ryuk | 826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec

Analysis

max time kernel
188s
max time network
195s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20/02/2022, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
Size 206KB
Sample220220-ftwwaaaael
SHA256 826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec
MD5 c75b0beff52189aed827839bea3e5da4
SHA1 e9b20948b82eee88081cebe2d62408871dbe601a
SHA512 4fe591ab12f1245f7f16efea215679321ff415b879cacfa373824e6f170d08ffcf650783f835fd219abe240b7fe0fd48d4f1dad0e4b730e7e72fb6433b6b8a9c
MD5 SHA1 SHA512

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

ryuk

Ransom Note

Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 5052 created 2740	5052	WerFault.exe	33
PID 4812 created 2916	4812	WerFault.exe	31

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\3D Objects\desktop.ini	sihost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	sihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
4960	2740	WerFault.exe	33
5700	2740	WerFault.exe	33
5712	2916	WerFault.exe	31

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
2224	sihost.exe
2224	sihost.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
2224	sihost.exe
2224	sihost.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
5712	WerFault.exe
5712	WerFault.exe
4960	WerFault.exe
4960	WerFault.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
Token: SeBackupPrivilege	2224	sihost.exe
Token: SeBackupPrivilege	2916	StartMenuExperienceHost.exe
Token: SeBackupPrivilege	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
2980	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 2224	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	38
PID 1984 wrote to memory of 2244	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	37
PID 1984 wrote to memory of 2296	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	36
PID 1984 wrote to memory of 2536	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	34
PID 1984 wrote to memory of 2740	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	33
PID 1984 wrote to memory of 2916	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	31
PID 1984 wrote to memory of 2980	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	11
PID 1984 wrote to memory of 3068	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	30
PID 1984 wrote to memory of 2772	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	29
PID 1984 wrote to memory of 3496	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	27
PID 1984 wrote to memory of 2924	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	23
PID 1984 wrote to memory of 2168	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	18
PID 2740 wrote to memory of 4960	2740	DllHost.exe	60
PID 2740 wrote to memory of 4960	2740	DllHost.exe	60
PID 1984 wrote to memory of 4980	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	64
PID 1984 wrote to memory of 4980	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	64
PID 2224 wrote to memory of 4992	2224	sihost.exe	63
PID 2224 wrote to memory of 4992	2224	sihost.exe	63
PID 1984 wrote to memory of 544	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	65
PID 1984 wrote to memory of 544	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	65
PID 2224 wrote to memory of 2992	2224	sihost.exe	67
PID 2224 wrote to memory of 2992	2224	sihost.exe	67
PID 2224 wrote to memory of 4928	2224	sihost.exe	72
PID 2224 wrote to memory of 4928	2224	sihost.exe	72
PID 1984 wrote to memory of 2424	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	69
PID 1984 wrote to memory of 2424	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	69
PID 1984 wrote to memory of 5192	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	74
PID 4992 wrote to memory of 5216	4992	net.exe	76
PID 4992 wrote to memory of 5216	4992	net.exe	76
PID 2992 wrote to memory of 5232	2992	net.exe	78
PID 2992 wrote to memory of 5232	2992	net.exe	78
PID 1984 wrote to memory of 5192	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	74
PID 4928 wrote to memory of 5224	4928	net.exe	77
PID 4928 wrote to memory of 5224	4928	net.exe	77
PID 1984 wrote to memory of 5260	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	79
PID 1984 wrote to memory of 5260	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	79
PID 1984 wrote to memory of 5296	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	82
PID 1984 wrote to memory of 5296	1984	826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe	82
PID 4980 wrote to memory of 5424	4980	net.exe	87
PID 4980 wrote to memory of 5424	4980	net.exe	87
PID 544 wrote to memory of 5396	544	net.exe	86
PID 544 wrote to memory of 5396	544	net.exe	86
PID 2424 wrote to memory of 5432	2424	net.exe	85
PID 2424 wrote to memory of 5432	2424	net.exe	85
PID 5192 wrote to memory of 5484	5192	net.exe	90
PID 5192 wrote to memory of 5484	5192	net.exe	90
PID 5052 wrote to memory of 2740	5052	WerFault.exe	33
PID 5052 wrote to memory of 2740	5052	WerFault.exe	33
PID 5296 wrote to memory of 5520	5296	net.exe	89
PID 5296 wrote to memory of 5520	5296	net.exe	89
PID 5260 wrote to memory of 5528	5260	net.exe	88
PID 5260 wrote to memory of 5528	5260	net.exe	88
PID 4812 wrote to memory of 2916	4812	WerFault.exe	31
PID 4812 wrote to memory of 2916	4812	WerFault.exe	31
PID 2224 wrote to memory of 840	2224	sihost.exe	96
PID 2224 wrote to memory of 840	2224	sihost.exe	96
PID 840 wrote to memory of 5180	840	net.exe	98
PID 840 wrote to memory of 5180	840	net.exe	98
PID 2224 wrote to memory of 4828	2224	sihost.exe	99
PID 2224 wrote to memory of 4828	2224	sihost.exe	99
PID 4828 wrote to memory of 3784	4828	net.exe	101
PID 4828 wrote to memory of 3784	4828	net.exe	101
PID 2224 wrote to memory of 5708	2224	sihost.exe	102
PID 2224 wrote to memory of 5708	2224	sihost.exe	102

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Suspicious use of UnmapMainImage
PID:2980

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:2168

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2772

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3068

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 2232
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:5712

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 956
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:4960
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 956
  2⤵
  - Program crash
  PID:5700

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2536

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2244

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5216
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5232
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4928
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5224
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5180
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3784
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5708
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:452

C:\Users\Admin\AppData\Local\Temp\826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe
"C:\Users\Admin\AppData\Local\Temp\826ab21b35cb73a12a56002c87c492d0192e85f912627e440f49e2d2777942ec.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5424
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5396
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2424
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5432
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5484
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5260
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5528
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5296
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5520
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:2504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5596
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:5600
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:2752
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:2192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5172
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:5720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5344
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:2836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1936
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:3360
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1528

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 452 -p 2740 -ip 2740
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:5052

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2916 -ip 2916
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:4812

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-130-0x00007FF6E2C40000-0x00007FF6E2FD7000-memory.dmp

Download

memory/2244-131-0x00007FF6E2C40000-0x00007FF6E2FD7000-memory.dmp

Download