Analysis

  • max time kernel
    122s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    17/03/2025, 01:30

General

  • Target

    2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe

  • Size

    11.5MB

  • MD5

    8099f355d023f687efab26a1323977c7

  • SHA1

    6839dd1d3b1c92ee02df1a9daa0771b83ab1a983

  • SHA256

    bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9

  • SHA512

    7afade18da1755a3811b8cf0ea980077896e67eb2523bea2bb874c34d0ad076933ebfb6c12cd5dea2f33e86101544c8a77f025a58c2fff6ccd1287debd9da314

  • SSDEEP

    196608:aPXLYgk+yA9//qt++3HF9onJ5hrZEE3e9tGPqKM48RmU/3ZlsPvpEbPCTbPKRTvI:aY+Cl9c5hlEE/PNMtN3ZWqDC3PuTZU

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Desktop\README.txt

Family

demonware

Ransom Note
Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs

https://keys.zeznzo.nl

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

  • Demonware family
  • Loads dropped DLL 54 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2472
    • C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:2516

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\VCRUNTIME140.dll

    Filesize

    85KB

    MD5

    89a24c66e7a522f1e0016b1d0b4316dc

    SHA1

    5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

    SHA256

    3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

    SHA512

    e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\_bz2.pyd

    Filesize

    92KB

    MD5

    cf77513525fc652bad6c7f85e192e94b

    SHA1

    23ec3bb9cdc356500ec192cac16906864d5e9a81

    SHA256

    8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41

    SHA512

    dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\_tkinter.pyd

    Filesize

    68KB

    MD5

    09f66528018ffef916899845d6632307

    SHA1

    cf9ddad46180ef05a306dcb05fdb6f24912a69ce

    SHA256

    34d89fe378fc10351d127fb85427449f31595eccf9f5d17760b36709dd1449b9

    SHA512

    ed406792d8a533db71bd71859edbb2c69a828937757afec1a83fd1eacb1e5e6ec9afe3aa5e796fa1f518578f6d64ff19d64f64c9601760b7600a383efe82b3de

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-core-file-l1-2-0.dll

    Filesize

    11KB

    MD5

    07aa9916d3383d7e040a88665a6df67f

    SHA1

    549c5cd800dc3b51ffb552333777d92cddfb299d

    SHA256

    650555a4c89bfa77054e453ea61f2fe9f095f15a13629f964b903ec7fc07dd12

    SHA512

    d4c70acb84004d27cfe5db22dddccd90217f95d6d2425bbe4359f318056817b669c98907e2679111c49ccf0321011a60cac88c7156566e825b1ea9b1a12e2189

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-core-file-l2-1-0.dll

    Filesize

    11KB

    MD5

    966f1686b72929b452c7c0999791d42f

    SHA1

    20961fd566d789b5657f65595c3a39622c569a22

    SHA256

    2f7553fc7b0e511813ef7639cab9b2466348eeb78ffc534a12e2e271af8e7ce8

    SHA512

    b427eea99d197889e4a4b8801a45baebd20824983f38794ef0e81723c9592c28d75f39744691f650e220208e5f072d61470add4fc99221383e0a89369de5ab93

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-core-localization-l1-2-0.dll

    Filesize

    13KB

    MD5

    3c40a9d1ae0b5e72b2f90761a0fd49cf

    SHA1

    567282eedcb721a7137dde2f135704a50f3cd883

    SHA256

    91c4f107fe8e8c902728e131672bd6953d94964b7a0f1edcc004ae5f471a2a42

    SHA512

    d8f69f1c6ea2837e56c98a2591dbd3a336c40e2ad0af45550406cd00c70fbbc3d7c7594509bef4418aa45e0faf0cb7ce739e6e986ab505b4cd32ce595c236243

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-core-processthreads-l1-1-1.dll

    Filesize

    11KB

    MD5

    25cd5a26ea59e6f4c082b8945b16fc3a

    SHA1

    851ea9bfebbbc901edc98f928d59fb03d15a0037

    SHA256

    093b7168f6b64c655464d9bbf51bbc29456772ff747763c112ed206e023c69cf

    SHA512

    dc001828c40e4a85791644d100eea7132951b2644b59f7f147f17feac515d405313289d5aafbf147ffb1913ce855a501ae79acf832c32ed08d348352c80e9cf3

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-core-timezone-l1-1-0.dll

    Filesize

    11KB

    MD5

    cf403b7b90696ab2ded707ffdea27112

    SHA1

    8d25084c7d24143cf95303bfa0654a42d9cb0ca2

    SHA256

    f5f5e3cfa9237bb04bd485f28cecd07892212335648d32e9e3e1b248784baeb6

    SHA512

    0004a31e0982fc4007c7fdaf0d06b6d3a19dc35ca00feeb8f161b62695b063bb07fb409c0926a1f95a4698ca57c22f773d9a431eee586633b075366de0cbacca

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-conio-l1-1-0.dll

    Filesize

    12KB

    MD5

    ed14b64c94f543974b7fdc592fa0594b

    SHA1

    dc66ca3de44c021d89ebd5160c447aaedc565514

    SHA256

    9165248996814b72f6a334750e65994b39f971267ffc95f759e529356fa3125c

    SHA512

    5d20bedcfb8d2f603b3f27d874a9e0e3a7ca7df4809aab52b02af630c0037b37923536cc93c78c9deb014df28e378d16d67e99688f8b656e3e7bfd1e2e914dcc

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-heap-l1-1-0.dll

    Filesize

    12KB

    MD5

    f97e7878a2b372291b1269d80327bbf6

    SHA1

    cee6f776fe0aa5a6d4854058f20f675253f48998

    SHA256

    c4e195d297d163a49514847ef166da614499404d28bc9419e3e6a28a8e03e9b6

    SHA512

    475898e60ffc291362fda45ab710b9ddaf1cf5e82f66dfcc04998ded583c54692ecfcac6cc4fe21b32bdd0e4dce8ac32fd9aecca2b0b60f129415180350d7825

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-locale-l1-1-0.dll

    Filesize

    11KB

    MD5

    761ddd8669a661d57d9cf9c335949c06

    SHA1

    251bbcad15771d80492f1deb001491a7abb6c563

    SHA256

    fe51064e0728d553d0f3e96967671f7e6ae4ebd35d821679292014dd4c3bb8e3

    SHA512

    5ad590a5f81532f8bf21fb4f62bc248e71bbf657dfb1720b2d9f1628033afe39426a1c27a89d9a06e50849bd0ed2242afa93e4cf2bc83f03a922b8204f0f4f2a

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-runtime-l1-1-0.dll

    Filesize

    15KB

    MD5

    bbae7b5436d6d1b0fc967ff67e35415f

    SHA1

    f67bc165cefb119ad767b6bec27a1102c0fd2bac

    SHA256

    8150a238851d7da74bc8f6f13262a8d6568373dc509f67544ab6a62398f20c4f

    SHA512

    4201a8edfe303057545d04de683bbdf0acb68cf4d2e894192f899a70398df18299432c0f6caee72d917a986882bbc0585035a9b934d4579f67a1c98cc894dee2

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-stdio-l1-1-0.dll

    Filesize

    17KB

    MD5

    53e9526af1fdce39f799bfe9217397a8

    SHA1

    f4a7fbd2d9384873f708f1eeaeb041a3fbe2c144

    SHA256

    de44561e4587c588bc140502fd6cd52e5955abeec63d415be38a6d03f35f808f

    SHA512

    8167ee463506fe0e9d145cc4e0dc8a86f1837ae87bc9efe61632fb39ef996303e2f2a889b6b02ff4a201faf73f3e76e52b1b9af0263c6fcfdac9e6ea32b0859f

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-string-l1-1-0.dll

    Filesize

    17KB

    MD5

    eccf5973b80d771a79643732017cea9a

    SHA1

    e7a28aa17e81965ca2d43f906ed5ab51ac34ee7c

    SHA256

    038b93e611704cc5b9f70a91ebf06e9db62ef40180ec536d9e5ab68eb4bb1333

    SHA512

    b95f5efc083716cb9daba160b8fa7b94f80d93ab5de65a9fb0356c7fb32c0d45fe8d5d551e625a4d6d8e96b314bae2d38df58b457b6ced17a95d11f6f2f5370e

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-time-l1-1-0.dll

    Filesize

    13KB

    MD5

    090dd0bb2bddee3eaae5b6ff15fae209

    SHA1

    ddc5ac01227970a4925a08f29ba65eb10344edb1

    SHA256

    957177c4fe21ae182dfe3a2a13a1ff020f143048fc14499ae9856e523605083e

    SHA512

    2e0b8567231e320b2e52af3b86047cfab16824e2db1d1bb17bafe7a1c6c5f0bf62d76656206a3d7ef1d3849b479bf5e09db1f0f4e4cd0aa2df09838d35c877f3

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\base_library.zip

    Filesize

    769KB

    MD5

    fa5d95091901e5fcb3f30956da007aa2

    SHA1

    f49ca7f7e422af6cd6461a70627ef1cd30d6f562

    SHA256

    7ae597d785381425377fc205f26ed0fa6fb031e0adca29d9c80b802c0a6270f3

    SHA512

    28167fbdd5737c974e8fa6af62f3f4cf1ae61a24bd0f6759d5b2cff580db4704eea7d21404fdc11714e7580299d43b070455290558f280115a3701f24da24274

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\python37.dll

    Filesize

    3.6MB

    MD5

    c4709f84e6cf6e082b80c80b87abe551

    SHA1

    c0c55b229722f7f2010d34e26857df640182f796

    SHA256

    ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

    SHA512

    e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

  • C:\Users\Admin\AppData\Local\Temp\_MEI24722\ucrtbase.dll

    Filesize

    961KB

    MD5

    2381e189321ead521ff71e72d08a6b17

    SHA1

    0db7fea07b4bc14f0f9d71ecfa6ddf3097229875

    SHA256

    4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806

    SHA512

    2d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5

  • C:\Users\Admin\Desktop\README.txt

    Filesize

    575B

    MD5

    efd54055b28e173ea64831fc59a0aca8

    SHA1

    cdf18b0692a53cbeed66ee14fa0f54666cf04013

    SHA256

    e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99

    SHA512

    5ecf69dbdf824a6e0221e7f953ed58889bbd76ee563e9fc7e5d95b68245d0f4af0e0ec5f13f002975b65bacf0cd29027964b9f8c4174134ed08358e41b58f4d5

  • \Users\Admin\AppData\Local\Temp\_MEI24722\PIL\_imaging.cp37-win_amd64.pyd

    Filesize

    2.5MB

    MD5

    4950d9d67d4661237ed76d8011dde67e

    SHA1

    1f2229ccabea756d1ce883ee2469dac54403bf93

    SHA256

    70557af68ecc14faa19b03c5f1bc4ac3c26e742b9a2232f0eaad3bba2def0701

    SHA512

    02380d434591a7061d2051d6926b9f6260bebc49c70656844538e166cfd88026f1f9caeee2e39fced576ad81c5d57daef2a9930e8fbb2454d43d8d3f72a7afda

  • \Users\Admin\AppData\Local\Temp\_MEI24722\_ctypes.pyd

    Filesize

    129KB

    MD5

    5e869eebb6169ce66225eb6725d5be4a

    SHA1

    747887da0d7ab152e1d54608c430e78192d5a788

    SHA256

    430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

    SHA512

    feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

  • \Users\Admin\AppData\Local\Temp\_MEI24722\_elementtree.pyd

    Filesize

    203KB

    MD5

    7d0c4ab57fdc1bd30c0e8e42ccc2aa35

    SHA1

    81bff07b6b5dd843e2227a3e8054500cfec65983

    SHA256

    ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db

    SHA512

    56ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe

  • \Users\Admin\AppData\Local\Temp\_MEI24722\_hashlib.pyd

    Filesize

    38KB

    MD5

    b32cb9615a9bada55e8f20dcea2fbf48

    SHA1

    a9c6e2d44b07b31c898a6d83b7093bf90915062d

    SHA256

    ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5

    SHA512

    5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

  • \Users\Admin\AppData\Local\Temp\_MEI24722\_lzma.pyd

    Filesize

    172KB

    MD5

    5fbb728a3b3abbdd830033586183a206

    SHA1

    066fde2fa80485c4f22e0552a4d433584d672a54

    SHA256

    f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b

    SHA512

    31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

  • \Users\Admin\AppData\Local\Temp\_MEI24722\_socket.pyd

    Filesize

    75KB

    MD5

    8ea18d0eeae9044c278d2ea7a1dbae36

    SHA1

    de210842da8cb1cb14318789575d65117d14e728

    SHA256

    9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2

    SHA512

    d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-convert-l1-1-0.dll

    Filesize

    15KB

    MD5

    1908861649e67cdc20c563c234a89914

    SHA1

    471ae3b9a3b40e63c880362892865ecf8bd80f67

    SHA256

    4aea1cedd976ef15a47a3433f3a2e176b1c5e495a54497dba27247b35a1b8449

    SHA512

    dec24d5c3f31c90cbec3810290506309a1db5677022c600d3bdd2e92b73078dc6353023f2aeefa408aceac7c9f7ed5a2ff07a399b446e177ff93e5fa1b3f9353

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-environment-l1-1-0.dll

    Filesize

    11KB

    MD5

    af851dfd0d9fecb76ff2b403f3c30f5b

    SHA1

    30f79fb4d4c91af847963c46882d095d1f42efbe

    SHA256

    6a3fd4b050f19ec5c53c15544b1f1b1540ac84f6061c0ec353983eb891330fda

    SHA512

    04509b02115ec9b5bc4ee2f90e49e799ccf85884fe1f11f762f0614a96764b8f2b08f96895c467c5b11f20273183096b2bcceb0b769df9d65b56c378cb32b0f5

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-filesystem-l1-1-0.dll

    Filesize

    13KB

    MD5

    0f143310fade4de116070a3917a79c18

    SHA1

    b9a092e885c73cb6d33c9e17d429ede950cf3a26

    SHA256

    2def5140c289b89c9a27a2112a2cc01ad1a902944c597d6204bed4efbc09ff7a

    SHA512

    f87104272aa2326641e46450a0333626567ab3fa85a89b81f7a7c0b1f90a47a70ea189ce3f6bf5db6bb5cccda6d190fb2276edeb44334245b210e7faca05fc60

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-math-l1-1-0.dll

    Filesize

    20KB

    MD5

    56556659c691dd043dbe24b0a195d64c

    SHA1

    117b9a201d1e8bb9e5fadeae808141d3fa41fb60

    SHA256

    2e1664e05c238d529393162f23640a51def436279184d2e2c16cfbf92ab736c1

    SHA512

    a8d4c4a24e126c62b387120bae0edd5cbce6d33b026590ff7470d72eb171ffe62b8b2b01e745079c9a06cf1eb78a166707514715e17bbd512981792a1d2127e0

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-process-l1-1-0.dll

    Filesize

    12KB

    MD5

    6631c212f79350458589a5281374b38b

    SHA1

    88be6865aac123ffbdafec32a6fba34a26428875

    SHA256

    52cc325a4c2158b687c95f9702f4be2e3ec41c80207e50f252f5620ba1784649

    SHA512

    e53d7bfa2639efccdb66d37957972fd1f8eb2beea3a81145588ed622501ee50261e05a06611ee7126564b11a5301b109f295d062f1a2dc1e44a2847000fd7298

  • \Users\Admin\AppData\Local\Temp\_MEI24722\api-ms-win-crt-utility-l1-1-0.dll

    Filesize

    11KB

    MD5

    cc337898e64d9078cb697ac19f995c7f

    SHA1

    2ebcfa0cdf865fe40cbaf4ffce6d3903aea47e3c

    SHA256

    e7ef5d714fc21dd1aa9db0c4eefe634463eefbd5aa4454a568bfc52e04fddf18

    SHA512

    6960fa9617514ca223b9abda9a3a6c69cf05474b3c5fec2be6c6d5f65580c7a18e129b6d207f21eb136b0737481107e09c20b0398826284ce5f9a65a3cf8a1ca

  • \Users\Admin\AppData\Local\Temp\_MEI24722\pyexpat.pyd

    Filesize

    198KB

    MD5

    6500aa010c8b50ffd1544f08af03fa4f

    SHA1

    a03f9f70d4ecc565f0fae26ef690d63e3711a20a

    SHA256

    752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec

    SHA512

    f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1

  • \Users\Admin\AppData\Local\Temp\_MEI24722\select.pyd

    Filesize

    26KB

    MD5

    fb4a0d7abaeaa76676846ad0f08fefa5

    SHA1

    755fd998215511506edd2c5c52807b46ca9393b2

    SHA256

    65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429

    SHA512

    f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f