ryuk | 307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1

General

Target

307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
Size

144KB
MD5

b1ad9afd96168db991f79eb546d6b79a
SHA1

9fbfbe72774b9cc3d174daa7b8be76bf8cb57ecf
SHA256

307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1
SHA512

677f25200f29b010895a335ac2171fdea359e9d59d4f91fa2d8c46b89c9933582f3e46ecf0026e4fb247d5acb430d74fec54368f7e27e74ff201385b77e65d13

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'g2JGFG1ll'; $torlink = 'http://nqm76vazre4sqqrbhtxdaei5iud5u7qrmis4bavj3kw5vzormeqqvfid.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://nqm76vazre4sqqrbhtxdaei5iud5u7qrmis4bavj3kw5vzormeqqvfid.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3952	TihLnENVfrep.exe
3332	bbEsNXVeolan.exe
3348	MSJskRCtMlan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3728	icacls.exe
4056	icacls.exe

Enumerates connected drives 3 TTPs 22 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\W:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\T:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\N:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\M:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\L:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\E:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\Z:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\U:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\S:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\R:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\P:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\I:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\H:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\V:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\Q:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\O:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\K:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\Y:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\J:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\G:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
File opened (read-only)	\??\F:	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 2256 wrote to memory of 3952	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	79
PID 2256 wrote to memory of 3952	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	79
PID 2256 wrote to memory of 3952	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	79
PID 2256 wrote to memory of 3332	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	80
PID 2256 wrote to memory of 3332	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	80
PID 2256 wrote to memory of 3332	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	80
PID 2256 wrote to memory of 3348	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	81
PID 2256 wrote to memory of 3348	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	81
PID 2256 wrote to memory of 3348	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	81
PID 2256 wrote to memory of 3728	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	82
PID 2256 wrote to memory of 3728	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	82
PID 2256 wrote to memory of 3728	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	82
PID 2256 wrote to memory of 4056	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	83
PID 2256 wrote to memory of 4056	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	83
PID 2256 wrote to memory of 4056	2256	307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe	83

C:\Users\Admin\AppData\Local\Temp\307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe
"C:\Users\Admin\AppData\Local\Temp\307a8158e698680c7186e3c1481b29186d8b265bb83662397a54f235b0c9a3d1.exe"
1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2256
- C:\Users\Admin\AppData\Local\Temp\TihLnENVfrep.exe
  "C:\Users\Admin\AppData\Local\Temp\TihLnENVfrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:3952
- C:\Users\Admin\AppData\Local\Temp\bbEsNXVeolan.exe
  "C:\Users\Admin\AppData\Local\Temp\bbEsNXVeolan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3332
- C:\Users\Admin\AppData\Local\Temp\MSJskRCtMlan.exe
  "C:\Users\Admin\AppData\Local\Temp\MSJskRCtMlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3348
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3728
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4056