ryuk | f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682

General

Target

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
Size

188KB
MD5

81a657edce1fc7c97e2e3367e676339f
SHA1

13a1686aaaba2c46792b468ca78f6f20a3817468
SHA256

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682
SHA512

2233a938fa19a39d9052a2e339b18b140d9e258a9d3394219e60c636095566647faacba4ee72d007ade4c768cdece84b373f029bb19e53b3279e99f1204ee07e

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

VhocDwe.exe

pid process

560 VhocDwe.exe

pid	process
560	VhocDwe.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exeVhocDwe.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	VhocDwe.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe

Modifies data under HKEY_USERS 45 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.228571"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899665031120379"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4076"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exeVhocDwe.exe

pid	process
1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
560	VhocDwe.exe
560	VhocDwe.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exeVhocDwe.exe

description	pid	process
Token: SeBackupPrivilege	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
Token: SeBackupPrivilege	560	VhocDwe.exe

Suspicious use of WriteProcessMemory 39 IoCs

Processes:

f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exeVhocDwe.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1364 wrote to memory of 560	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	VhocDwe.exe
PID 1364 wrote to memory of 560	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	VhocDwe.exe
PID 1364 wrote to memory of 560	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	VhocDwe.exe
PID 1364 wrote to memory of 4024	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 4024	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 4024	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 560 wrote to memory of 2996	560	VhocDwe.exe	net.exe
PID 560 wrote to memory of 2996	560	VhocDwe.exe	net.exe
PID 560 wrote to memory of 2996	560	VhocDwe.exe	net.exe
PID 1364 wrote to memory of 912	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 912	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 912	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 1240	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 1240	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 1240	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 560 wrote to memory of 3624	560	VhocDwe.exe	net.exe
PID 560 wrote to memory of 3624	560	VhocDwe.exe	net.exe
PID 560 wrote to memory of 3624	560	VhocDwe.exe	net.exe
PID 1364 wrote to memory of 4036	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 4036	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 1364 wrote to memory of 4036	1364	f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe	net.exe
PID 4036 wrote to memory of 4264	4036	net.exe	net1.exe
PID 4036 wrote to memory of 4264	4036	net.exe	net1.exe
PID 4036 wrote to memory of 4264	4036	net.exe	net1.exe
PID 4024 wrote to memory of 4248	4024	net.exe	net1.exe
PID 4024 wrote to memory of 4248	4024	net.exe	net1.exe
PID 4024 wrote to memory of 4248	4024	net.exe	net1.exe
PID 1240 wrote to memory of 4252	1240	net.exe	net1.exe
PID 1240 wrote to memory of 4252	1240	net.exe	net1.exe
PID 1240 wrote to memory of 4252	1240	net.exe	net1.exe
PID 912 wrote to memory of 4272	912	net.exe	net1.exe
PID 912 wrote to memory of 4272	912	net.exe	net1.exe
PID 912 wrote to memory of 4272	912	net.exe	net1.exe
PID 3624 wrote to memory of 4280	3624	net.exe	net1.exe
PID 3624 wrote to memory of 4280	3624	net.exe	net1.exe
PID 3624 wrote to memory of 4280	3624	net.exe	net1.exe
PID 2996 wrote to memory of 4284	2996	net.exe	net1.exe
PID 2996 wrote to memory of 4284	2996	net.exe	net1.exe
PID 2996 wrote to memory of 4284	2996	net.exe	net1.exe

C:\Users\Admin\AppData\Local\Temp\f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe
"C:\Users\Admin\AppData\Local\Temp\f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1364

C:\Users\Admin\AppData\Local\Temp\VhocDwe.exe
"C:\Users\Admin\AppData\Local\Temp\VhocDwe.exe" 8 LAN
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:560

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
4⤵
PID:4284

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:3624

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:4280

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4024

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:4248

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:4252

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:912

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:4272

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:4036

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:4264

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:1004

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:748

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5
1a5a69d7cb1789774945d277bd047dbe

SHA1
a371ee603fe3cafdeea8d91709ea23f44d25c551

SHA256
3db7ceb32a486e45f18490cd348c359a852dfe2a8e5d186c2f376acf46c3152a

SHA512
3a9ed562bc7a5d8c0045f084bee7d645b5aa6527be774bb78e37e99b4bc5d877332114c1bddfd4c3b542a76d98e4ec3c0ca04a16f5a5b62d2599b0c77273430a

Download Submit
C:\Users\Admin\AppData\Local\Temp\VhocDwe.exe

MD5
81a657edce1fc7c97e2e3367e676339f

SHA1
13a1686aaaba2c46792b468ca78f6f20a3817468

SHA256
f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682

SHA512
2233a938fa19a39d9052a2e339b18b140d9e258a9d3394219e60c636095566647faacba4ee72d007ade4c768cdece84b373f029bb19e53b3279e99f1204ee07e

Download Submit
C:\Users\Admin\AppData\Local\Temp\VhocDwe.exe

MD5
81a657edce1fc7c97e2e3367e676339f

SHA1
13a1686aaaba2c46792b468ca78f6f20a3817468

SHA256
f63501542310745baa8fa2026930590cd690b53bfddb940378eca685a2c5e682

SHA512
2233a938fa19a39d9052a2e339b18b140d9e258a9d3394219e60c636095566647faacba4ee72d007ade4c768cdece84b373f029bb19e53b3279e99f1204ee07e

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads