Analysis

  • max time kernel
    150s
  • max time network
    147s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-en-20220112
  • submitted
    06-03-2022 02:26

General

  • Target

    af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe

  • Size

    120KB

  • MD5

    d06b3960bbb5b12b3b5827296d6551db

  • SHA1

    58c0a54b4c6dd1f616631ffd973a54ee77b50c55

  • SHA256

    af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b

  • SHA512

    e40bc6aab4fa50543f649879aa0ecd200a60e305057cf32671067377d0c027b869bcbbf28e02e408d9ec77f6ed058f6a70cf68849eda8cef67281d3717ee75f0

Malware Config

Extracted

Path

C:\$Recycle.Bin\RyukReadMe.html

Family

ryuk

Ransom Note
apmasampbubb1977@protonmail.com balance of shadow universe Ryuk
Emails

apmasampbubb1977@protonmail.com

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe
    "C:\Users\Admin\AppData\Local\Temp\af5169631789347e6884a5402a945d7eac6d07784a79caf858ab59c8e2201e8b.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious use of WriteProcessMemory
    PID:3700
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:804
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:3548

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\$Recycle.Bin\S-1-5-21-790714498-1549421491-1643397139-1000\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\DumpStack.log.tmp.RYK
    MD5

    a5b5cade89ec7c6b698276cd38c08cfe

    SHA1

    69bd539c49a6a90e22beeea239fd5c9deba9671e

    SHA256

    91c0ace9b91acc87c536043fac7f056b10d9116407c4aaf0c52f4ead599d0407

    SHA512

    ea61d01dca6eb4c7c5c5687328286abeaeeedec80162ce592c9031422899f09bb1997cad03409bdea9f4762a8d30b933e540c9897b40ce21ef53950c3810e851

  • C:\PerfLogs\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\Users\Public\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\Users\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\odt\RyukReadMe.html
    MD5

    13db87b5d27c1d62b4a2c9911d0025ce

    SHA1

    cdb34398e63235fd03c4c4eb85bca8bcd1daa3a3

    SHA256

    8f00dc7bd38819a39c6ee168ef037d958d8aa49e16ee4aa96be55f112bb35000

    SHA512

    9d01c40a1a95171a101e457bfc8fa038a94ac1d208516380720e9f8bd9648aacc4372c5961cdec511eedd0fa053c55a936af5607a48576678cd318910146c58d

  • C:\odt\config.xml.RYK
    MD5

    0f2949112168d6675b817d4d21167d35

    SHA1

    a36521d873be31966010347dfb0cfba8d39fd546

    SHA256

    ab4e4b33eb0d655c08334d4530ddd95c265efe11f8eb5187890c0f2d67b5cec0

    SHA512

    38053dcea093be3d7a0c179543b268a36894c0ab567635df9c7117fa521845f475239fe3bf3db81c993608cd807223faf27a05329564a8a8702a265033cde91f