Overview

overview

10

Static

static

161925cd53...77.exe

windows7_x64

10

161925cd53...77.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    131s
  • max time network
    66s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-02-2022 09:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777.exe

  • Size

    202KB

  • MD5

    a0b20675907355281f517795ee1ec3dd

  • SHA1

    f5c7ed589e5170191dbd4ea998a14d229bbff51c

  • SHA256

    161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777

  • SHA512

    f85ae1a5332720df6992b327634311cfcf4c60cec392e0ba52f20add9018514670ed1010f08aba61c0aa1abd4009ae218c27fb1248952617a4ec6295836658a4

Score
10/10
ryukpersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] balance of shadow universe Ryuk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1256
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Windows\system32\taskhost.exe" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Windows\system32\reg.exe
        REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Windows\system32\taskhost.exe" /f
        3⤵
        • Adds Run key to start application
        PID:304
    • C:\Windows\System32\net.exe
      "C:\Windows\System32\net.exe" stop "samss" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1564
      • C:\Windows\system32\net1.exe
        C:\Windows\system32\net1 stop "samss" /y
        3⤵
          PID:1968
    • C:\Windows\system32\Dwm.exe
      "C:\Windows\system32\Dwm.exe"
      1⤵
        PID:1360
      • C:\Users\Admin\AppData\Local\Temp\161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777.exe
        "C:\Users\Admin\AppData\Local\Temp\161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777.exe"
        1⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1904
        • C:\Users\Admin\AppData\Local\Temp\MNVEwzb.exe
          "C:\Users\Admin\AppData\Local\Temp\MNVEwzb.exe" 8 LAN
          2⤵
          • Executes dropped EXE
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:560
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1496
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              4⤵
                PID:1132
            • C:\Windows\System32\cmd.exe
              "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MNVEwzb.exe" /f
              3⤵
              • Suspicious use of WriteProcessMemory
              PID:3868
              • C:\Windows\system32\reg.exe
                REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\MNVEwzb.exe" /f
                4⤵
                • Adds Run key to start application
                PID:3896
          • C:\Windows\System32\net.exe
            "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:428
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
              3⤵
                PID:836
            • C:\Windows\System32\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:276
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 stop "samss" /y
                3⤵
                  PID:1384
              • C:\Windows\System32\cmd.exe
                "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777.exe" /f
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1836
                • C:\Windows\system32\reg.exe
                  REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\161925cd5323dd58b3dee09c2f89c97c436cfa81c6b740d77d5fce7de0b55777.exe" /f
                  3⤵
                  • Adds Run key to start application
                  PID:1996
              • C:\Windows\System32\net.exe
                "C:\Windows\System32\net.exe" stop "samss" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1008
                • C:\Windows\system32\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:1072

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/1256-60-0x000000013F580000-0x000000013F6F5000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/1256-59-0x000000013F580000-0x000000013F6F5000-memory.dmp

                Filesize

                1.5MB

                Download

              • memory/1904-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

                Filesize

                8KB

                Download