Overview

overview

10

Static

static

58a0a56466...9d.exe

windows7_x64

10

58a0a56466...9d.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    168s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 07:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d.exe

  • Size

    153KB

  • MD5

    91759691cfe41dd1a9dd07eaf9f48129

  • SHA1

    37fd2b22f3a9c85cdbaaf4cbbe33333ecc8030c4

  • SHA256

    58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d

  • SHA512

    f19d0b358f318e243a648311b1cf7e9c162cf18880f667ba4daff3fd5696a17854a091791452ee9814b1e1e85d07f4b98da07d957b7f51b450692e85a6b5e3a6

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Drops desktop.ini file(s) 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1372
    • C:\Windows\system32\taskhost.exe
      "taskhost.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Suspicious use of AdjustPrivilegeToken
      PID:1252
    • C:\Users\Admin\AppData\Local\Temp\58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d.exe
      "C:\Users\Admin\AppData\Local\Temp\58a0a5646669443e997f88d532219141ff6c9ca8d36cd449c34a1807be919a9d.exe"
      1⤵
      • Drops desktop.ini file(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1616

    Network

    MITRE ATT&CK Matrix

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1252-55-0x000000013F160000-0x000000013F4EA000-memory.dmp

      Filesize

      3.5MB

      Download

    • memory/1252-57-0x000000013F160000-0x000000013F4EA000-memory.dmp

      Filesize

      3.5MB

      Download

    • memory/1372-58-0x000000013F160000-0x000000013F4EA000-memory.dmp

      Filesize

      3.5MB

      Download