Overview

overview

10

Static

static

d8a0d25776...88.exe

windows7_x64

10

d8a0d25776...88.exe

windows10_x64

10

Analysis

  • max time kernel
    136s
  • max time network
    120s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    13-09-2021 15:41

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe

  • Size

    140KB

  • MD5

    c0f972c5e033c0b4dc268a805cfa16a2

  • SHA1

    a3f38579feb14d3b20289e453b41d88232145f68

  • SHA256

    d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

  • SHA512

    de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

Score
10/10
ryukdiscoveryransomware

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = '3y5fSfK'; $torlink = 'http://ojaiemvqphz6dgg7gncqpdlbx2aoisftpwvrhda67uth6ncuax2ghyad.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://ojaiemvqphz6dgg7gncqpdlbx2aoisftpwvrhda67uth6ncuax2ghyad.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Executes dropped EXE 3 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe
    "C:\Users\Admin\AppData\Local\Temp\d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:3728
    • C:\Users\Admin\AppData\Local\Temp\gRnLxOynorep.exe
      "C:\Users\Admin\AppData\Local\Temp\gRnLxOynorep.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:2900
    • C:\Users\Admin\AppData\Local\Temp\hOdgEBygplan.exe
      "C:\Users\Admin\AppData\Local\Temp\hOdgEBygplan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:4004
    • C:\Users\Admin\AppData\Local\Temp\PKenmRFJKlan.exe
      "C:\Users\Admin\AppData\Local\Temp\PKenmRFJKlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:3144
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:3872
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:3952
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
        PID:3960
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
        2⤵
          PID:1860
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "samss" /y
          2⤵
            PID:4220
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
              PID:4208

          Network

          MITRE ATT&CK Matrix ATT&CK v6

          Initial Access

          Execution

          Persistence

          Privilege Escalation

          Defense Evasion

          File Permissions Modification

          1
          T1222

          Credential Access

          Discovery

          Query Registry

          1
          T1012

          Peripheral Device Discovery

          1
          T1120

          System Information Discovery

          2
          T1082

          Lateral Movement

          Collection

          Exfiltration

          Command and Control

          Impact

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\$Recycle.Bin\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\$Recycle.Bin\S-1-5-21-1594587808-2047097707-2163810515-1000\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\BOOTSECT.BAK.RYK
            MD5

            a5ef949d9f32712728a06605e9d5d7dd

            SHA1

            b4917f69310f13992202bb0ed3f71212dbf7ca57

            SHA256

            7b4e240311925ec5129738aa7192f3aa65ebaae1e6359e00f75c27da02dd7894

            SHA512

            0164761d8337a4852ea39b6c8f0bc3a221c0af66be7529b8447ba0dc3d49757836cd753f08e35d94cd529bf4b5b23c74a7307c6343f227d6fa783114c1b6a303

            Download Submit
          • C:\Boot\BOOTSTAT.DAT.RYK
            MD5

            91dc3ec8d88ef48bf7d519de1c031635

            SHA1

            494e91dcb363f3111d64dc474c3170dd6ae9f960

            SHA256

            eccb4d7fe4692a4e6da9ba152e635a7af320f1b1bc0492d6dd3c8ef787dfcab8

            SHA512

            2b1774d73eded475d8012eb374226538cc120b395f5996e3bce7bc2d7ee5dce9a7340cc86fa0327e3b5dc810e4ff0177968299776bd513c9edd495347893f96c

            Download Submit
          • C:\PerfLogs\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\PKenmRFJKlan.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\PKenmRFJKlan.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\gRnLxOynorep.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\gRnLxOynorep.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\hOdgEBygplan.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\Admin\AppData\Local\Temp\hOdgEBygplan.exe
            MD5

            c0f972c5e033c0b4dc268a805cfa16a2

            SHA1

            a3f38579feb14d3b20289e453b41d88232145f68

            SHA256

            d8a0d25776c28e17e724da2b1c8fdae28d7c6b32cfa9d3d2a20f3f57ff370488

            SHA512

            de7803c4119355be7e06616abbfbf44b4ee23ba2caa987b630ad520126187c1f9eb2308f0ba5ba51cc8287fa75e5251d4e9d5ad940e8beb90b97f65d4890ca47

            Download Submit
          • C:\Users\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\odt\RyukReadMe.html
            MD5

            ef4f7747ff07d010fc040da223fdbc61

            SHA1

            2b89042ff0b635aa34ec32c0a2090cd4f781c9ae

            SHA256

            6a1c4bfe0368464c37652bb21a4eec21ee11f16b6f8a820c6696c6f7e5fe10c8

            SHA512

            0342ef5ca647586af05b99d5f82d264457d51ca44e8831acc9a1013db7ee98e2e86ef122733862f7492f0870a51136cf829978ab97ed14659f4d2d081d177a2f

            Download Submit
          • C:\odt\config.xml.RYK
            MD5

            a600005237fa7756829079a9c6ea359c

            SHA1

            68415b2c611a97fb3aa45b4de8832b8d4072df76

            SHA256

            d9e011f9c0320cfcfaf541e9b7cc5d124b6ba2dc3d46593d5c2bed72a25957da

            SHA512

            28d0febeb171a35eb1c7db8cdf6ba94cfeeec935b4cbaaf8ce0ae2788b869b6e3d8a5d2e8c1e13b43e5ebf86244b31b7f596c90db3087d20e8896e007dede46a

            Download Submit
          • memory/1860-135-0x0000000000000000-mapping.dmp
            Download
          • memory/2900-114-0x0000000000000000-mapping.dmp
            Download
          • memory/3144-120-0x0000000000000000-mapping.dmp
            Download
          • memory/3872-123-0x0000000000000000-mapping.dmp
            Download
          • memory/3952-124-0x0000000000000000-mapping.dmp
            Download
          • memory/3960-134-0x0000000000000000-mapping.dmp
            Download
          • memory/4004-117-0x0000000000000000-mapping.dmp
            Download
          • memory/4208-136-0x0000000000000000-mapping.dmp
            Download
          • memory/4220-137-0x0000000000000000-mapping.dmp
            Download