ryuk | 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

General

Target

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Size

219KB
MD5

c4d162f04eb0464adc841390f42431ed
SHA1

a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA256

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA512

07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

Processes:

WerFault.exe

description pid process target process

PID 12184 created 4412 12184 WerFault.exe BmHRIGz.exe
Executes dropped EXE 1 IoCs

Processes:

BmHRIGz.exe

pid process

4412 BmHRIGz.exe

description	pid	process	target process
PID 12184 created 4412	12184	WerFault.exe	BmHRIGz.exe

pid	process
4412	BmHRIGz.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	BmHRIGz.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

14084 4412 WerFault.exe BmHRIGz.exe
Runs net.exe

pid	pid_target	process	target process
14084	4412	WerFault.exe	BmHRIGz.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exe

pid	process
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
4412	BmHRIGz.exe
4412	BmHRIGz.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exeWerFault.exe

description	pid	process
Token: SeBackupPrivilege	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Token: SeBackupPrivilege	4412	BmHRIGz.exe
Token: SeRestorePrivilege	14084	WerFault.exe
Token: SeBackupPrivilege	14084	WerFault.exe

Suspicious use of WriteProcessMemory 57 IoCs

Processes:

0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exenet.exenet.exenet.exenet.exeBmHRIGz.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	BmHRIGz.exe
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	BmHRIGz.exe
PID 1340 wrote to memory of 4412	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	BmHRIGz.exe
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 4792	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 4792 wrote to memory of 1468	4792	net.exe	net1.exe
PID 4792 wrote to memory of 1468	4792	net.exe	net1.exe
PID 4792 wrote to memory of 1468	4792	net.exe	net1.exe
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 2372	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 2372 wrote to memory of 1848	2372	net.exe	net1.exe
PID 2372 wrote to memory of 1848	2372	net.exe	net1.exe
PID 2372 wrote to memory of 1848	2372	net.exe	net1.exe
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 4580	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 4580 wrote to memory of 1896	4580	net.exe	net1.exe
PID 4580 wrote to memory of 1896	4580	net.exe	net1.exe
PID 4580 wrote to memory of 1896	4580	net.exe	net1.exe
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 848	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 848 wrote to memory of 4596	848	net.exe	net1.exe
PID 848 wrote to memory of 4596	848	net.exe	net1.exe
PID 848 wrote to memory of 4596	848	net.exe	net1.exe
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	net.exe
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	net.exe
PID 4412 wrote to memory of 3412	4412	BmHRIGz.exe	net.exe
PID 3412 wrote to memory of 4752	3412	net.exe	net1.exe
PID 3412 wrote to memory of 4752	3412	net.exe	net1.exe
PID 3412 wrote to memory of 4752	3412	net.exe	net1.exe
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 11876	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 11876 wrote to memory of 11936	11876	net.exe	net1.exe
PID 11876 wrote to memory of 11936	11876	net.exe	net1.exe
PID 11876 wrote to memory of 11936	11876	net.exe	net1.exe
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 3728	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 3728 wrote to memory of 12024	3728	net.exe	net1.exe
PID 3728 wrote to memory of 12024	3728	net.exe	net1.exe
PID 3728 wrote to memory of 12024	3728	net.exe	net1.exe
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 13240	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 1340 wrote to memory of 13252	1340	0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe	net.exe
PID 13252 wrote to memory of 13512	13252	net.exe	net1.exe
PID 13252 wrote to memory of 13512	13252	net.exe	net1.exe
PID 13252 wrote to memory of 13512	13252	net.exe	net1.exe
PID 13240 wrote to memory of 13532	13240	net.exe	net1.exe
PID 13240 wrote to memory of 13532	13240	net.exe	net1.exe
PID 13240 wrote to memory of 13532	13240	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340

C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe
"C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe" 8 LAN
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4412

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3412

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:4752

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 9004
3⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:14084

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:1468

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:2372

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:1848

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4580

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:1896

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:848

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:4596

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:11876

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:11936

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:3728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:12024

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:13240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:13532

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:13252

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:13512

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4412 -ip 4412
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:12184

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_e269d2c1-0edf-4391-ac7b-818b8e88b04f
MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe
MD5
c4d162f04eb0464adc841390f42431ed

SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045

SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Download Submit
C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe
MD5
c4d162f04eb0464adc841390f42431ed

SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045

SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6

SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
MD5
5c1543434c0c7e2b00f6709fcf8241fd

SHA1
5791c19f4c38eaaf573192c6c39f8a6cc2c43ffe

SHA256
4b59af349b6a429cb5599090fc74cd00dc435ce39f0dfcd3cdbefb116fcace23

SHA512
034f366ab29e06adebbff1db76093b14fdb174aba916f846472d8b9de3a711afbf208863d20d680f8282a3e31d7c494375e4eb5f14f50b1742ea0275af63dc5b

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads