ryuk | 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

General

Target

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
Size

190KB
MD5

65865d94596a90b7e6204deb1de53c3d
SHA1

282e3776f86d3b0b2916ed6047ad272fe2f0cf6e
SHA256

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb
SHA512

3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

zXWyTgQ.exe

pid process

760 zXWyTgQ.exe

pid	process
760	zXWyTgQ.exe

Loads dropped DLL 2 IoCs

Processes:

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

pid	process
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

Enumerates connected drives 3 TTPs 2 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

description	ioc	process
File opened (read-only)	\??\a:	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
File opened (read-only)	\??\A:	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 39 IoCs

Processes:

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exezXWyTgQ.exe

pid	process
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
760	zXWyTgQ.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
760	zXWyTgQ.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
760	zXWyTgQ.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exezXWyTgQ.exe

description	pid	process
Token: SeBackupPrivilege	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
Token: SeBackupPrivilege	760	zXWyTgQ.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exezXWyTgQ.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exe

description	pid	process	target process
PID 1672 wrote to memory of 760	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	zXWyTgQ.exe
PID 1672 wrote to memory of 760	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	zXWyTgQ.exe
PID 1672 wrote to memory of 760	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	zXWyTgQ.exe
PID 1672 wrote to memory of 760	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	zXWyTgQ.exe
PID 1672 wrote to memory of 1992	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1992	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1992	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1992	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 760 wrote to memory of 596	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 596	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 596	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 596	760	zXWyTgQ.exe	net.exe
PID 1672 wrote to memory of 1084	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1084	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1084	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1084	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 760 wrote to memory of 2000	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 2000	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 2000	760	zXWyTgQ.exe	net.exe
PID 760 wrote to memory of 2000	760	zXWyTgQ.exe	net.exe
PID 1672 wrote to memory of 1600	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1600	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1600	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 1600	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 996	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 996	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 996	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 996	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 2000 wrote to memory of 2156	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2156	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2156	2000	net.exe	net1.exe
PID 2000 wrote to memory of 2156	2000	net.exe	net1.exe
PID 1600 wrote to memory of 2244	1600	net.exe	net1.exe
PID 1600 wrote to memory of 2244	1600	net.exe	net1.exe
PID 1600 wrote to memory of 2244	1600	net.exe	net1.exe
PID 1600 wrote to memory of 2244	1600	net.exe	net1.exe
PID 1992 wrote to memory of 2228	1992	net.exe	net1.exe
PID 1992 wrote to memory of 2228	1992	net.exe	net1.exe
PID 1992 wrote to memory of 2228	1992	net.exe	net1.exe
PID 1992 wrote to memory of 2228	1992	net.exe	net1.exe
PID 596 wrote to memory of 2136	596	net.exe	net1.exe
PID 596 wrote to memory of 2136	596	net.exe	net1.exe
PID 596 wrote to memory of 2136	596	net.exe	net1.exe
PID 596 wrote to memory of 2136	596	net.exe	net1.exe
PID 996 wrote to memory of 2236	996	net.exe	net1.exe
PID 996 wrote to memory of 2236	996	net.exe	net1.exe
PID 996 wrote to memory of 2236	996	net.exe	net1.exe
PID 996 wrote to memory of 2236	996	net.exe	net1.exe
PID 1084 wrote to memory of 2252	1084	net.exe	net1.exe
PID 1084 wrote to memory of 2252	1084	net.exe	net1.exe
PID 1084 wrote to memory of 2252	1084	net.exe	net1.exe
PID 1084 wrote to memory of 2252	1084	net.exe	net1.exe
PID 1672 wrote to memory of 35076	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35076	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35076	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35076	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 35076 wrote to memory of 35120	35076	net.exe	net1.exe
PID 35076 wrote to memory of 35120	35076	net.exe	net1.exe
PID 35076 wrote to memory of 35120	35076	net.exe	net1.exe
PID 35076 wrote to memory of 35120	35076	net.exe	net1.exe
PID 1672 wrote to memory of 35728	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35728	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35728	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe
PID 1672 wrote to memory of 35728	1672	683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
"C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672

C:\Users\Admin\AppData\Local\Temp\zXWyTgQ.exe
"C:\Users\Admin\AppData\Local\Temp\zXWyTgQ.exe" 8 LAN
2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:596

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
4⤵
PID:2136

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:2156

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
PID:36732

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
4⤵
PID:36756

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1992

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2228

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2252

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1600

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2244

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:996

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2236

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:35076

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:35120

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:35728

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:35724

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:36656

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:36684

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:36696

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:36720

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a
MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
MD5
3b40f517a25611205b0ba7af8ae225f1

SHA1
aa7e89f3d1202b37ff89d629ebe10dae8c4e14db

SHA256
385752904c61abf42b315b172c40b4a50d50cc58c94077cff0815c834e1ac013

SHA512
8d17239868ef33175214e14fc5ad245c9d5505deaf8747c079e6e05bca1c77e62bbacc5af8519dccae63b8d4e959ed32d3748d62de1aa3f7b256c35524af9f52

Download Submit
C:\Users\Admin\AppData\Local\Temp\zXWyTgQ.exe
MD5
65865d94596a90b7e6204deb1de53c3d

SHA1
282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

SHA256
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

SHA512
3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Download Submit
\Users\Admin\AppData\Local\Temp\zXWyTgQ.exe
MD5
65865d94596a90b7e6204deb1de53c3d

SHA1
282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

SHA256
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

SHA512
3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Download Submit
\Users\Admin\AppData\Local\Temp\zXWyTgQ.exe
MD5
65865d94596a90b7e6204deb1de53c3d

SHA1
282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

SHA256
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

SHA512
3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Download Submit
memory/1672-55-0x0000000075F81000-0x0000000075F83000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads