ryuk | 88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335

General

Target

88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
Size

575KB
MD5

6cad2f7dc809b9353a31753a438aef4e
SHA1

459d816bb020f5da8257076a36d0ffd1f1f02d76
SHA256

88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335
SHA512

a67367990452bf21b7c0d0682c598422c78a5ed455a5d5e684d8fabb43366b0e9f9cd579a5f18123f6b1f97945f789904929838d1d893b70f450bfeafb243bb8

Score

10^/10

ryuk discovery ransomware

Malware Config

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1992	icacls.exe
932	icacls.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2116	3928	WerFault.exe	67

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe
2116	WerFault.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeRestorePrivilege	2116	WerFault.exe
Token: SeBackupPrivilege	2116	WerFault.exe
Token: SeDebugPrivilege	2116	WerFault.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 3928 wrote to memory of 1992	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	78
PID 3928 wrote to memory of 1992	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	78
PID 3928 wrote to memory of 1992	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	78
PID 3928 wrote to memory of 932	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	79
PID 3928 wrote to memory of 932	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	79
PID 3928 wrote to memory of 932	3928	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	79

C:\Users\Admin\AppData\Local\Temp\88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
"C:\Users\Admin\AppData\Local\Temp\88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1992
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:932
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3928 -s 652
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2116

Network

GET

http://www.msftconnecttest.com/connecttest.txt

WerFault.exe

Remote address:

13.107.4.52:80

Request

GET /connecttest.txt HTTP/1.1
Connection: Keep-Alive
Host: www.msftconnecttest.com

Response

HTTP/1.1 200 OK

Cache-Control: no-store
Content-Length: 22
Content-Type: text/plain; charset=utf-8
Last-Modified: Mon, 04 Jan 2021 19:34:40 GMT
Accept-Ranges: bytes
ETag: 0x8D343F9E96C9DAC
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MSEdge-Ref
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-MSEdge-Ref: Ref A: 8DA82A10F5C2475288AAF8D2123D32F9 Ref B: AMBEDGE0717 Ref C: 2021-01-18T11:46:32Z
Date: Mon, 18 Jan 2021 11:46:32 GMT
GET

http://www.msftconnecttest.com/connecttest.txt

WerFault.exe

Remote address:

13.107.4.52:80

Request

GET /connecttest.txt HTTP/1.1
Connection: Keep-Alive
Host: www.msftconnecttest.com

Response

HTTP/1.1 200 OK

Cache-Control: no-store
Content-Length: 22
Content-Type: text/plain; charset=utf-8
Last-Modified: Mon, 04 Jan 2021 19:34:40 GMT
Accept-Ranges: bytes
ETag: 0x8D343F9E96C9DAC
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MSEdge-Ref
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-MSEdge-Ref: Ref A: 5596D88DBB264694A828515FA7A928C1 Ref B: AMBEDGE0717 Ref C: 2021-01-18T11:46:32Z
Date: Mon, 18 Jan 2021 11:46:32 GMT
GET

http://www.msftconnecttest.com/connecttest.txt

WerFault.exe

Remote address:

13.107.4.52:80

Request

GET /connecttest.txt HTTP/1.1
Connection: Keep-Alive
Host: www.msftconnecttest.com

Response

HTTP/1.1 200 OK

Cache-Control: no-store
Content-Length: 22
Content-Type: text/plain; charset=utf-8
Last-Modified: Mon, 04 Jan 2021 19:34:40 GMT
Accept-Ranges: bytes
ETag: 0x8D343F9E96C9DAC
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MSEdge-Ref
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-MSEdge-Ref: Ref A: B8C485569FDF466EBA57E076644083B3 Ref B: AMBEDGE0717 Ref C: 2021-01-18T11:46:32Z
Date: Mon, 18 Jan 2021 11:46:32 GMT
GET

http://www.msftconnecttest.com/connecttest.txt

WerFault.exe

Remote address:

13.107.4.52:80

Request

GET /connecttest.txt HTTP/1.1
Connection: Keep-Alive
Host: www.msftconnecttest.com

Response

HTTP/1.1 200 OK

Cache-Control: no-store
Content-Length: 22
Content-Type: text/plain; charset=utf-8
Last-Modified: Mon, 04 Jan 2021 19:34:40 GMT
Accept-Ranges: bytes
ETag: 0x8D343F9E96C9DAC
Access-Control-Allow-Origin: *
Access-Control-Expose-Headers: X-MSEdge-Ref
Timing-Allow-Origin: *
X-Content-Type-Options: nosniff
X-MSEdge-Ref: Ref A: CF9E59986F674140B19C0987766DFF57 Ref B: AMBEDGE0717 Ref C: 2021-01-18T11:46:32Z
Date: Mon, 18 Jan 2021 11:46:32 GMT

13.107.4.52:80

http://www.msftconnecttest.com/connecttest.txt

http

WerFault.exe

794 B
2.4kB
10
11

HTTP Request

GET http://www.msftconnecttest.com/connecttest.txt

HTTP Response

200

HTTP Request

GET http://www.msftconnecttest.com/connecttest.txt

HTTP Response

200

HTTP Request

GET http://www.msftconnecttest.com/connecttest.txt

HTTP Response

200

HTTP Request

GET http://www.msftconnecttest.com/connecttest.txt

HTTP Response

200

No results found

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2116-4-0x0000000004740000-0x0000000004741000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

HTTP Request

HTTP Response

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.