ryuk | 307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1

General

Target

307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
Size

144KB
MD5

b1ad9afd96168db991f79eb546d6b79a
SHA1

9fbfbe72774b9cc3d174daa7b8be76bf8cb57ecf
SHA256

307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1
SHA512

677f25200f29b010895a335ac2171fdea359e9d59d4f91fa2d8c46b89c9933582f3e46ecf0026e4fb247d5acb430d74fec54368f7e27e74ff201385b77e65d13

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'g2JGFG1ll'; $torlink = 'http://nqm76vazre4sqqrbhtxdaei5iud5u7qrmis4bavj3kw5vzormeqqvfid.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://nqm76vazre4sqqrbhtxdaei5iud5u7qrmis4bavj3kw5vzormeqqvfid.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 2 IoCs

pid	Process
1216	AUwfBVCkIrep.exe
2040	kqVQPByfqlan.exe

Loads dropped DLL 4 IoCs

pid	Process
280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
852	icacls.exe
1844	icacls.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 280 wrote to memory of 1216	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	29
PID 280 wrote to memory of 1216	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	29
PID 280 wrote to memory of 1216	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	29
PID 280 wrote to memory of 1216	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	29
PID 280 wrote to memory of 2040	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	30
PID 280 wrote to memory of 2040	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	30
PID 280 wrote to memory of 2040	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	30
PID 280 wrote to memory of 2040	280	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	30

C:\Users\Admin\AppData\Local\Temp\307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
"C:\Users\Admin\AppData\Local\Temp\307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:280
- C:\Users\Admin\AppData\Local\Temp\AUwfBVCkIrep.exe
  "C:\Users\Admin\AppData\Local\Temp\AUwfBVCkIrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1216
- C:\Users\Admin\AppData\Local\Temp\kqVQPByfqlan.exe
  "C:\Users\Admin\AppData\Local\Temp\kqVQPByfqlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2040
- C:\Users\Admin\AppData\Local\Temp\BxLLnClSIlan.exe
  "C:\Users\Admin\AppData\Local\Temp\BxLLnClSIlan.exe" 8 LAN
  2⤵
  PID:1212
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1844
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:852

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/280-60-0x0000000075041000-0x0000000075043000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing