Analysis
-
max time kernel
52s -
max time network
53s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
14-06-2024 14:34
Static task
static1
Behavioral task
behavioral1
Sample
2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe
Resource
win10v2004-20240508-en
General
-
Target
2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe
-
Size
38KB
-
MD5
4a38ede90c924aa5e3e2e1dc67f432e1
-
SHA1
2f88914130f08712a3fecea34fd6e4993f58c2c1
-
SHA256
58baea354fb8318158364b476a5e7b7662f4c56b6d71219b324d3c1a14b7f909
-
SHA512
ab795c8f2e4bc7458a64447babdda3f93d12a2e229939e97ccbed36f15a096c521b34b57359f901d29a4d1aa2c30f8de61e06abad1c4222485d5612ae79ab213
-
SSDEEP
768:UMs3yBEgMYosM5Ar/xY6Xc4FSimT3oDz/KVA5m1q:vdB5bM5Ar/S6Xc4FnmT3oDz/KV
Malware Config
Signatures
-
Renames multiple (185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops desktop.ini file(s) 25 IoCs
Processes:
2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exedescription ioc process File opened for modification C:\Users\Admin\Links\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Libraries\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\3D Objects\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Documents\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Downloads\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Pictures\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\OneDrive\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Searches\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Documents\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Downloads\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Desktop\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Favorites\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Videos\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Desktop\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Music\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Pictures\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Contacts\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Admin\Saved Games\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\AccountPictures\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Music\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened for modification C:\Users\Public\Videos\desktop.ini 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exedescription ioc process File opened (read-only) \??\G: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\H: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\J: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\P: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\W: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\E: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\K: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\S: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\U: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\X: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\Y: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\L: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\N: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\Q: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\R: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\I: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\M: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\O: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\T: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\V: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe File opened (read-only) \??\Z: 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
625B
MD55aea0bfd70679b3285da2ce305e5d992
SHA1bd90c1be51b76fb43dcb46d9781cfbebdf655520
SHA25691b4c8028e4a86fb2fa57ef0e4f01e860ba23c1fe5ed88aa84915e281a57deb5
SHA512c5ef4fa016103775c9581010e845cca0291ce8e33bbc16fa7c4b8059367cddcdc7a02aedc26959fba3437cef70b2167d0f815fc8f3698ba0b85da447c6e0fb96