ryuk | 88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335

General

Target

88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
Size

575KB
MD5

6cad2f7dc809b9353a31753a438aef4e
SHA1

459d816bb020f5da8257076a36d0ffd1f1f02d76
SHA256

88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335
SHA512

a67367990452bf21b7c0d0682c598422c78a5ed455a5d5e684d8fabb43366b0e9f9cd579a5f18123f6b1f97945f789904929838d1d893b70f450bfeafb243bb8

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�

Emails

[email protected]

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
788	icacls.exe
1592	icacls.exe

Drops file in Program Files directory 10 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\7-Zip\Lang\af.txt	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\Lang\an.txt	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ar.txt	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\RyukReadMe.html	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\7-zip.chm	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\7z.sfx	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\History.txt	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\descript.ion	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
File opened for modification	C:\Program Files\7-Zip\RyukReadMe.html	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 616 wrote to memory of 788	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	29
PID 616 wrote to memory of 788	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	29
PID 616 wrote to memory of 788	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	29
PID 616 wrote to memory of 788	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	29
PID 616 wrote to memory of 1592	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	30
PID 616 wrote to memory of 1592	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	30
PID 616 wrote to memory of 1592	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	30
PID 616 wrote to memory of 1592	616	88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe	30

C:\Users\Admin\AppData\Local\Temp\88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe
"C:\Users\Admin\AppData\Local\Temp\88b1b4966650de59cef20c340b28739c52dc9ead91d9959a338a8e531ad38335.exe"
1⤵
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:616
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:788
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1592

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

1

T1222

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/616-54-0x0000000074FF1000-0x0000000074FF3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads