Overview

overview

10

Static

static

17ad1d64ba...aa.exe

windows7_x64

10

17ad1d64ba...aa.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    180s
  • max time network
    186s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    20-02-2022 09:52

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa.exe

  • Size

    170KB

  • MD5

    83ca718ae747c80564e1a888051301a5

  • SHA1

    487f7828ea059d5730aafbfa54b8f86b2e6f321c

  • SHA256

    17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa

  • SHA512

    ad3b69ff2407cba0ae28d5537f98a0fdd2143705f0ab8fd9b9be342721dfb846252653cc0dd56038b6a32bc2979c43dd83ad87644e616c61bfed3b58c3f24a1f

Score
10/10
ryukpersistenceransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe
Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com
Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 5 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 49 IoCs
  • Modifies registry class 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Windows\system32\taskhostw.exe
    taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
    1⤵
      PID:2296
    • C:\Windows\System32\RuntimeBroker.exe
      C:\Windows\System32\RuntimeBroker.exe -Embedding
      1⤵
        PID:2908
      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
        1⤵
          PID:2992
        • C:\Windows\system32\backgroundTaskHost.exe
          "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
          1⤵
            PID:2224
            • C:\Windows\system32\WerFault.exe
              C:\Windows\system32\WerFault.exe -u -p 2224 -s 1696
              2⤵
              • Program crash
              PID:4664
          • C:\Windows\system32\backgroundTaskHost.exe
            "C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
            1⤵
              PID:212
            • C:\Windows\system32\BackgroundTransferHost.exe
              "BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
              1⤵
                PID:868
                • C:\Windows\system32\WerFault.exe
                  C:\Windows\system32\WerFault.exe -u -p 868 -s 2588
                  2⤵
                  • Program crash
                  PID:4672
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                • Modifies registry class
                PID:2900
              • C:\Windows\System32\RuntimeBroker.exe
                C:\Windows\System32\RuntimeBroker.exe -Embedding
                1⤵
                  PID:3516
                • C:\Windows\System32\RuntimeBroker.exe
                  C:\Windows\System32\RuntimeBroker.exe -Embedding
                  1⤵
                    PID:3116
                  • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                    "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                    1⤵
                      PID:2844
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2844 -s 3060
                        2⤵
                        • Program crash
                        • Suspicious behavior: EnumeratesProcesses
                        PID:4656
                    • C:\Windows\system32\DllHost.exe
                      C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
                      1⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2732
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2732 -s 980
                        2⤵
                        • Program crash
                        • Suspicious behavior: EnumeratesProcesses
                        PID:1104
                      • C:\Windows\system32\WerFault.exe
                        C:\Windows\system32\WerFault.exe -u -p 2732 -s 980
                        2⤵
                        • Program crash
                        PID:4648
                    • C:\Windows\system32\svchost.exe
                      C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
                      1⤵
                        PID:2536
                      • C:\Windows\system32\svchost.exe
                        C:\Windows\system32\svchost.exe -k UnistackSvcGroup
                        1⤵
                          PID:2252
                        • C:\Windows\system32\sihost.exe
                          sihost.exe
                          1⤵
                          • Drops file in Program Files directory
                          PID:2240
                        • C:\Users\Admin\AppData\Local\Temp\17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa.exe
                          "C:\Users\Admin\AppData\Local\Temp\17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa.exe"
                          1⤵
                          • Checks computer location settings
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4092
                          • C:\Windows\System32\cmd.exe
                            "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa.exe" /f
                            2⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1876
                            • C:\Windows\system32\reg.exe
                              REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\17ad1d64baf39c16612ac1c056fc9c23b73d180451bcd8c170fce0861129afaa.exe" /f
                              3⤵
                              • Adds Run key to start application
                              PID:2236
                        • C:\Windows\system32\MusNotifyIcon.exe
                          %systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
                          1⤵
                          • Checks processor information in registry
                          PID:3012
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 472 -p 2844 -ip 2844
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Suspicious use of WriteProcessMemory
                          PID:2984
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 492 -p 2224 -ip 2224
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Suspicious use of WriteProcessMemory
                          PID:3020
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 504 -p 2732 -ip 2732
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Suspicious use of WriteProcessMemory
                          PID:1300
                        • C:\Windows\system32\WerFault.exe
                          C:\Windows\system32\WerFault.exe -pss -s 576 -p 868 -ip 868
                          1⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Suspicious use of WriteProcessMemory
                          PID:1152
                        • C:\Windows\System32\svchost.exe
                          C:\Windows\System32\svchost.exe -k NetworkService -p
                          1⤵
                          • Drops file in Windows directory
                          • Modifies data under HKEY_USERS
                          PID:4440

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Initial Access

                        Execution

                        Persistence

                        Registry Run Keys / Startup Folder

                        1
                        T1060

                        Privilege Escalation

                        Defense Evasion

                        Modify Registry

                        1
                        T1112

                        Credential Access

                        Discovery

                        Query Registry

                        2
                        T1012

                        System Information Discovery

                        3
                        T1082

                        Lateral Movement

                        Collection

                        Exfiltration

                        Command and Control

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\BackgroundTransferApi\7aa470cf-a2cf-47eb-afbf-aebb88b11052.3bd1020d-1a90-45d2-be57-b040448fa9d9.down_meta
                          MD5

                          a1768ff73e2998372a338ec8a8fa3c01

                          SHA1

                          cbef0b30463b2bb02df53ea03a0d9da9d6d8e452

                          SHA256

                          001ee041bb06fddfb3404e354baa1dffc652dcf07ba27eb5c4f64cb20ed29955

                          SHA512

                          b0ce153548acc9a3ce78c65b3c1f1ecec7825a8324629da5f61a1a235ae0b4a58cfb227472ded98d7dbc41c9becb2b8deba681e1ebb1e06a9903284618683b21

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\BackgroundTransferApi\7aa470cf-a2cf-47eb-afbf-aebb88b11052.up_meta_secure
                          MD5

                          8d1eaa4b17708f883fed2c4475e22812

                          SHA1

                          200e2d25498fb35e81b9eb07ef0990b9b1b0a22d

                          SHA256

                          c7173ca17b2e836fe4bbc4a10b968af40a12144b86d81977ecd72e67365522a3

                          SHA512

                          d4c695eaa58c8e82dccc87d0cbb73af3f3b73b9ac652e4dfae829a666e2289dfe6881108b6a785b10a3e95e2e74f7469650a8583306cd4a67cfac99204ab4ed7

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\Microsoft\Crypto\RSA\S-1-5-21-790714498-1549421491-1643397139-1000\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2_4e5a6fffd34f5a98a3ffc9d0e34ac87b
                          MD5

                          93a5aadeec082ffc1bca5aa27af70f52

                          SHA1

                          47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                          SHA256

                          a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                          SHA512

                          df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                          Download Submit
                        • memory/2240-130-0x00007FF691980000-0x00007FF691D0E000-memory.dmp
                          Filesize

                          3.6MB

                          Download
                        • memory/2252-131-0x00007FF691980000-0x00007FF691D0E000-memory.dmp
                          Filesize

                          3.6MB

                          Download
                        • memory/2844-132-0x00007FF691980000-0x00007FF691D0E000-memory.dmp
                          Filesize

                          3.6MB

                          Download
                        • memory/3116-133-0x00007FF691980000-0x00007FF691D0E000-memory.dmp
                          Filesize

                          3.6MB

                          Download