- Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\ExcelNaiveBayesCommandRanker.txt.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherImages\210x173\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ja-jp\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\ca-es\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Java\jdk-1.8\README.html.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_2019.807.41.0_neutral_~_8wekyb3d8bbwe\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\ja-jp\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\sv-se\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\sk-sk\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\AccessR_OEM_Perp-ul-phn.xrm-ms.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\POWERPNT.VisualElementsManifest.xml.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\Font\MyriadPro-BoldIt.otf.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\selector.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\ru-ru\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\VBA\VBA7.1\1033\FM20.CHM.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\Microsoft Office\root\Templates\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\server_ok.gif.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Retail-ul-phn.xrm-ms.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ka.pak.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\Logos\StoreLogo\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\sk-sk\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Java\jre-1.8\lib\fonts\LucidaSansDemiBold.ttf.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_neutral_split.scale-100_8wekyb3d8bbwe\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.MSPaint_6.1907.29027.0_x64__8wekyb3d8bbwe\Assets\StartScreen\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.DesktopAppInstaller_1.0.30251.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\es\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Grace-ppd.xrm-ms.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\it-it\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\es-es\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\StepApprove.asf.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudent2019R_Retail-ul-oob.xrm-ms.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\open_original_form.gif.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Trust Protection Lists\Sigma\LICENSE.DATA.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.WindowsCalculator_2020.1906.55.0_neutral_~_8wekyb3d8bbwe\microsoft.system.package.metadata\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\de-de\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Bibliography\Style\APASixthEditionOfficeOnline.xsl.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\zh-cn\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\nb-no\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\en-ae\ui-strings.js.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\en-il\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\dialogs\equalizer_window.html.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_neutral_split.scale-200_8wekyb3d8bbwe\microsoft.system.package.metadata\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\Microsoft Office\root\Office16\MSIPC\sv\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\kk.pak.DATA.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\WPFT632.CNV.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\ResiliencyLinks\Locales\fa.pak.DATA.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\remove.svg.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\en-ae\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\MSO.ACL.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CONCRETE\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File created C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\js\plugins\selection-action-plugins\cpdf\!nissenvelten!HOW_TO_RESTORE.log 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\de_get.svg.nissenvelten-sjj3hhut 1a130d16a9e828cccb6a2135cbd7f1615219979612e0bae67cbe7c9a9606cf51.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\!nissenvelten!HOW_TO_RESTORE.log
- Size 1KB
- SHA256 72e9a50a52585a25c5529b846cf586946694e46a912a97b526e4a7067ab1d7e6
- MD5 1ac13e1c2b35dfaf377ceb55e61e5309
- SHA1 e53185eee04a0578483054e507d639be2635b4d7
- SHA512 fa702569f13d82d24e78cba21397f0d53281c0a93db7a484bb974f4cb965da23dd4691c7061de6bfd54e40d5d32faa2e8b8af52968191b91f9164f5c7d459fa6
- MD5 SHA1 SHA512