ryuk | 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

Analysis

max time kernel
170s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
19-02-2022 08:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Size

219KB
MD5

c4d162f04eb0464adc841390f42431ed
SHA1

a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA256

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA512

07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 12184 created 4412	12184	WerFault.exe	85

Executes dropped EXE 1 IoCs

pid	Process
4412	BmHRIGz.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	BmHRIGz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
14084	4412	WerFault.exe	85

Runs net.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
4412	BmHRIGz.exe
4412	BmHRIGz.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Token: SeBackupPrivilege	4412	BmHRIGz.exe
Token: SeRestorePrivilege	14084	WerFault.exe
Token: SeBackupPrivilege	14084	WerFault.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	85
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	85
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	85
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	86
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	86
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	86
PID 4792 wrote to memory of 1468	4792	net.exe	88
PID 4792 wrote to memory of 1468	4792	net.exe	88
PID 4792 wrote to memory of 1468	4792	net.exe	88
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	89
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	89
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	89
PID 2372 wrote to memory of 1848	2372	net.exe	91
PID 2372 wrote to memory of 1848	2372	net.exe	91
PID 2372 wrote to memory of 1848	2372	net.exe	91
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	93
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	93
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	93
PID 4580 wrote to memory of 1896	4580	net.exe	95
PID 4580 wrote to memory of 1896	4580	net.exe	95
PID 4580 wrote to memory of 1896	4580	net.exe	95
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	96
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	96
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	96
PID 848 wrote to memory of 4596	848	net.exe	98
PID 848 wrote to memory of 4596	848	net.exe	98
PID 848 wrote to memory of 4596	848	net.exe	98
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	99
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	99
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	99
PID 3412 wrote to memory of 4752	3412	net.exe	101
PID 3412 wrote to memory of 4752	3412	net.exe	101
PID 3412 wrote to memory of 4752	3412	net.exe	101
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	104
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	104
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	104
PID 11876 wrote to memory of 11936	11876	net.exe	106
PID 11876 wrote to memory of 11936	11876	net.exe	106
PID 11876 wrote to memory of 11936	11876	net.exe	106
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	107
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	107
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	107
PID 3728 wrote to memory of 12024	3728	net.exe	109
PID 3728 wrote to memory of 12024	3728	net.exe	109
PID 3728 wrote to memory of 12024	3728	net.exe	109
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	112
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	112
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	112
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	113
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	113
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	113
PID 13252 wrote to memory of 13512	13252	net.exe	116
PID 13252 wrote to memory of 13512	13252	net.exe	116
PID 13252 wrote to memory of 13512	13252	net.exe	116
PID 13240 wrote to memory of 13532	13240	net.exe	117
PID 13240 wrote to memory of 13532	13240	net.exe	117
PID 13240 wrote to memory of 13532	13240	net.exe	117

C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe
  "C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4412
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3412
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:4752
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 9004
    3⤵
    - Program crash
    - Suspicious use of AdjustPrivilegeToken
    PID:14084
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1468
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2372
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1848
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1896
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:848
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4596
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:11876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:11936
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:12024
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:13240
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:13532
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:13252
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:13512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4412 -ip 4412
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:12184

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads