Overview

overview

10

Static

static

683c3cdeda...db.exe

windows7_x64

10

683c3cdeda...db.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    4294211s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-20220223-en
  • submitted
    06-03-2022 03:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe

  • Size

    190KB

  • MD5

    65865d94596a90b7e6204deb1de53c3d

  • SHA1

    282e3776f86d3b0b2916ed6047ad272fe2f0cf6e

  • SHA256

    683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb

  • SHA512

    3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5

Score
10/10
ryukransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note
[email protected] balance of shadow universe Ryuk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Drops file in Drivers directory 14 IoCs
  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 4 IoCs

    Ransomware generally changes the extension on encrypted files.

    ransomware
  • Drops startup file 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 2 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 64 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
    "C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe"
    1⤵
    • Drops file in Drivers directory
    • Modifies extensions of user files
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1568
    • C:\Users\Admin\AppData\Local\Temp\AoWpqrX.exe
      "C:\Users\Admin\AppData\Local\Temp\AoWpqrX.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:960
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "samss" /y
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:9520
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "samss" /y
          4⤵
            PID:9580
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "samss" /y
          3⤵
            PID:113344
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              4⤵
                PID:113368
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:576
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "audioendpointbuilder" /y
              3⤵
                PID:768
            • C:\Windows\SysWOW64\net.exe
              "C:\Windows\System32\net.exe" stop "samss" /y
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:632
              • C:\Windows\SysWOW64\net1.exe
                C:\Windows\system32\net1 stop "samss" /y
                3⤵
                  PID:304
              • C:\Windows\SysWOW64\net.exe
                "C:\Windows\System32\net.exe" stop "samss" /y
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:1000
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop "samss" /y
                  3⤵
                    PID:988
                • C:\Windows\SysWOW64\net.exe
                  "C:\Windows\System32\net.exe" stop "samss" /y
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:56624
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop "samss" /y
                    3⤵
                      PID:57080
                  • C:\Windows\SysWOW64\net.exe
                    "C:\Windows\System32\net.exe" stop "samss" /y
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:60316
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop "samss" /y
                      3⤵
                        PID:60348
                    • C:\Windows\SysWOW64\net.exe
                      "C:\Windows\System32\net.exe" stop "samss" /y
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:113268
                      • C:\Windows\SysWOW64\net1.exe
                        C:\Windows\system32\net1 stop "samss" /y
                        3⤵
                          PID:113292
                      • C:\Windows\SysWOW64\net.exe
                        "C:\Windows\System32\net.exe" stop "samss" /y
                        2⤵
                          PID:113304
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop "samss" /y
                            3⤵
                              PID:113328

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/960-61-0x000000000E270000-0x000000000ED2A000-memory.dmp

                          Filesize

                          10.7MB

                          Download

                        • memory/1568-54-0x0000000076771000-0x0000000076773000-memory.dmp

                          Filesize

                          8KB

                          Download