Analysis

  • max time kernel
    102s
  • max time network
    114s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250314-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
  • submitted
    17/03/2025, 01:30

General

  • Target

    2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe

  • Size

    11.5MB

  • MD5

    8099f355d023f687efab26a1323977c7

  • SHA1

    6839dd1d3b1c92ee02df1a9daa0771b83ab1a983

  • SHA256

    bf0e8e9c10d34111aa67a2ef8582518144362096c4942cec0cdc9c8c3dbfdcb9

  • SHA512

    7afade18da1755a3811b8cf0ea980077896e67eb2523bea2bb874c34d0ad076933ebfb6c12cd5dea2f33e86101544c8a77f025a58c2fff6ccd1287debd9da314

  • SSDEEP

    196608:aPXLYgk+yA9//qt++3HF9onJ5hrZEE3e9tGPqKM48RmU/3ZlsPvpEbPCTbPKRTvI:aY+Cl9c5hlEE/PNMtN3ZWqDC3PuTZU

Score
10/10

Malware Config

Extracted

Path

C:\Users\Admin\Pictures\README.txt

Family

demonware

Ransom Note
Tango Down! Seems like you got hit by DemonWare ransomware! Don't Panic, you get have your files back! DemonWare uses a basic encryption script to lock your files. This type of ransomware is known as CRYPTO. You'll need a decryption key in order to unlock your files. Your files will be deleted when the timer runs out, so you better hurry. You have 10 hours to find your key C'mon, be glad I don't ask for payment like other ransomware. Please visit: https://keys.zeznzo.nl and search for your IP/hostname to get your key. Kind regards, Zeznzo
URLs

https://keys.zeznzo.nl

Signatures

  • DemonWare

    Ransomware first seen in mid-2020.

  • Demonware family
  • Loads dropped DLL 36 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
    "C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2060
    • C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe
      "C:\Users\Admin\AppData\Local\Temp\2025-03-17_8099f355d023f687efab26a1323977c7_ryuk.exe"
      2⤵
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      PID:4216

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_Salsa20.cp37-win_amd64.pyd

    Filesize

    14KB

    MD5

    2b6eac8d1d5cd08279f4c711f84e3953

    SHA1

    c1b44d08dcf6fe7f50a1707d91f606b70538ce62

    SHA256

    a05ffcf7b30d87021f67dc94324f4e7e0481809b07f59cbc77b6798aeb319e7b

    SHA512

    827215a6894c20e9dde798a660ba49f5810d48d50f75cbbe88607254dbd5bad9518c612f1a06fdd932e3836e928ef9f04df7ce4800614e09ca74fffc0070b86d

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_raw_cbc.cp37-win_amd64.pyd

    Filesize

    12KB

    MD5

    b768eda0fa972c9cd34cebc1e7c4b54e

    SHA1

    95967222a6902226e9bc94bc1503c1638fbcc7cc

    SHA256

    4e872e1aa9229a3e95a970af1b6a71c17c5ab84e53a57012c5c7c4412fafeb3f

    SHA512

    fcf4de7f5be68bb029cd5f6a6413ce3fc1db0ea3d58152b766f86ae1c81653ac9c1b303b8622bb2a34b254f1b9f33e8422b42642992936512d80f435e5229690

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_raw_cfb.cp37-win_amd64.pyd

    Filesize

    12KB

    MD5

    00afcb334aa9cbc635ffb7864d487bca

    SHA1

    9b0c29dc4c01984ef63d2b868b7d27637aeabde2

    SHA256

    69e5945cde019e9dcdc23404e81fcc7dd2313eebf259daa3a5af537eaf418267

    SHA512

    ef1b73b5906713f9b90afc41c60a29d45a1630a6ab1c22be1cc7aa72dc5db7b7bc90dfce1eefda9167a98e911952f7232c5c0f1c4e043428d292cf64fbae284b

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_raw_ctr.cp37-win_amd64.pyd

    Filesize

    13KB

    MD5

    d02012848d57be3b3967d379ea42426e

    SHA1

    69610f7f1f35830639cdcf74f99a20be5bb011c7

    SHA256

    cc1782f000f855b66ff94ddbb34dae3aa520c3fbb98b972c5561f2745791849d

    SHA512

    51f2dbc9f74b9190fa1f395cac5e8e1b60ac3181da169477e7510411700d42bdcf426285cce8a09983eaa84597621c892d5dc360c56231031e2fc702cddd1be1

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_raw_ecb.cp37-win_amd64.pyd

    Filesize

    10KB

    MD5

    ea90e3f80b3f3d089e20514e52cae4bb

    SHA1

    2bd4a5e1b0871ef7ca753b635101216422260eee

    SHA256

    256f905da0b889b74dcc0ed69a090f26b92e82936e1b149ed1c6d413b45eff96

    SHA512

    8a8715842b1773386aa75a4eb7136cb8c43da3330e54eddf952469e165c59fe8ce3ed439db6b89e24d1640cec3c64ca2bb3d673727d6a90e9cbd161602d7692c

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Cipher\_raw_ofb.cp37-win_amd64.pyd

    Filesize

    11KB

    MD5

    22d65fdceebad51d277a2d8db999b237

    SHA1

    f65ed91b8bab5c2766f4aeaa86580de0017770ad

    SHA256

    3a4a5aaaa9a80180601376412180b024dbd43c1a3c313dc408dcdd5ee208cd6a

    SHA512

    d574e7ba77d4bcea014742678608ce46b51b585a6cc8b6e2a2c064b426042c769083f5a74cebe00800283e6efc8f7b079ef0720c2a7bf51098b5f51978419dc9

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_BLAKE2s.cp37-win_amd64.pyd

    Filesize

    14KB

    MD5

    f79a4c8843675e13fc0d4f057faec76a

    SHA1

    80f8d466d2a42a3b278db0f6edb7e60c2f5afa26

    SHA256

    e4f57da1c2ae72d2ab4980a2ffa370ac0cf1f3f8c76273dcea3c28fd5c858c1e

    SHA512

    7955edd12c426599c5103fc71d4fa051092584e5bf6755beee5bbb76977927093ec6b73eaec0276de6e3e28e4f3e1ca0507d1b4a85eeba14f2e5b6032401715d

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_MD5.cp37-win_amd64.pyd

    Filesize

    15KB

    MD5

    9172a2fc5c66fff01f12676d16d8e882

    SHA1

    ee71eafd922f0ee24f1559c63dd8c82b16dbba00

    SHA256

    1143956ef572524ca0a4db6e55b918d7e3e137fa87d15df31ae4f8a4d5c6334b

    SHA512

    8a70a90edbac647d04444e5c926d7619d200632192e978fb56f9597583d3cd4ed8dcb5a0db89f0d3f89a41157388d51a3ab3eca7bc19d37da6917ca954ee0741

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_SHA1.cp37-win_amd64.pyd

    Filesize

    18KB

    MD5

    609daa8ccbefeda1291d663235c257eb

    SHA1

    3a7232f1f6c6b1c03963316c45b7ae335fd9ede6

    SHA256

    28cca9038d7f709a8cc251cc664195c68f65d61832547459fb8b3021044fe6da

    SHA512

    028a198e5c8b2f2f7bf8df716a06b5ffae0a875a9ac4d42c1bc64e4232e1d0700f79a01485a87c8fa7515e7c458912ef89487f4aea77fd769bd32e02ce3b1c64

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_SHA256.cp37-win_amd64.pyd

    Filesize

    20KB

    MD5

    fd2bab04dcf785080fd7e6aa1abdb566

    SHA1

    9eece186b95a4a6ffa8fadca283ebd2e1f60a340

    SHA256

    a660650ba2a0914d510d931458bf93a2e2479cf5922bd830f55ff74deebb19c9

    SHA512

    5ba2a7e097506c18c5ac74c0adac276b137b04185286fc7f2151dc7e7628c044a99d062b123c56dcf2d409dea1b9a5624a08899f5b7735a233f465317e8cfac5

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_ghash_clmul.cp37-win_amd64.pyd

    Filesize

    13KB

    MD5

    9e94efa7a0bd313c473c1f65001a5cca

    SHA1

    95e645f35d3a83780efd552b415e3f1dd77cc37f

    SHA256

    94abdf6cb2e0137aa8b3148076134e1e5237d8de7d010965d7d72b9cb782369f

    SHA512

    91feb7058c51291a437e65f012a6397277f4a9b80fb485e754231884a529e84b081489ffb1592f989f8c5e10424ae21f5b67b9bf538debeb59e40ff6aa5be34c

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Hash\_ghash_portable.cp37-win_amd64.pyd

    Filesize

    12KB

    MD5

    f9d715d7bbf155fe0b9c930c5f6ff6f2

    SHA1

    b85174e52601470927cc8e79e211b0ca4e01bbc4

    SHA256

    a7ba14b6a5989776e50a2bcbd7d13b9215c91c6c975373c2b52f7ba529eba294

    SHA512

    b69f96aa216ca38fd6405998ea948dce03607ee1a8ef2235fb48c6974199acac6aa44750f43d0b20d8029e750f1dd9bb9f3b90099f6c18be8d5bacb7cb6b134f

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Protocol\_scrypt.cp37-win_amd64.pyd

    Filesize

    12KB

    MD5

    456a382953f5b0eff12b5ab55bd15026

    SHA1

    48b2e5c7dbc617ea7c3fa00fe356c53da6055c9f

    SHA256

    86949f24ecf1fb5bba5b045e0a65bdf2e4ee653855900e810044b35912ac5cf1

    SHA512

    6ed5ef3a0c870f2eb6e5db8e9cc60be08c3d138e588b5440b95df2977cb22f925d44496db168c8cedea981c09f73a06c0a5e25479fb7ed2174b4193480919133

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Util\_cpuid_c.cp37-win_amd64.pyd

    Filesize

    10KB

    MD5

    ec54e8bd34ce4048fcc056f7c1819c90

    SHA1

    3d658a5497bba41ae7df11f0c9c49461ec7425d5

    SHA256

    b5d6738c2283b14d22383dd04d5fa9b7349d81e3bfa4abbbdd587c9306f4e62e

    SHA512

    f994449d4bcf8b659cf0055ae00cbb67d986e9520193bdd08424f89cf286a2b15a2db216fc2f927096a2768376589cee51e0eb4ed3288ad1acf9a3a09b4f36e3

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\Crypto\Util\_strxor.cp37-win_amd64.pyd

    Filesize

    10KB

    MD5

    7d2ed7ed7b5f765f13123a905abdd190

    SHA1

    6c99d801d39c13f86352762d3c150f0c4ff2918b

    SHA256

    0dcbf6c5d564b77d40cc71096769ab89092b946dd8ebde2a0effb0c28b36ef3a

    SHA512

    9d5f307ae558ba62abc2b44b8dd3205a7a7c7524253662ba6f427288695aa41e02ac28785ab77b95a0961bff8b5860fd5b20b54438b280bf9f6cb2523dcedac6

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\PIL\_imaging.cp37-win_amd64.pyd

    Filesize

    2.5MB

    MD5

    4950d9d67d4661237ed76d8011dde67e

    SHA1

    1f2229ccabea756d1ce883ee2469dac54403bf93

    SHA256

    70557af68ecc14faa19b03c5f1bc4ac3c26e742b9a2232f0eaad3bba2def0701

    SHA512

    02380d434591a7061d2051d6926b9f6260bebc49c70656844538e166cfd88026f1f9caeee2e39fced576ad81c5d57daef2a9930e8fbb2454d43d8d3f72a7afda

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\VCRUNTIME140.dll

    Filesize

    85KB

    MD5

    89a24c66e7a522f1e0016b1d0b4316dc

    SHA1

    5340dd64cfe26e3d5f68f7ed344c4fd96fbd0d42

    SHA256

    3096cafb6a21b6d28cf4fe2dd85814f599412c0fe1ef090dd08d1c03affe9ab6

    SHA512

    e88e0459744a950829cd508a93e2ef0061293ab32facd9d8951686cbe271b34460efd159fd8ec4aa96ff8a629741006458b166e5cff21f35d049ad059bc56a1a

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_bz2.pyd

    Filesize

    92KB

    MD5

    cf77513525fc652bad6c7f85e192e94b

    SHA1

    23ec3bb9cdc356500ec192cac16906864d5e9a81

    SHA256

    8bce02e8d44003c5301608b1722f7e26aada2a03d731fa92a48c124db40e2e41

    SHA512

    dbc1ba8794ce2d027145c78b7e1fc842ffbabb090abf9c29044657bdecd44396014b4f7c2b896de18aad6cfa113a4841a9ca567e501a6247832b205fe39584a9

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_ctypes.pyd

    Filesize

    129KB

    MD5

    5e869eebb6169ce66225eb6725d5be4a

    SHA1

    747887da0d7ab152e1d54608c430e78192d5a788

    SHA256

    430f1886caf059f05cde6eb2e8d96feb25982749a151231e471e4b8d7f54f173

    SHA512

    feb6888bb61e271b1670317435ee8653dedd559263788fbf9a7766bc952defd7a43e7c3d9f539673c262abedd97b0c4dd707f0f5339b1c1570db4e25da804a16

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_elementtree.pyd

    Filesize

    203KB

    MD5

    7d0c4ab57fdc1bd30c0e8e42ccc2aa35

    SHA1

    81bff07b6b5dd843e2227a3e8054500cfec65983

    SHA256

    ee8c4a8fe8eaa918a4fee353d46f4191bd161582098b400c33220847d84797db

    SHA512

    56ae9f10de02e7c777673814128d0252b47d001d2edc74bff9d85d7b0b6538b6f4d3d163e301dfb31429ec1eeefee550a72d6e424f20e10eb63c28db0e69fbbe

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_hashlib.pyd

    Filesize

    38KB

    MD5

    b32cb9615a9bada55e8f20dcea2fbf48

    SHA1

    a9c6e2d44b07b31c898a6d83b7093bf90915062d

    SHA256

    ca4f433a68c3921526f31f46d8a45709b946bbd40f04a4cfc6c245cb9ee0eab5

    SHA512

    5c583292de2ba33a3fc1129dfb4e2429ff2a30eeaf9c0bcff6cca487921f0ca02c3002b24353832504c3eec96a7b2c507f455b18717bcd11b239bbbbd79fadbe

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_lzma.pyd

    Filesize

    172KB

    MD5

    5fbb728a3b3abbdd830033586183a206

    SHA1

    066fde2fa80485c4f22e0552a4d433584d672a54

    SHA256

    f9bc6036d9e4d57d08848418367743fb608434c04434ab07da9dabe4725f9a9b

    SHA512

    31e7c9fe9d8680378f8e3ea4473461ba830df2d80a3e24e5d02a106128d048430e5d5558c0b99ec51c3d1892c76e4baa14d63d1ec1fc6b1728858aa2a255b2fb

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_socket.pyd

    Filesize

    75KB

    MD5

    8ea18d0eeae9044c278d2ea7a1dbae36

    SHA1

    de210842da8cb1cb14318789575d65117d14e728

    SHA256

    9822c258a9d25062e51eafc45d62ed19722e0450a212668f6737eb3bfe3a41c2

    SHA512

    d275ce71d422cfaacef1220dc1f35afba14b38a205623e3652766db11621b2a1d80c5d0fb0a7df19402ebe48603e76b8f8852f6cbff95a181d33e797476029f0

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\_tkinter.pyd

    Filesize

    68KB

    MD5

    09f66528018ffef916899845d6632307

    SHA1

    cf9ddad46180ef05a306dcb05fdb6f24912a69ce

    SHA256

    34d89fe378fc10351d127fb85427449f31595eccf9f5d17760b36709dd1449b9

    SHA512

    ed406792d8a533db71bd71859edbb2c69a828937757afec1a83fd1eacb1e5e6ec9afe3aa5e796fa1f518578f6d64ff19d64f64c9601760b7600a383efe82b3de

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\base_library.zip

    Filesize

    769KB

    MD5

    fa5d95091901e5fcb3f30956da007aa2

    SHA1

    f49ca7f7e422af6cd6461a70627ef1cd30d6f562

    SHA256

    7ae597d785381425377fc205f26ed0fa6fb031e0adca29d9c80b802c0a6270f3

    SHA512

    28167fbdd5737c974e8fa6af62f3f4cf1ae61a24bd0f6759d5b2cff580db4704eea7d21404fdc11714e7580299d43b070455290558f280115a3701f24da24274

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\libcrypto-1_1.dll

    Filesize

    3.2MB

    MD5

    cc4cbf715966cdcad95a1e6c95592b3d

    SHA1

    d5873fea9c084bcc753d1c93b2d0716257bea7c3

    SHA256

    594303e2ce6a4a02439054c84592791bf4ab0b7c12e9bbdb4b040e27251521f1

    SHA512

    3b5af9fbbc915d172648c2b0b513b5d2151f940ccf54c23148cd303e6660395f180981b148202bef76f5209acc53b8953b1cb067546f90389a6aa300c1fbe477

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\pyexpat.pyd

    Filesize

    198KB

    MD5

    6500aa010c8b50ffd1544f08af03fa4f

    SHA1

    a03f9f70d4ecc565f0fae26ef690d63e3711a20a

    SHA256

    752cf6804aac09480bf1e839a26285ec2668405010ed7ffd2021596e49b94dec

    SHA512

    f5f0521039c816408a5dd8b7394f9db5250e6dc14c0328898f1bed5de1e8a26338a678896f20aafa13c56b903b787f274d3dec467808787d00c74350863175d1

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\python37.dll

    Filesize

    3.6MB

    MD5

    c4709f84e6cf6e082b80c80b87abe551

    SHA1

    c0c55b229722f7f2010d34e26857df640182f796

    SHA256

    ca8e39f2b1d277b0a24a43b5b8eada5baf2de97488f7ef2484014df6e270b3f3

    SHA512

    e04a5832b9f2e1e53ba096e011367d46e6710389967fa7014a0e2d4a6ce6fc8d09d0ce20cee7e7d67d5057d37854eddab48bef7df1767f2ec3a4ab91475b7ce4

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\select.pyd

    Filesize

    26KB

    MD5

    fb4a0d7abaeaa76676846ad0f08fefa5

    SHA1

    755fd998215511506edd2c5c52807b46ca9393b2

    SHA256

    65a3c8806d456e9df2211051ed808a087a96c94d38e23d43121ac120b4d36429

    SHA512

    f5b3557f823ee4c662f2c9b7ecc5497934712e046aa8ae8e625f41756beb5e524227355316f9145bfabb89b0f6f93a1f37fa94751a66c344c38ce449e879d35f

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\tcl86t.dll

    Filesize

    1.6MB

    MD5

    c0b23815701dbae2a359cb8adb9ae730

    SHA1

    5be6736b645ed12e97b9462b77e5a43482673d90

    SHA256

    f650d6bc321bcda3fc3ac3dec3ac4e473fb0b7b68b6c948581bcfc54653e6768

    SHA512

    ed60384e95be8ea5930994db8527168f78573f8a277f8d21c089f0018cd3b9906da764ed6fcc1bd4efad009557645e206fbb4e5baef9ab4b2e3c8bb5c3b5d725

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\tcl\encoding\cp1252.enc

    Filesize

    1KB

    MD5

    5900f51fd8b5ff75e65594eb7dd50533

    SHA1

    2e21300e0bc8a847d0423671b08d3c65761ee172

    SHA256

    14df3ae30e81e7620be6bbb7a9e42083af1ae04d94cf1203565f8a3c0542ace0

    SHA512

    ea0455ff4cd5c0d4afb5e79b671565c2aede2857d534e1371f0c10c299c74cb4ad113d56025f58b8ae9e88e2862f0864a4836fed236f5730360b2223fde479dc

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\tk86t.dll

    Filesize

    1.4MB

    MD5

    fdc8a5d96f9576bd70aa1cadc2f21748

    SHA1

    bae145525a18ce7e5bc69c5f43c6044de7b6e004

    SHA256

    1a6d0871be2fa7153de22be008a20a5257b721657e6d4b24da8b1f940345d0d5

    SHA512

    816ada61c1fd941d10e6bb4350baa77f520e2476058249b269802be826bab294a9c18edc5d590f5ed6f8dafed502ab7ffb29db2f44292cb5bedf2f5fa609f49c

  • C:\Users\Admin\AppData\Local\Temp\_MEI20602\ucrtbase.dll

    Filesize

    961KB

    MD5

    2381e189321ead521ff71e72d08a6b17

    SHA1

    0db7fea07b4bc14f0f9d71ecfa6ddf3097229875

    SHA256

    4918f2e631ef1ae34c7863fa4f3bd7663b2fdf0fa160c0de507ed343484ac806

    SHA512

    2d51d1de627deb852d5ce48315654dfb34115ea9f546f640bb2304cd763d4576eadff5cd7fd184a9b17bac8bf37309a0409034d6303662edfa1a6db69366b9e5

  • C:\Users\Admin\Pictures\README.txt

    Filesize

    575B

    MD5

    efd54055b28e173ea64831fc59a0aca8

    SHA1

    cdf18b0692a53cbeed66ee14fa0f54666cf04013

    SHA256

    e3cf65e96fcf774320e0ae4a42d6544f1aef476cd67184432465b2c595180a99

    SHA512

    5ecf69dbdf824a6e0221e7f953ed58889bbd76ee563e9fc7e5d95b68245d0f4af0e0ec5f13f002975b65bacf0cd29027964b9f8c4174134ed08358e41b58f4d5