Overview

overview

10

Static

static

683c3cdeda...db.exe

windows7_x64

10

683c3cdeda...db.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294211s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 03:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

  • Size

    190KB

  • MD5

    65865d94596a90b7e6204deb1de53c3d

  • SHA1

    282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

  • SHA256

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

  • SHA512

    3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> unumschooler1972@protonmail.com <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������
Emails

unumschooler1972@protonmail.com

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
unumschooler1972@protonmail.com balance of shadow universe Ryuk
Emails

unumschooler1972@protonmail.com

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Drops file in Drivers directory 14 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
    "C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\AoWpqrX.exe
      "C:\Users\Admin\AppData\Local\Temp\AoWpqrX.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "samss" /y
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:9520
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "samss" /y
          4⤵
            PID:9580
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "samss" /y
          3⤵
            PID:113344
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              4⤵
                PID:113368
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:576
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
              3⤵
                PID:768
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:632
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "samss" /y
                3⤵
                  PID:304
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" stop "samss" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1000
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:988
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:56624
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "samss" /y
                    3⤵
                      PID:57080
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" stop "samss" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:60316
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "samss" /y
                      3⤵
                        PID:60348
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop "samss" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:113268
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "samss" /y
                        3⤵
                          PID:113292
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" stop "samss" /y
                        2⤵
                          PID:113304
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "samss" /y
                            3⤵
                              PID:113328

                        Network

                        MITRE ATT&CK Matrix ATT&CK v6

                        Initial Access

                        Execution

                        Persistence

                        Privilege Escalation

                        Defense Evasion

                        Credential Access

                        Discovery

                        Query Registry

                        1
                        T1012

                        Peripheral Device Discovery

                        1
                        T1120

                        System Information Discovery

                        2
                        T1082

                        Lateral Movement

                        Collection

                        Exfiltration

                        Command and Control

                        Impact

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_1a933a73-4d03-4b91-8cac-7b66f466e846
                          MD5

                          93a5aadeec082ffc1bca5aa27af70f52

                          SHA1

                          47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

                          SHA256

                          a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

                          SHA512

                          df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\AoWpqrX.exe
                          MD5

                          65865d94596a90b7e6204deb1de53c3d

                          SHA1

                          282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

                          SHA256

                          683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

                          SHA512

                          3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

                          Download Submit
                        • C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
                          MD5

                          3b40f517a25611205b0ba7af8ae225f1

                          SHA1

                          aa7e89f3d1202b37ff89d629ebe10dae8c4e14db

                          SHA256

                          385752904c61abf42b315b172c40b4a50d50cc58c94077cff0815c834e1ac013

                          SHA512

                          8d17239868ef33175214e14fc5ad245c9d5505deaf8747c079e6e05bca1c77e62bbacc5af8519dccae63b8d4e959ed32d3748d62de1aa3f7b256c35524af9f52

                          Download Submit
                        • \Users\Admin\AppData\Local\Temp\AoWpqrX.exe
                          MD5

                          65865d94596a90b7e6204deb1de53c3d

                          SHA1

                          282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

                          SHA256

                          683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

                          SHA512

                          3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

                          Download Submit
                        • \Users\Admin\AppData\Local\Temp\AoWpqrX.exe
                          MD5

                          65865d94596a90b7e6204deb1de53c3d

                          SHA1

                          282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

                          SHA256

                          683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

                          SHA512

                          3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

                          Download Submit
                        • memory/960-61-0x000000000E270000-0x000000000ED2A000-memory.dmp
                          Filesize

                          10.7MB

                          Download
                        • memory/1568-54-0x0000000076771000-0x0000000076773000-memory.dmp
                          Filesize

                          8KB

                          Download