ryuk | 3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc

Analysis

max time kernel
186s
max time network
243s
platform
windows10-2004_x64
resource
win10v2004-en-20220113
submitted
20-02-2022 08:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
Size

140KB
MD5

d27a71b6b5bb69501ac88ab920878446
SHA1

0d06f9eb99239d6637936dd0637e17ea537f55cf
SHA256

3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc
SHA512

037f7b34841dd924574089bede0acfc8ae374a612cc4151180a7aee684581b1896562956e950c0aed27355062ad27318557f8091fcf1afe7440544094fb58810

Score

10^/10

ryuk persistence ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe"	reg.exe

Drops file in Program Files directory 45 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\7z.sfx	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fa.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\da.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\co.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hr.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\io.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\RyukReadMe.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\br.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fr.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gu.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hy.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bg.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ast.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\bn.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fur.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cs.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\id.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\RyukReadMe.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\az.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ga.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\es.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\el.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ext.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eu.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\de.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hi.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\he.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
File opened for modification	C:\Program Files\7-Zip\Lang\hu.txt	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe

Suspicious use of WriteProcessMemory 19 IoCs

description	pid	Process	procid_target
PID 1176 wrote to memory of 2508	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	84
PID 1176 wrote to memory of 2508	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	84
PID 1176 wrote to memory of 2508	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	84
PID 1176 wrote to memory of 2276	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	61
PID 2508 wrote to memory of 448	2508	cmd.exe	86
PID 2508 wrote to memory of 448	2508	cmd.exe	86
PID 2508 wrote to memory of 448	2508	cmd.exe	86
PID 1176 wrote to memory of 2300	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	60
PID 1176 wrote to memory of 2420	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	58
PID 1176 wrote to memory of 708	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	49
PID 1176 wrote to memory of 3260	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	48
PID 1176 wrote to memory of 3348	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	47
PID 1176 wrote to memory of 3424	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	25
PID 1176 wrote to memory of 3500	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	46
PID 1176 wrote to memory of 3744	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	45
PID 1176 wrote to memory of 2248	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	42
PID 1176 wrote to memory of 556	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	32
PID 1176 wrote to memory of 2044	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	30
PID 1176 wrote to memory of 640	1176	3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe	83

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3424

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2044

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
PID:556

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2248

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3744

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3500

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:3348

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3260

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:708

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2420

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2300

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2276

C:\Users\Admin\AppData\Local\Temp\3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe
"C:\Users\Admin\AppData\Local\Temp\3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1176
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe" /f /reg:64
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2508
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\3ed083999930a1eab5857dc0e0101fd5777a737029eabe6eb481052f78c53ccc.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:448

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
PID:640

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1176-130-0x0000000030000000-0x0000000030382000-memory.dmp

Filesize
3.5MB

Download