ryuk | 64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb

Analysis

max time kernel
171s
max time network
175s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20-02-2022 06:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe
Size

170KB
MD5

70aaa49f0a555839f4a1243687a93734
SHA1

89f755b3dee1dfd4fc847510fec715165c915964
SHA256

64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb
SHA512

f0b28badfe31f8bd0bb147e03d48f103da6e2e529c7bd568b9e6b7c63f495770bdb90633f27c1291cbd6871dae08f7e3ff72b113b80f6ae0e3de50aeda877372

Score

10^/10

ryuk persistence ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 1428 created 2908	1428	WerFault.exe	44

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\RELEASE-NOTES.html	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\security\javaws.policy	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\amd64\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsnld.xml	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\ado\ja-JP\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jconsole.jar	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgePackages.h	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\ffjcext.zip	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscht.xml	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshrv.xml	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\es-ES\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\it-IT\sqloledb.rll.mui	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\classlist	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\splash.gif	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\ja-JP\sqloledb.rll.mui	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\LICENSE	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.c	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\COPYRIGHT	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ro.txt	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ug.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\logging.properties	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\ado\adovbs.inc	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\README-JDK.html	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\dropins\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hu-HU\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Internet Explorer\SIGNUP\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Internet Explorer\de-DE\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\COPYRIGHT	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\jvmti.h	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\rt.jar	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\adcjavas.inc	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\Services\verisign.bmp	sihost.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\sound.properties	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\keypad\ea.xml	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenclm.dat	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\sRGB.pf	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\RyukReadMe.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_pt_BR.properties	sihost.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaBrightDemiItalic.ttf	sihost.exe
File opened for modification	C:\Program Files\7-Zip\Lang\mng2.txt	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	sihost.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	sihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 2 IoCs

pid	pid_target	Process	procid_target
3660	2812	WerFault.exe	45
4440	2908	WerFault.exe	44

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe
3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe
4440	WerFault.exe
4440	WerFault.exe
3660	WerFault.exe
3660	WerFault.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
3384	RuntimeBroker.exe

Suspicious use of WriteProcessMemory 23 IoCs

description	pid	Process	procid_target
PID 3840 wrote to memory of 4084	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	58
PID 3840 wrote to memory of 4084	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	58
PID 3840 wrote to memory of 2284	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	49
PID 4084 wrote to memory of 2676	4084	cmd.exe	60
PID 4084 wrote to memory of 2676	4084	cmd.exe	60
PID 3840 wrote to memory of 2304	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	48
PID 3840 wrote to memory of 2344	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	24
PID 3840 wrote to memory of 2612	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	46
PID 3840 wrote to memory of 2812	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	45
PID 3840 wrote to memory of 2908	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	44
PID 3840 wrote to memory of 3008	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	43
PID 3840 wrote to memory of 772	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	42
PID 3840 wrote to memory of 3128	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	41
PID 3840 wrote to memory of 3516	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	25
PID 3840 wrote to memory of 3384	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	35
PID 3840 wrote to memory of 3372	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	26
PID 3840 wrote to memory of 2108	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	30
PID 3840 wrote to memory of 1588	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	57
PID 3840 wrote to memory of 4084	3840	64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe	58
PID 2812 wrote to memory of 3660	2812	DllHost.exe	66
PID 2812 wrote to memory of 3660	2812	DllHost.exe	66
PID 1428 wrote to memory of 2908	1428	WerFault.exe	44
PID 1428 wrote to memory of 2908	1428	WerFault.exe	44

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2344

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3516

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3372

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:2108

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of UnmapMainImage
PID:3384

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3128

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:772

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3008

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:2908
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2908 -s 2648
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:4440

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2812 -s 372
  2⤵
  - Program crash
  - Suspicious behavior: EnumeratesProcesses
  PID:3660

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2304

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Drops file in Program Files directory
PID:2284

C:\Users\Admin\AppData\Local\Temp\64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe
"C:\Users\Admin\AppData\Local\Temp\64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3840
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4084
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\64a52f12347a9a53bfb1adeecec2a3cd09b71f080c9c2cbd9f3f3eb2c24ee3cb.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2676

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:1588

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 468 -p 2908 -ip 2908
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
PID:1428

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
PID:5072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2284-130-0x00007FF6BBE40000-0x00007FF6BC1CE000-memory.dmp

Filesize
3.6MB

Download
memory/2304-131-0x00007FF6BBE40000-0x00007FF6BC1CE000-memory.dmp

Filesize
3.6MB

Download
memory/2812-132-0x000001F80E2B0000-0x000001F80E2B8000-memory.dmp

Filesize
32KB

Download
memory/2812-133-0x000001F80E050000-0x000001F80E051000-memory.dmp

Filesize
4KB

Download
memory/2812-134-0x000001F80E050000-0x000001F80E058000-memory.dmp

Filesize
32KB

Download
memory/2812-135-0x000001F80DFA0000-0x000001F80DFA1000-memory.dmp

Filesize
4KB

Download