Overview

overview

10

Static

static

3

2024-06-07...uk.exe

windows7-x64

7

2024-06-07...uk.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    143s
  • max time network
    160s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07/06/2024, 02:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2024-06-07_ccf28af40d78acf12f05894559150e70_ryuk.exe
  • Size 11.9MB
  • Sample240607-cq2qkshb44
  • SHA256 cdf13eedd60a35d7ed8f74721e36c8f77505fc4da9ec6ae34c0f4e47f73c590d
  • MD5 SHA1 SHA512 SSDEEP
Score
10/10
demonwareransomware

Malware Config

Extracted

Path

  • C:\Users\Admin\Pictures\README.txt

Ransom Note
  • Your personal files are encrypted by Nagini-Locker. What happened to my computer? [!] Your documents, photos, databases and other important files have been encrypted with strongest encryption and unique key, generated for this computer. [!] Private decryption key is stored on a secret internet server and nobody can decrypt your files until you pay and obtain the private key. [!] You have only 72 hours to submit the payment. If you do not send the money within provided time, all your files will be permanently crypted and leaked on internet. How do i pay? [!] Send 0.01 BTC to this Bitcoin adress [!] 3DfRZMeEAEuD1pjMrE8P4VnPBB863oebHn How to buy bitcoin? [!] www.coinbase.com [!] www.bitcoin.org How can i recover my files? [!] After your payment, contact us at [email protected] to get your decryption key. Nagini.
Wallets

  • 3DfRZMeEAEuD1pjMrE8P4VnPBB863oebHn

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

    ransomwaredemonware
  • Loads dropped DLL 36 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-06-07_ccf28af40d78acf12f05894559150e70_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-06-07_ccf28af40d78acf12f05894559150e70_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2640
    • C:\Users\Admin\AppData\Local\Temp\2024-06-07_ccf28af40d78acf12f05894559150e70_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2024-06-07_ccf28af40d78acf12f05894559150e70_ryuk.exe"
      2⤵
      • Loads dropped DLL
      PID:2996
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3812 --field-trial-handle=2292,i,2103142837140538807,15881446839139365070,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2772

    Network

          MITRE ATT&CK Matrix

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          _Salsa20.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_Salsa20.cp39-win_amd64.pyd
          • Size 15KB
          • SHA256 32724cd93515e542b24887c714e825d16f38dfc6c762711f566bf65c816a374c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_cbc.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_raw_cbc.cp39-win_amd64.pyd
          • Size 13KB
          • SHA256 be805b0cc32419859fbf0fc06c00fb178e49b51d67add736dc43750495fe0d06
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_cfb.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_raw_cfb.cp39-win_amd64.pyd
          • Size 14KB
          • SHA256 cae7b092bf323d5fb9bd97faa8839f9df6e946fe5cc5bf651d04e22b320fd280
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ctr.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_raw_ctr.cp39-win_amd64.pyd
          • Size 14KB
          • SHA256 030ba5b4aafda597cc62c2f340a2b2cdc15280b1f08f52c27a6aca4e34ad3870
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ecb.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_raw_ecb.cp39-win_amd64.pyd
          • Size 11KB
          • SHA256 ed33378b96f14afd0a181594fc6529c5fad386d62e156975151a2d3df3f3043e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _raw_ofb.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Cipher\_raw_ofb.cp39-win_amd64.pyd
          • Size 12KB
          • SHA256 b7cfa8ff75d2717e1ac01f95fa30def3f50b0661c37326f8081d281881305c21
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _BLAKE2s.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_BLAKE2s.cp39-win_amd64.pyd
          • Size 15KB
          • SHA256 7d1d5226be5f7e5a64be5c0334d1bc0654f95c4264a4ae188b1f6d3975f7f12d
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _MD5.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_MD5.cp39-win_amd64.pyd
          • Size 17KB
          • SHA256 3f56f08f3ceaec70cec7b45bd69c83999446ba0dfddc6636c05f0cde2fb9b1e6
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _SHA1.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_SHA1.cp39-win_amd64.pyd
          • Size 19KB
          • SHA256 da5a46d672008f2da7e016d47e8d10b8d343e386f5a1ed534d9986b9dc3ab821
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _SHA256.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_SHA256.cp39-win_amd64.pyd
          • Size 22KB
          • SHA256 2a1a9df342e7261425e7e83b674b32fc49918b970f147c728ca018cd9f3dffa5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ghash_clmul.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_ghash_clmul.cp39-win_amd64.pyd
          • Size 14KB
          • SHA256 b2094f11fdb9ed8db33fe33e86a8c4ac96c56679fbef7a20a15fe63e505811b3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ghash_portable.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Hash\_ghash_portable.cp39-win_amd64.pyd
          • Size 13KB
          • SHA256 9dacae80d6127546f0ceb0a36bfcaf34ac1cdc12ab30bf6165df15997a91a7c8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _scrypt.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Protocol\_scrypt.cp39-win_amd64.pyd
          • Size 13KB
          • SHA256 20a9494be4478051f62c18e98bb726be67d2d74df00c66afa754cbebf009616f
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _cpuid_c.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Util\_cpuid_c.cp39-win_amd64.pyd
          • Size 11KB
          • SHA256 4aee6a9621fe296fd2608364d34bdada63a34f64606623e73466e5183e9b6f8e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _strxor.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\Crypto\Util\_strxor.cp39-win_amd64.pyd
          • Size 11KB
          • SHA256 c8da8ad5af56d5d5ba7d338ab23f5f78239229218a6ac2735564b5d08b2da3f3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _imaging.cp39-win_amd64.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\PIL\_imaging.cp39-win_amd64.pyd
          • Size 2.5MB
          • SHA256 c565c21a3a42752ca70a21747a9f96b46ee778ad5531c77535ea1d1be8998ac9
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          VCRUNTIME140.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\VCRUNTIME140.dll
          • Size 91KB
          • SHA256 8ee6b49830436ff3bec9ba89213395427b5535813930489f118721fd3d2d942c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _bz2.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_bz2.pyd
          • Size 84KB
          • SHA256 6c2bbed242c399c4bc9b33268afe538cf1dea494c75c8d0db786030a0dcc4b7e
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _ctypes.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_ctypes.pyd
          • Size 123KB
          • SHA256 c1e3e9548243ca523f1941990477723f57a1052965fccc8f10c2cfae414a6b8a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _elementtree.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_elementtree.pyd
          • Size 173KB
          • SHA256 a048bae40ececd2d56a79216c8552e3a3e6f9c4bfa1f6fb1c4987b954b80bcb1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _hashlib.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_hashlib.pyd
          • Size 64KB
          • SHA256 8aa7abe0a92a89adf821e4eb783ad254a19858e62d99f80eb5872d81e8b3541c
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _lzma.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_lzma.pyd
          • Size 158KB
          • SHA256 ac0ceb8e6b5e67525b136b5ce97500fe4f152061b1bf2783f127eff557b248a3
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _socket.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_socket.pyd
          • Size 78KB
          • SHA256 09ab789238120df329956278f68a683210692c9bcccb8cd548c771e7f9711869
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          _tkinter.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\_tkinter.pyd
          • Size 63KB
          • SHA256 7b42c10c651931b8984e4797fc713656bcce4db420197881f9d9946daad0cf6a
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          base_library.zip
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\base_library.zip
          • Size 767KB
          • SHA256 013a0d369fbe2f0a43065db1ce99a024ebb08019530d64d18fed4e3d2e7ece56
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libcrypto-1_1.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\libcrypto-1_1.dll
          • Size 3.2MB
          • SHA256 594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          libffi-7.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\libffi-7.dll
          • Size 32KB
          • SHA256 f60dd9f2fcbd495674dfc1555effb710eb081fc7d4cae5fa58c438ab50405081
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          pyexpat.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\pyexpat.pyd
          • Size 185KB
          • SHA256 2d59ddb10d0fa2516da1e879d2b3f180272160a4325f705d4e71ed21b90438b8
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          python39.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\python39.dll
          • Size 4.2MB
          • SHA256 53f27444e1e18cc39bdb733d19111e392769e428b518c0fc0839965b5a5727a2
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          select.pyd
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\select.pyd
          • Size 27KB
          • SHA256 b26b6631d433af5d63b8e7cda221b578e7236c8b34b3cffcf7630f2e83fc8434
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          tcl86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\tcl86t.dll
          • Size 1.6MB
          • SHA256 f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          cp1252.enc
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\tcl\encoding\cp1252.enc
          • Size 1KB
          • SHA256 14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0
          • MD5 SHA1 SHA512
          Submit Download

          tk86t.dll
          • Path C:\Users\Admin\AppData\Local\Temp\_MEI26402\tk86t.dll
          • Size 1.4MB
          • SHA256 1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5
          • MD5 SHA1 SHA512 SSDEEP
          Submit Download

          README.txt
          • Path C:\Users\Admin\Pictures\README.txt
          • Size 854B
          • SHA256 f8cd21d98a035420d1569f059f53754e3a743ef43c760e413341986326894c1b
          • MD5 SHA1 SHA512
          Submit Download