ryuk | 487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4

General

Target

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
Size

193KB
MD5

e197188193bc7e7a2049c8c966c2e148
SHA1

8a12a2255be5b4d42c90c5d0b9f2d4797fa3cd69
SHA256

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4
SHA512

edf405353d643eeb038b4040b1bd1f5558ec6fded6c7ab516497d6f62c1f48d0c2d948d5bb8d6cc3ec87fd7f4f2ce883879ea20bcf86b69721629ae67a3323d8

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 1 IoCs

Processes:

lwOczsq.exe

pid process

3468 lwOczsq.exe

pid	process
3468	lwOczsq.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exelwOczsq.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	lwOczsq.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899957417381930"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4164"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4228"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.921989"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.591713"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.909112"	svchost.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exelwOczsq.exe

pid	process
1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
3468	lwOczsq.exe
3468	lwOczsq.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exelwOczsq.exe

description	pid	process
Token: SeBackupPrivilege	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
Token: SeBackupPrivilege	3468	lwOczsq.exe

Suspicious use of WriteProcessMemory 21 IoCs

Processes:

487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exelwOczsq.exe

description	pid	process	target process
PID 1640 wrote to memory of 3468	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	lwOczsq.exe
PID 1640 wrote to memory of 3468	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	lwOczsq.exe
PID 1640 wrote to memory of 3468	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	lwOczsq.exe
PID 1640 wrote to memory of 3208	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 3208	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 3208	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 1224	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 1224	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 1224	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 2900	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 2900	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 2900	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 3468 wrote to memory of 3816	3468	lwOczsq.exe	net.exe
PID 3468 wrote to memory of 3816	3468	lwOczsq.exe	net.exe
PID 3468 wrote to memory of 3816	3468	lwOczsq.exe	net.exe
PID 1640 wrote to memory of 3936	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 3936	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 1640 wrote to memory of 3936	1640	487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe	net.exe
PID 3468 wrote to memory of 2024	3468	lwOczsq.exe	net.exe
PID 3468 wrote to memory of 2024	3468	lwOczsq.exe	net.exe
PID 3468 wrote to memory of 2024	3468	lwOczsq.exe	net.exe

C:\Users\Admin\AppData\Local\Temp\487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe
"C:\Users\Admin\AppData\Local\Temp\487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640

C:\Users\Admin\AppData\Local\Temp\lwOczsq.exe
"C:\Users\Admin\AppData\Local\Temp\lwOczsq.exe" 8 LAN
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3468

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
3⤵
PID:3816

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
3⤵
PID:2024

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
PID:1224

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
PID:3208

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:2900

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:3936

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:3304

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2
MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwOczsq.exe
MD5
e197188193bc7e7a2049c8c966c2e148

SHA1
8a12a2255be5b4d42c90c5d0b9f2d4797fa3cd69

SHA256
487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4

SHA512
edf405353d643eeb038b4040b1bd1f5558ec6fded6c7ab516497d6f62c1f48d0c2d948d5bb8d6cc3ec87fd7f4f2ce883879ea20bcf86b69721629ae67a3323d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\lwOczsq.exe
MD5
e197188193bc7e7a2049c8c966c2e148

SHA1
8a12a2255be5b4d42c90c5d0b9f2d4797fa3cd69

SHA256
487d4698c6c938ca3e9251827a5813ddd21e26584b3459d768e457ddd4e8c4d4

SHA512
edf405353d643eeb038b4040b1bd1f5558ec6fded6c7ab516497d6f62c1f48d0c2d948d5bb8d6cc3ec87fd7f4f2ce883879ea20bcf86b69721629ae67a3323d8

Download Submit

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads