Overview

overview

10

Static

static

88c513a6ec...c5.exe

windows7_x64

10

88c513a6ec...c5.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    173s
  • max time network
    200s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20-02-2022 04:55

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    88c513a6ec19c8f34fb699d6c2f46549e0a4c3dedd364b91b801757d7bfe4fc5.exe

  • Size

    190KB

  • MD5

    e8c26344b4adb62a9a42cf6480c88d05

  • SHA1

    41f926e43e9686382f8c84da42880c47999645fb

  • SHA256

    88c513a6ec19c8f34fb699d6c2f46549e0a4c3dedd364b91b801757d7bfe4fc5

  • SHA512

    287c49f05e2a9928c98986130e875af96d2690097ce00780bbd51034a1a5396c56d20e90ca267f8eb79c440d9b2cbf44e0082910807d934c5edad036d6277d2f

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Adobe\Acrobat\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] [email protected] balance of shadow universe Ryuk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 4 IoCs
  • Modifies registry class 42 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\backgroundTaskHost.exe
    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:3580
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3580 -s 3180
      2⤵
      • Program crash
      • Suspicious behavior: EnumeratesProcesses
      PID:5796
  • C:\Windows\system32\backgroundTaskHost.exe
    "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
    1⤵
      PID:1648
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
      • Modifies registry class
      PID:2572
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:3324
      • C:\Windows\System32\RuntimeBroker.exe
        C:\Windows\System32\RuntimeBroker.exe -Embedding
        1⤵
          PID:2628
        • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
          "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
          1⤵
            PID:3064
          • C:\Windows\System32\RuntimeBroker.exe
            C:\Windows\System32\RuntimeBroker.exe -Embedding
            1⤵
              PID:2984
            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
              1⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2904
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2904 -s 2780
                2⤵
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                PID:5828
            • C:\Windows\system32\DllHost.exe
              C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
              1⤵
              • Suspicious use of WriteProcessMemory
              PID:2744
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2744 -s 996
                2⤵
                • Program crash
                PID:4824
              • C:\Windows\system32\WerFault.exe
                C:\Windows\system32\WerFault.exe -u -p 2744 -s 996
                2⤵
                • Program crash
                PID:5808
            • C:\Windows\system32\svchost.exe
              C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
              1⤵
                PID:2528
              • C:\Windows\system32\taskhostw.exe
                taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
                1⤵
                  PID:2296
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                  1⤵
                    PID:2244
                  • C:\Windows\system32\sihost.exe
                    sihost.exe
                    1⤵
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:2228
                    • C:\Windows\System32\net.exe
                      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:1012
                      • C:\Windows\system32\net1.exe
                        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                        3⤵
                          PID:5396
                      • C:\Windows\System32\net.exe
                        "C:\Windows\System32\net.exe" stop "samss" /y
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:5196
                        • C:\Windows\system32\net1.exe
                          C:\Windows\system32\net1 stop "samss" /y
                          3⤵
                            PID:5420
                        • C:\Windows\System32\net.exe
                          "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                          2⤵
                          • Suspicious use of WriteProcessMemory
                          PID:5924
                          • C:\Windows\system32\net1.exe
                            C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                            3⤵
                              PID:5976
                          • C:\Windows\System32\net.exe
                            "C:\Windows\System32\net.exe" stop "samss" /y
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:5996
                            • C:\Windows\system32\net1.exe
                              C:\Windows\system32\net1 stop "samss" /y
                              3⤵
                                PID:6048
                          • C:\Users\Admin\AppData\Local\Temp\88c513a6ec19c8f34fb699d6c2f46549e0a4c3dedd364b91b801757d7bfe4fc5.exe
                            "C:\Users\Admin\AppData\Local\Temp\88c513a6ec19c8f34fb699d6c2f46549e0a4c3dedd364b91b801757d7bfe4fc5.exe"
                            1⤵
                            • Checks computer location settings
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3748
                            • C:\Windows\System32\net.exe
                              "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                              2⤵
                              • Suspicious use of WriteProcessMemory
                              PID:5320
                              • C:\Windows\system32\net1.exe
                                C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                3⤵
                                  PID:5640
                              • C:\Windows\System32\net.exe
                                "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                2⤵
                                • Suspicious use of WriteProcessMemory
                                PID:5328
                                • C:\Windows\system32\net1.exe
                                  C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                  3⤵
                                    PID:5648
                                • C:\Windows\System32\net.exe
                                  "C:\Windows\System32\net.exe" stop "samss" /y
                                  2⤵
                                  • Suspicious use of WriteProcessMemory
                                  PID:5436
                                  • C:\Windows\system32\net1.exe
                                    C:\Windows\system32\net1 stop "samss" /y
                                    3⤵
                                      PID:5700
                                  • C:\Windows\System32\net.exe
                                    "C:\Windows\System32\net.exe" stop "samss" /y
                                    2⤵
                                    • Suspicious use of WriteProcessMemory
                                    PID:5532
                                    • C:\Windows\system32\net1.exe
                                      C:\Windows\system32\net1 stop "samss" /y
                                      3⤵
                                        PID:5708
                                    • C:\Windows\System32\net.exe
                                      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                      2⤵
                                      • Suspicious use of WriteProcessMemory
                                      PID:6104
                                      • C:\Windows\system32\net1.exe
                                        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                        3⤵
                                          PID:5216
                                      • C:\Windows\System32\net.exe
                                        "C:\Windows\System32\net.exe" stop "samss" /y
                                        2⤵
                                          PID:5084
                                          • C:\Windows\system32\net1.exe
                                            C:\Windows\system32\net1 stop "samss" /y
                                            3⤵
                                              PID:2604
                                          • C:\Windows\System32\net.exe
                                            "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
                                            2⤵
                                            • Suspicious use of WriteProcessMemory
                                            PID:4860
                                            • C:\Windows\system32\net1.exe
                                              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
                                              3⤵
                                                PID:3512
                                            • C:\Windows\System32\net.exe
                                              "C:\Windows\System32\net.exe" stop "samss" /y
                                              2⤵
                                                PID:5484
                                                • C:\Windows\system32\net1.exe
                                                  C:\Windows\system32\net1 stop "samss" /y
                                                  3⤵
                                                    PID:5100
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 488 -p 3580 -ip 3580
                                                1⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                • Suspicious use of WriteProcessMemory
                                                PID:5008
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 424 -p 2744 -ip 2744
                                                1⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                • Suspicious use of WriteProcessMemory
                                                PID:4996
                                              • C:\Windows\system32\WerFault.exe
                                                C:\Windows\system32\WerFault.exe -pss -s 480 -p 2904 -ip 2904
                                                1⤵
                                                • Suspicious use of NtCreateProcessExOtherParentProcess
                                                • Suspicious use of WriteProcessMemory
                                                PID:4816

                                              Network

                                              MITRE ATT&CK Enterprise v6

                                              Replay Monitor

                                              Loading Replay Monitor...

                                              Downloads

                                              • memory/2228-130-0x00007FF6701A0000-0x00007FF670475000-memory.dmp

                                                Filesize

                                                2.8MB

                                                Download

                                              • memory/2744-180-0x00000265DB1F0000-0x00000265DB1F1000-memory.dmp

                                                Filesize

                                                4KB

                                                Download

                                              • memory/2744-179-0x00000265DB200000-0x00000265DB208000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2744-195-0x00000265DB2E0000-0x00000265DB2E8000-memory.dmp

                                                Filesize

                                                32KB

                                                Download

                                              • memory/2744-196-0x00000265DB100000-0x00000265DB101000-memory.dmp

                                                Filesize

                                                4KB

                                                Download