ryuk | 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096

Analysis

max time kernel
175s
max time network
211s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
Size

186KB
MD5

d0020f73e4567c9a96b92c78419ed215
SHA1

10766dfbedd4ffba1c23bad0d83324bd04d2700a
SHA256

6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096
SHA512

fa075796f4192b8249708f0d18b3dadf56874b75a1619e17ae3a3e61ff72eec010e9d53bb69e5627255119a1ade463dd432b8d9a046da74b653c7f5e83238d8a

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 1 IoCs

pid	Process
4476	vSCrxOE.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	vSCrxOE.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4476	vSCrxOE.exe
4476	vSCrxOE.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
4476	vSCrxOE.exe
4476	vSCrxOE.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
Token: SeBackupPrivilege	4476	vSCrxOE.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4832 wrote to memory of 4476	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	84
PID 4832 wrote to memory of 4476	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	84
PID 4832 wrote to memory of 4476	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	84
PID 4832 wrote to memory of 3496	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	85
PID 4832 wrote to memory of 3496	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	85
PID 4832 wrote to memory of 3496	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	85
PID 4832 wrote to memory of 2788	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	86
PID 4832 wrote to memory of 2788	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	86
PID 4832 wrote to memory of 2788	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	86
PID 2788 wrote to memory of 1640	2788	net.exe	89
PID 2788 wrote to memory of 1640	2788	net.exe	89
PID 2788 wrote to memory of 1640	2788	net.exe	89
PID 3496 wrote to memory of 4028	3496	net.exe	90
PID 3496 wrote to memory of 4028	3496	net.exe	90
PID 3496 wrote to memory of 4028	3496	net.exe	90
PID 4476 wrote to memory of 4192	4476	vSCrxOE.exe	91
PID 4476 wrote to memory of 4192	4476	vSCrxOE.exe	91
PID 4476 wrote to memory of 4192	4476	vSCrxOE.exe	91
PID 4832 wrote to memory of 4384	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	92
PID 4832 wrote to memory of 4384	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	92
PID 4832 wrote to memory of 4384	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	92
PID 4832 wrote to memory of 2580	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	93
PID 4832 wrote to memory of 2580	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	93
PID 4832 wrote to memory of 2580	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	93
PID 4192 wrote to memory of 4056	4192	net.exe	97
PID 4192 wrote to memory of 4056	4192	net.exe	97
PID 4192 wrote to memory of 4056	4192	net.exe	97
PID 4476 wrote to memory of 828	4476	vSCrxOE.exe	98
PID 4476 wrote to memory of 828	4476	vSCrxOE.exe	98
PID 4476 wrote to memory of 828	4476	vSCrxOE.exe	98
PID 2580 wrote to memory of 3688	2580	net.exe	99
PID 2580 wrote to memory of 3688	2580	net.exe	99
PID 2580 wrote to memory of 3688	2580	net.exe	99
PID 4384 wrote to memory of 3848	4384	net.exe	101
PID 4384 wrote to memory of 3848	4384	net.exe	101
PID 4384 wrote to memory of 3848	4384	net.exe	101
PID 828 wrote to memory of 2612	828	net.exe	102
PID 828 wrote to memory of 2612	828	net.exe	102
PID 828 wrote to memory of 2612	828	net.exe	102
PID 4832 wrote to memory of 9944	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	106
PID 4832 wrote to memory of 9944	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	106
PID 4832 wrote to memory of 9944	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	106
PID 4832 wrote to memory of 9952	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	105
PID 4832 wrote to memory of 9952	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	105
PID 4832 wrote to memory of 9952	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	105
PID 4832 wrote to memory of 10008	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	109
PID 4832 wrote to memory of 10008	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	109
PID 4832 wrote to memory of 10008	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	109
PID 4832 wrote to memory of 10024	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	111
PID 4832 wrote to memory of 10024	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	111
PID 4832 wrote to memory of 10024	4832	6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe	111
PID 9952 wrote to memory of 10120	9952	net.exe	113
PID 9952 wrote to memory of 10120	9952	net.exe	113
PID 9952 wrote to memory of 10120	9952	net.exe	113
PID 10008 wrote to memory of 10136	10008	net.exe	114
PID 10008 wrote to memory of 10136	10008	net.exe	114
PID 10008 wrote to memory of 10136	10008	net.exe	114
PID 10024 wrote to memory of 10148	10024	net.exe	115
PID 10024 wrote to memory of 10148	10024	net.exe	115
PID 10024 wrote to memory of 10148	10024	net.exe	115
PID 9944 wrote to memory of 10156	9944	net.exe	116
PID 9944 wrote to memory of 10156	9944	net.exe	116
PID 9944 wrote to memory of 10156	9944	net.exe	116

C:\Users\Admin\AppData\Local\Temp\6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
"C:\Users\Admin\AppData\Local\Temp\6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832
- C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exe
  "C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4476
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4192
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
      4⤵
      PID:4056
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:828
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:2612
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3496
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4028
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1640
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4384
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3848
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2580
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3688
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:9952
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:10120
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:9944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:10156
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:10008
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:10136
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:10024
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:10148

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads