Analysis
-
max time kernel
150s -
max time network
104s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-03-2021 15:09
Static task
static1
Behavioral task
behavioral1
Sample
a563c50c5fa0fd541248acaf72cc4e7d.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
a563c50c5fa0fd541248acaf72cc4e7d.exe
Resource
win10v20201028
General
-
Target
a563c50c5fa0fd541248acaf72cc4e7d.exe
-
Size
635KB
-
MD5
a563c50c5fa0fd541248acaf72cc4e7d
-
SHA1
4b8c12b074e20a796071aa50dc82fe2ff755e8f6
-
SHA256
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
-
SHA512
d7c4c92b3eeb8cefe6d007b7b4fd79cbec388582ca0f3708d520a2c3e432d490d2f69ce365edbc1141f13e71ac473fed74a4367b7898af68d5c1e3b4e4899479
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Dave packer 1 IoCs
Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.
resource yara_rule behavioral2/memory/1192-4-0x00000000022B0000-0x00000000022D2000-memory.dmp dave -
Executes dropped EXE 3 IoCs
pid Process 808 SOyMLhrXQrep.exe 1456 nMmKpNWSklan.exe 744 hgrBEFwjLlan.exe -
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4552 icacls.exe 4564 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI a563c50c5fa0fd541248acaf72cc4e7d.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\boxed-split.avi a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\.eclipseproduct a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\EssentialLetter.dotx a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\de-de\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-modules-options-keymap.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\proof.en-us.msi.16.en-us.vreg.dat a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\fr-ma\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\7-Zip\License.txt a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\WinWordLogo.scale-80.png a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\back-arrow-disabled.svg a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vreg\office32ww.msi.16.x-none.vreg.dat a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\tr-tr\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsen.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Internet Explorer\images\bing.ico a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-core-kit_zh_CN.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\mc.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Google\Update\Download\{8A69D345-D564-463C-AFF1-A69D9E530F96}\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Times New Roman-Arial.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ul-oob.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Legal\ENU\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-attach.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ja-jp\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Trial-pl.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATERMAR\WATERMAR.INF a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\ICE.INF a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ja\msipc.dll.mui a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\css\main.css a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\ca-es\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\tools\@1x\themes\dark\[email protected] a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessR_Trial-ul-oob.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\en_GB\LC_MESSAGES\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\forms_poster.jpg a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-spi-quicksearch_zh_CN.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\soundcloud.luac a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\ACEINTL.DLL a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64_3.103.1.v20140903-1947.jar a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses_selected-hover.svg a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\root\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\js\nls\de-de\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Templates\1033\TimelessLetter.dotx a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sl-si\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\images\themeless\S_ThumbDownOutline_22_N1.svg a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-keymap.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentDemoR_BypassTrial180-ppd.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\PREVIEW.GIF a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\pt-br\RyukReadMe.html a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\sl-si\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\progress.gif a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application-views.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\c2rpridslicensefiles_auto.xml a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019R_OEM_Perp-pl.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\zh-tw\ui-strings.js a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\TabTip.exe.mui a563c50c5fa0fd541248acaf72cc4e7d.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_KMS_Client-ppd.xrm-ms a563c50c5fa0fd541248acaf72cc4e7d.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
pid Process 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 808 SOyMLhrXQrep.exe 808 SOyMLhrXQrep.exe 1456 nMmKpNWSklan.exe 1456 nMmKpNWSklan.exe 744 hgrBEFwjLlan.exe 744 hgrBEFwjLlan.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1192 wrote to memory of 808 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 79 PID 1192 wrote to memory of 808 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 79 PID 1192 wrote to memory of 808 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 79 PID 1192 wrote to memory of 1456 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 80 PID 1192 wrote to memory of 1456 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 80 PID 1192 wrote to memory of 1456 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 80 PID 1192 wrote to memory of 744 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 81 PID 1192 wrote to memory of 744 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 81 PID 1192 wrote to memory of 744 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 81 PID 1192 wrote to memory of 4552 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 82 PID 1192 wrote to memory of 4552 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 82 PID 1192 wrote to memory of 4552 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 82 PID 1192 wrote to memory of 4564 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 83 PID 1192 wrote to memory of 4564 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 83 PID 1192 wrote to memory of 4564 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 83 PID 1192 wrote to memory of 4680 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 86 PID 1192 wrote to memory of 4680 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 86 PID 1192 wrote to memory of 4680 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 86 PID 1192 wrote to memory of 5024 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 89 PID 1192 wrote to memory of 5024 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 89 PID 1192 wrote to memory of 5024 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 89 PID 1192 wrote to memory of 4560 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 88 PID 1192 wrote to memory of 4560 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 88 PID 1192 wrote to memory of 4560 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 88 PID 1192 wrote to memory of 4652 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 92 PID 1192 wrote to memory of 4652 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 92 PID 1192 wrote to memory of 4652 1192 a563c50c5fa0fd541248acaf72cc4e7d.exe 92 PID 4560 wrote to memory of 1452 4560 net.exe 96 PID 4560 wrote to memory of 1452 4560 net.exe 96 PID 4560 wrote to memory of 1452 4560 net.exe 96 PID 4652 wrote to memory of 5068 4652 net.exe 95 PID 4652 wrote to memory of 5068 4652 net.exe 95 PID 4652 wrote to memory of 5068 4652 net.exe 95 PID 4680 wrote to memory of 4724 4680 net.exe 94 PID 4680 wrote to memory of 4724 4680 net.exe 94 PID 4680 wrote to memory of 4724 4680 net.exe 94 PID 5024 wrote to memory of 4992 5024 net.exe 97 PID 5024 wrote to memory of 4992 5024 net.exe 97 PID 5024 wrote to memory of 4992 5024 net.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\a563c50c5fa0fd541248acaf72cc4e7d.exe"C:\Users\Admin\AppData\Local\Temp\a563c50c5fa0fd541248acaf72cc4e7d.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Users\Admin\AppData\Local\Temp\SOyMLhrXQrep.exe"C:\Users\Admin\AppData\Local\Temp\SOyMLhrXQrep.exe" 9 REP2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:808
-
-
C:\Users\Admin\AppData\Local\Temp\nMmKpNWSklan.exe"C:\Users\Admin\AppData\Local\Temp\nMmKpNWSklan.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1456
-
-
C:\Users\Admin\AppData\Local\Temp\hgrBEFwjLlan.exe"C:\Users\Admin\AppData\Local\Temp\hgrBEFwjLlan.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:744
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4552
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4564
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:4724
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4560 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1452
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4992
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4652 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:5068
-
-