Overview

overview

10

Static

static

8f368b029a...8a.exe

windows10_x64

10

Resubmissions

18-10-2023 22:01

231018-1xkmmsbg3v 10

09-07-2021 09:45

210709-w8k71s621j 10

Analysis

  • max time kernel
    123s
  • max time network
    266s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    09-07-2021 09:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe

  • Size

    144KB

  • MD5

    89895cf4c88f13e5797aab63dddf1078

  • SHA1

    1efc175983a17bd6c562fe7b054045d6dcb341e5

  • SHA256

    8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a

  • SHA512

    d238fa264ad931ed43798a65f01cbe1d044300dbe5312bdcef8540f2757079514daae27f30f2369b7b811a3273c961f9fd38e7ae5010c11120c83906e8c102e2

Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = 'UWUEbcQLr'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe
    "C:\Users\Admin\AppData\Local\Temp\8f368b029a3a5517cb133529274834585d087a2d3a5875d03ea38e5774019c8a.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3424
    • C:\Users\Admin\AppData\Local\Temp\1073r.exe
      "C:\Users\Admin\AppData\Local\Temp\1073r.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:2508
    • C:\Users\Admin\AppData\Local\Temp\zpttZFcBylan.exe
      "C:\Users\Admin\AppData\Local\Temp\zpttZFcBylan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:2612
    • C:\Users\Admin\AppData\Local\Temp\SocTmVGrelan.exe
      "C:\Users\Admin\AppData\Local\Temp\SocTmVGrelan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:3084
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:3684
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:3464
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
        PID:1968
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
          3⤵
            PID:4160
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
          2⤵
            PID:4972
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
              3⤵
                PID:4268
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
                PID:4228
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:4360
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                    PID:5024
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "samss" /y
                      3⤵
                        PID:4436
                    • C:\Windows\SysWOW64\SCHTASKS.exe
                      SCHTASKS /CREATE /NP /SC DAILY /TN "PrintIv" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\WuPbJ.dll" /ST 10:25 /SD 07/10/2021 /ED 07/17/2021
                      2⤵
                      • Creates scheduled task(s)
                      PID:2304
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop "samss" /y
                      2⤵
                        PID:5420
                        • C:\Windows\SysWOW64\net1.exe
                          C:\Windows\system32\net1 stop "samss" /y
                          3⤵
                            PID:5524
                        • C:\Windows\SysWOW64\net.exe
                          "C:\Windows\System32\net.exe" stop "samss" /y
                          2⤵
                            PID:5460
                            • C:\Windows\SysWOW64\net1.exe
                              C:\Windows\system32\net1 stop "samss" /y
                              3⤵
                                PID:5548
                          • C:\Windows\System32\rundll32.exe
                            C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
                            1⤵
                              PID:3464
                            • C:\Windows\SysWOW64\mshta.exe
                              "C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\SendAssert.hta" {1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}{1E460BD7-F1C3-4B2E-88BF-4E770A288AF5}
                              1⤵
                                PID:1112
                              • C:\Windows\system32\mspaint.exe
                                "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\BackupNew.jpeg" /ForceBootstrapPaint3D
                                1⤵
                                  PID:3408
                                • C:\Windows\system32\mspaint.exe
                                  "C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\BackupNew.jpeg" /ForceBootstrapPaint3D
                                  1⤵
                                    PID:4860
                                  • \??\c:\windows\system32\svchost.exe
                                    c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s DsSvc
                                    1⤵
                                      PID:4100
                                    • C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe
                                      "C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca
                                      1⤵
                                        PID:4732
                                        • C:\Windows\system32\WerFault.exe
                                          C:\Windows\system32\WerFault.exe -u -p 4732 -s 3752
                                          2⤵
                                          • Program crash
                                          PID:3980

                                      Network

                                      MITRE ATT&CK Enterprise v6

                                      Replay Monitor

                                      Loading Replay Monitor...

                                      Downloads

                                      • memory/4100-143-0x000001D05AE00000-0x000001D05AE10000-memory.dmp

                                        Filesize

                                        64KB

                                        Download

                                      • memory/4100-144-0x000001D05FC30000-0x000001D05FC31000-memory.dmp

                                        Filesize

                                        4KB

                                        Download

                                      • memory/4100-142-0x000001D05AB80000-0x000001D05AB90000-memory.dmp

                                        Filesize

                                        64KB

                                        Download