Malware Analysis Report

2024-10-23 18:37

Sample ID 220220-dzah5ahbhp
Target ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f
SHA256 ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f
Tags
ryuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f

Threat Level: Known bad

The file ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f was found to be: Known bad.

Malicious Activity Summary

ryuk ransomware

Ryuk

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-20 03:26

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-20 03:26

Reported

2022-02-20 03:56

Platform

win7-en-20211208

Max time kernel

204s

Max time network

28s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe"

Signatures

Ryuk

ransomware ryuk

Enumerates physical storage devices

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 668 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 1944 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 1944 wrote to memory of 2168 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1944 wrote to memory of 2168 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1944 wrote to memory of 2168 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1944 wrote to memory of 2168 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 668 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 2628 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 2628 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2628 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2628 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2628 wrote to memory of 2708 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 668 wrote to memory of 8572 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8572 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8572 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8572 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 8572 wrote to memory of 8596 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8572 wrote to memory of 8596 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8572 wrote to memory of 8596 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8572 wrote to memory of 8596 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 668 wrote to memory of 8632 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8632 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8632 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 668 wrote to memory of 8632 N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe C:\Windows\SysWOW64\net.exe
PID 8632 wrote to memory of 8656 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8632 wrote to memory of 8656 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8632 wrote to memory of 8656 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 8632 wrote to memory of 8656 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe

"C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe"

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

N/A

Files

memory/668-54-0x0000000076451000-0x0000000076453000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-20 03:26

Reported

2022-02-20 03:56

Platform

win10v2004-en-20220113

Max time kernel

200s

Max time network

225s

Command Line

"C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe"

Signatures

Ryuk

ransomware ryuk

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe

"C:\Users\Admin\AppData\Local\Temp\ab5b8853961dbd4013c2fb44403eba2ac32abfbf4f65e2d32d83c5c642591e5f.exe"

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
NL 52.178.17.2:443 tcp
US 93.184.220.29:80 tcp
US 72.21.81.240:80 tcp
US 72.21.81.240:80 tcp
US 52.252.42.28:443 tcp
US 93.184.220.29:80 tcp
NL 104.110.191.140:80 tcp
US 8.8.8.8:53 crl4.digicert.com udp
US 93.184.220.29:80 crl4.digicert.com tcp
US 8.8.8.8:53 106.89.54.20.in-addr.arpa udp

Files

N/A