Malware Analysis Report

2024-10-18 21:35

Sample ID 240614-rxtqwaycnl
Target 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa
SHA256 58baea354fb8318158364b476a5e7b7662f4c56b6d71219b324d3c1a14b7f909
Tags
ransomware
score
9/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
9/10

SHA256

58baea354fb8318158364b476a5e7b7662f4c56b6d71219b324d3c1a14b7f909

Threat Level: Likely malicious

The file 2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa was found to be: Likely malicious.

Malicious Activity Summary

ransomware

Renames multiple (289) files with added filename extension

Renames multiple (185) files with added filename extension

Drops desktop.ini file(s)

Enumerates connected drives

Unsigned PE

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-14 14:34

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-14 14:34

Reported

2024-06-14 14:37

Platform

win7-20240508-en

Max time kernel

119s

Max time network

120s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe"

Signatures

Renames multiple (289) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links for United States\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Recorded TV\Sample Media\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Recorded TV\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Videos\Sample Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Music\Sample Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Pictures\Sample Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe"

Network

N/A

Files

C:\MSOCache\All Users\{90140000-0011-0000-0000-0000000FF1CE}-C\NOKOYAWA_readme.txt

MD5 5aea0bfd70679b3285da2ce305e5d992
SHA1 bd90c1be51b76fb43dcb46d9781cfbebdf655520
SHA256 91b4c8028e4a86fb2fa57ef0e4f01e860ba23c1fe5ed88aa84915e281a57deb5
SHA512 c5ef4fa016103775c9581010e845cca0291ce8e33bbc16fa7c4b8059367cddcdc7a02aedc26959fba3437cef70b2167d0f815fc8f3698ba0b85da447c6e0fb96

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-14 14:34

Reported

2024-06-14 14:37

Platform

win10v2004-20240508-en

Max time kernel

52s

Max time network

53s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe"

Signatures

Renames multiple (185) files with added filename extension

ransomware

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Users\Admin\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Libraries\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\3D Objects\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Favorites\Links\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\OneDrive\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Pictures\Camera Roll\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Searches\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Documents\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Downloads\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Favorites\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Desktop\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Pictures\Saved Pictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Contacts\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Admin\Saved Games\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\AccountPictures\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Music\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened for modification C:\Users\Public\Videos\desktop.ini C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-14_4a38ede90c924aa5e3e2e1dc67f432e1_nokoyawa.exe"

Network

Files

C:\Recovery\WindowsRE\NOKOYAWA_readme.txt

MD5 5aea0bfd70679b3285da2ce305e5d992
SHA1 bd90c1be51b76fb43dcb46d9781cfbebdf655520
SHA256 91b4c8028e4a86fb2fa57ef0e4f01e860ba23c1fe5ed88aa84915e281a57deb5
SHA512 c5ef4fa016103775c9581010e845cca0291ce8e33bbc16fa7c4b8059367cddcdc7a02aedc26959fba3437cef70b2167d0f815fc8f3698ba0b85da447c6e0fb96