Overview

overview

10

Static

static

7ac8689ab9...d9.exe

windows7_x64

10

7ac8689ab9...d9.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    177s
  • max time network
    185s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20-02-2022 05:28

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7ac8689ab907526b77e6294a8e91280b562046dc674a1a21e7f8e953821bccd9.exe

  • Size

    203KB

  • MD5

    071ccc24faaf0a8577075b7466293e8c

  • SHA1

    8beed359f92bfc5e14384783526f77049eb2cb9a

  • SHA256

    7ac8689ab907526b77e6294a8e91280b562046dc674a1a21e7f8e953821bccd9

  • SHA512

    454f5db75da3285cc28795078b598b8995d6a3fd586084b68c583029455a437905b5e58451992b3277ff61a1cd3b09a6107d4b94810128a738496137c4a62f90

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops desktop.ini file(s) 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\System32\RuntimeBroker.exe
    C:\Windows\System32\RuntimeBroker.exe -Embedding
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2988
  • C:\Windows\system32\backgroundTaskHost.exe
    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
    1⤵
      PID:1652
    • C:\Windows\system32\backgroundTaskHost.exe
      "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
      1⤵
        PID:1716
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
        • Modifies registry class
        PID:3456
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:3400
        • C:\Windows\System32\RuntimeBroker.exe
          C:\Windows\System32\RuntimeBroker.exe -Embedding
          1⤵
            PID:2772
          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
            1⤵
              PID:3060
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2924
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2924 -s 3012
                2⤵
                • Program crash
                PID:5864
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2740
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2740 -s 948
                2⤵
                • Program crash
                PID:5112
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
              1⤵
                PID:2520
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                1⤵
                  PID:2280
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                  1⤵
                    PID:2236
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Drops desktop.ini file(s)
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2220
                    • C:\Windows\System32\net.exe
                      "C:\Windows\System32\net.exe" stop "spooler" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1384
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "spooler" /y
                        3⤵
                          PID:5372
                      • C:\Windows\System32\net.exe
                        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5108
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                          3⤵
                            PID:5364
                        • C:\Windows\System32\net.exe
                          "C:\Windows\System32\net.exe" stop "samss" /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3772
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop "samss" /y
                            3⤵
                              PID:5580
                          • C:\Windows\System32\net.exe
                            "C:\Windows\System32\net.exe" stop "spooler" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5880
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop "spooler" /y
                              3⤵
                                PID:6044
                            • C:\Windows\System32\net.exe
                              "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5928
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                3⤵
                                  PID:6060
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" stop "samss" /y
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5976
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 stop "samss" /y
                                  3⤵
                                    PID:6052
                              • C:\Users\Admin\AppData\Local\Temp\7ac8689ab907526b77e6294a8e91280b562046dc674a1a21e7f8e953821bccd9.exe
                                "C:\Users\Admin\AppData\Local\Temp\7ac8689ab907526b77e6294a8e91280b562046dc674a1a21e7f8e953821bccd9.exe"
                                1⤵
                                • Checks computer location settings
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of WriteProcessMemory
                                PID:2092
                                • C:\Windows\System32\net.exe
                                  "C:\Windows\System32\net.exe" stop "spooler" /y
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:1728
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop "spooler" /y
                                    3⤵
                                      PID:5340
                                  • C:\Windows\System32\net.exe
                                    "C:\Windows\System32\net.exe" stop "spooler" /y
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:3368
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 stop "spooler" /y
                                      3⤵
                                        PID:5344
                                    • C:\Windows\System32\net.exe
                                      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:4224
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                        3⤵
                                          PID:5592
                                      • C:\Windows\System32\net.exe
                                        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                        2⤵
                                        • Suspicious use of WriteProcessMemory
                                        PID:5172
                                        • C:\Windows\system32\net1.exe
                                          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                          3⤵
                                            PID:5600
                                        • C:\Windows\System32\net.exe
                                          "C:\Windows\System32\net.exe" stop "samss" /y
                                          2⤵
                                          • Suspicious use of WriteProcessMemory
                                          PID:5404
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 stop "samss" /y
                                            3⤵
                                              PID:5564
                                          • C:\Windows\System32\net.exe
                                            "C:\Windows\System32\net.exe" stop "samss" /y
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:5424
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 stop "samss" /y
                                              3⤵
                                                PID:5568
                                            • C:\Windows\System32\net.exe
                                              "C:\Windows\System32\net.exe" stop "spooler" /y
                                              2⤵
                                                PID:6100
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 stop "spooler" /y
                                                  3⤵
                                                    PID:5224
                                                • C:\Windows\System32\net.exe
                                                  "C:\Windows\System32\net.exe" stop "spooler" /y
                                                  2⤵
                                                    PID:6092
                                                    • C:\Windows\system32\net1.exe
                                                      C:\Windows\system32\net1 stop "spooler" /y
                                                      3⤵
                                                        PID:4332
                                                    • C:\Windows\System32\net.exe
                                                      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                                      2⤵
                                                        PID:6124
                                                        • C:\Windows\system32\net1.exe
                                                          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                                          3⤵
                                                            PID:1856
                                                        • C:\Windows\System32\net.exe
                                                          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                                          2⤵
                                                            PID:6116
                                                            • C:\Windows\system32\net1.exe
                                                              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                                              3⤵
                                                                PID:216
                                                            • C:\Windows\System32\net.exe
                                                              "C:\Windows\System32\net.exe" stop "samss" /y
                                                              2⤵
                                                                PID:4220
                                                                • C:\Windows\system32\net1.exe
                                                                  C:\Windows\system32\net1 stop "samss" /y
                                                                  3⤵
                                                                    PID:2860
                                                                • C:\Windows\System32\net.exe
                                                                  "C:\Windows\System32\net.exe" stop "samss" /y
                                                                  2⤵
                                                                    PID:6140
                                                                    • C:\Windows\system32\net1.exe
                                                                      C:\Windows\system32\net1 stop "samss" /y
                                                                      3⤵
                                                                        PID:4204
                                                                  • C:\Windows\system32\BackgroundTransferHost.exe
                                                                    "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
                                                                    1⤵
                                                                      PID:2980
                                                                    • C:\Windows\system32\WerFault.exe
                                                                      C:\Windows\system32\WerFault.exe -pss -s 460 -p 2924 -ip 2924
                                                                      1⤵
                                                                      • Suspicious use of NtCreateProcessExOtherParentProcess
                                                                      PID:4940

                                                                    Network

                                                                    MITRE ATT&CK Enterprise v6

                                                                    Replay Monitor

                                                                    Loading Replay Monitor...

                                                                    Downloads

                                                                    • memory/2220-130-0x00007FF761430000-0x00007FF7617C6000-memory.dmp

                                                                      Filesize

                                                                      3.6MB

                                                                      Download

                                                                    • memory/2236-131-0x00007FF761430000-0x00007FF7617C6000-memory.dmp

                                                                      Filesize

                                                                      3.6MB

                                                                      Download

                                                                    • memory/2740-195-0x000001B6B83C0000-0x000001B6B83C8000-memory.dmp

                                                                      Filesize

                                                                      32KB

                                                                      Download

                                                                    • memory/2740-196-0x000001B6B8330000-0x000001B6B8331000-memory.dmp

                                                                      Filesize

                                                                      4KB

                                                                      Download