Analysis

  • max time kernel
    601s
  • max time network
    415s
  • platform
    windows7_x64
  • resource
    win7-20220331-en
  • submitted
    05-04-2022 12:09

General

  • Target

    23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe

  • Size

    384KB

  • MD5

    5ac0f050f93f86e69026faea1fbb4450

  • SHA1

    9709774fde9ec740ad6fed8ed79903296ca9d571

  • SHA256

    23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2

  • SHA512

    b554487c4e26a85ec5179cdcc1d25b5bc494e8821a8899fbbf868c3cf41f70cc72db107613b3f6655d3ab70f4db94cce2589066bb354b1ed955098d3911b844d

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at WayneEvenson@protonmail.com or WayneEvenson@tutanota.com BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe
Emails

WayneEvenson@protonmail.com

WayneEvenson@tutanota.com

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Deletes shadow copies 2 TTPs

    Ransomware often targets backup files to inhibit system recovery.

  • Executes dropped EXE 1 IoCs
  • Modifies extensions of user files 1 IoCs

    Ransomware generally changes the extension on encrypted files.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 18 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Interacts with shadow copies 2 TTPs 14 IoCs

    Shadow copies are often targeted by ransomware to inhibit system recovery.

  • Opens file in notepad (likely ransom note) 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • C:\Windows\system32\taskhost.exe
    "taskhost.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1140 -s 232
      2⤵
      • Program crash
      PID:1768
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1200
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 1200 -s 312
      2⤵
      • Program crash
      PID:1236
  • C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
    "C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1076
    • C:\users\Public\smrHY.exe
      "C:\users\Public\smrHY.exe" C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
      2⤵
      • Executes dropped EXE
      • Modifies extensions of user files
      • Deletes itself
      • Drops file in Program Files directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\smrHY.exe" /f
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:964
        • C:\Windows\system32\reg.exe
          REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\smrHY.exe" /f
          4⤵
          • Adds Run key to start application
          PID:852
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:71136
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:71180
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MB
          4⤵
          • Interacts with shadow copies
          PID:71384
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unbounded
          4⤵
          • Interacts with shadow copies
          PID:71416
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MB
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71448
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unbounded
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71480
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MB
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71512
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unbounded
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71544
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MB
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71580
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unbounded
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71612
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MB
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71644
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unbounded
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71676
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MB
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71012
        • C:\Windows\system32\vssadmin.exe
          vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unbounded
          4⤵
          • Enumerates connected drives
          • Interacts with shadow copies
          PID:71048
        • C:\Windows\system32\vssadmin.exe
          vssadmin Delete Shadows /all /quiet
          4⤵
          • Interacts with shadow copies
          PID:1716
  • C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    1⤵
      PID:1776
    • C:\Windows\explorer.exe
      "C:\Windows\explorer.exe"
      1⤵
        PID:15748
      • C:\Windows\system32\AUDIODG.EXE
        C:\Windows\system32\AUDIODG.EXE 0xc4
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:29660
      • C:\Windows\system32\vssvc.exe
        C:\Windows\system32\vssvc.exe
        1⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:71208
      • C:\Windows\system32\NOTEPAD.EXE
        "C:\Windows\system32\NOTEPAD.EXE" C:\RyukReadMe.txt
        1⤵
        • Opens file in notepad (likely ransom note)
        • Suspicious use of FindShellTrayWindow
        PID:71172

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Registry Run Keys / Startup Folder

      1
      T1060

      Defense Evasion

      File Deletion

      2
      T1107

      Modify Registry

      1
      T1112

      Credential Access

      Credentials in Files

      1
      T1081

      Discovery

      Query Registry

      1
      T1012

      Peripheral Device Discovery

      1
      T1120

      System Information Discovery

      2
      T1082

      Collection

      Data from Local System

      1
      T1005

      Impact

      Inhibit System Recovery

      2
      T1490

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\RyukReadMe.txt
        Filesize

        804B

        MD5

        cd99cba6153cbc0b14b7a849e4d0180f

        SHA1

        375961866404a705916cbc6cd4915de7d9778923

        SHA256

        74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

        SHA512

        0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

      • C:\Users\Public\smrHY.exe
        Filesize

        170KB

        MD5

        31bd0f224e7e74eee2847f43aae23974

        SHA1

        92e331e1e8ad30538f38dd7ba31386afafa14a58

        SHA256

        8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

        SHA512

        a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

      • C:\users\Public\window.bat
        Filesize

        1KB

        MD5

        d2aba3e1af80edd77e206cd43cfd3129

        SHA1

        3116da65d097708fad63a3b73d1c39bffa94cb01

        SHA256

        8940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12

        SHA512

        0059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec

      • \??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak
        Filesize

        12KB

        MD5

        c3784f5d42347b9e3e0411ae32267cf1

        SHA1

        e3b1ab39bba4f18c09132a877362b0e6fae82920

        SHA256

        2780e78a4c7ae016704bd088f21fb60decf3bf0115488cabfcaa920c43f225e2

        SHA512

        e46e42fb05ce593a119025bd7e3341a68daf47f38b2e963b1c1ea8e7e3cb0db8ee6ca7628efcb10894682b761d3e3fd8a0583f5be116b4b0dea779822291a35c

      • \Users\Public\smrHY.exe
        Filesize

        170KB

        MD5

        31bd0f224e7e74eee2847f43aae23974

        SHA1

        92e331e1e8ad30538f38dd7ba31386afafa14a58

        SHA256

        8b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d

        SHA512

        a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249

      • memory/852-63-0x0000000000000000-mapping.dmp
      • memory/964-59-0x0000000000000000-mapping.dmp
      • memory/1076-54-0x00000000755F1000-0x00000000755F3000-memory.dmp
        Filesize

        8KB

      • memory/1140-60-0x000000013F1E0000-0x000000013F56E000-memory.dmp
        Filesize

        3.6MB

      • memory/1236-66-0x0000000000000000-mapping.dmp
      • memory/1716-83-0x0000000000000000-mapping.dmp
      • memory/1768-62-0x0000000000000000-mapping.dmp
      • memory/1908-58-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp
        Filesize

        8KB

      • memory/1908-56-0x0000000000000000-mapping.dmp
      • memory/71012-81-0x0000000000000000-mapping.dmp
      • memory/71048-82-0x0000000000000000-mapping.dmp
      • memory/71136-68-0x0000000000000000-mapping.dmp
      • memory/71180-70-0x0000000000000000-mapping.dmp
      • memory/71384-71-0x0000000000000000-mapping.dmp
      • memory/71416-72-0x0000000000000000-mapping.dmp
      • memory/71448-73-0x0000000000000000-mapping.dmp
      • memory/71480-74-0x0000000000000000-mapping.dmp
      • memory/71512-75-0x0000000000000000-mapping.dmp
      • memory/71544-76-0x0000000000000000-mapping.dmp
      • memory/71580-77-0x0000000000000000-mapping.dmp
      • memory/71612-78-0x0000000000000000-mapping.dmp
      • memory/71644-79-0x0000000000000000-mapping.dmp
      • memory/71676-80-0x0000000000000000-mapping.dmp