Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-08-2022 17:07

General

  • Target

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe

  • Size

    397KB

  • MD5

    5af409fe584bed2f8b847bb9d2eca34f

  • SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

  • SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

  • SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
paustupexmnem1974@protonmail.com balance of shadow universe Ryuk
Emails

paustupexmnem1974@protonmail.com

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Dave packer 1 IoCs

    Detects executable using a packer named 'Dave' by the community, based on a string at the end.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe
    "C:\Users\Admin\AppData\Local\Temp\3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4.exe"
    • Checks computer location settings
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Users\Admin\AppData\Local\Temp\TpctBfxATlan.exe
      "C:\Users\Admin\AppData\Local\Temp\TpctBfxATlan.exe" 8 LAN
      • Executes dropped EXE
      PID:4800
    • C:\Users\Admin\AppData\Local\Temp\GGxojTzIclan.exe
      "C:\Users\Admin\AppData\Local\Temp\GGxojTzIclan.exe" 8 LAN
      • Executes dropped EXE
      PID:2072
    • C:\Users\Admin\AppData\Local\Temp\SBuIUyptZlan.exe
      "C:\Users\Admin\AppData\Local\Temp\SBuIUyptZlan.exe" 8 LAN
      • Executes dropped EXE
      PID:3012
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      • Modifies file permissions
      PID:4924
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      • Modifies file permissions
      PID:2640

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

File Permissions Modification

1
T1222

Discovery

Query Registry

1
T1012

System Information Discovery

2
T1082

Replay Monitor

00:00 00:00

Downloads

  • C:\$Recycle.Bin\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\$Recycle.Bin\S-1-5-21-2295526160-1155304984-640977766-1000\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\DumpStack.log.tmp.RYK
    Filesize

    8KB

    MD5

    3921128d36bacb5a4047192c303b5a64

    SHA1

    bfca912c65322cd03e31b887879489ab6e0e771d

    SHA256

    0d473326b529061c7f0549f36b9c836e0071cd6199e61bbe325aff9828348bfb

    SHA512

    2982b7361059cff56fa7afdfdc7dc5e0e0c3ba98b868f63ae65161af0398096e14a41dcfdc55ae33c5242001ec6bd7781773b77b623f7a2bac59f300e8ee24bf

  • C:\PerfLogs\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\Users\Admin\AppData\Local\Temp\GGxojTzIclan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\GGxojTzIclan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\SBuIUyptZlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\SBuIUyptZlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\TpctBfxATlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\Admin\AppData\Local\Temp\TpctBfxATlan.exe
    Filesize

    397KB

    MD5

    5af409fe584bed2f8b847bb9d2eca34f

    SHA1

    b49a2eed4d369cd608ffdf8d8cfe491d055f1cd3

    SHA256

    3ee706f07d13cb9e617eac2b4442479634ab48f11005568c739c6dcab75052a4

    SHA512

    f822e1a096f1a597b5c55159e725c769e63bf209c789e0e4e33ea6aa7db023aacde206a1151303cefa8b318a7312a3ae675231f8e91cc847d5db2c09c5b970bc

  • C:\Users\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\odt\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • C:\odt\config.xml.RYK
    Filesize

    978B

    MD5

    859bdebb38e4ce887b90ced6cb51287a

    SHA1

    49a91f08cefe6cf0fba6bfcf732da0bd071ca26c

    SHA256

    e35776664470cf60d11ee222abb7a7824141bfb85583e81829af4cc7c647bb35

    SHA512

    6a72f8245211cdd5046ebbc19d0e73c7b18be425457068c3910673856560645a9059f74ece78691cb0c3c2c7f5b9f330180d89aec02651012b49857c8dc3d6b4

  • C:\users\Public\RyukReadMe.html
    Filesize

    620B

    MD5

    5571a633e0ed282e12d066a24cebe1dd

    SHA1

    3814c9465ca1afdae41b7cc1e8a9790e53446490

    SHA256

    bf26056485fce5fefc42591d3144480eb19a689c57ac5e41fa1324d8c39c0e97

    SHA512

    eaa769f68aa25784cc8860cf24a4e2aba2232d6cbc35adf63e553161c254b9b97c89e22b6f37d05d3b96b7f769e05701f466ce4c55ce6e0daa0f84805aeeb97c

  • memory/2072-152-0x0000000000000000-mapping.dmp
  • memory/2072-155-0x00000000006D0000-0x00000000006F6000-memory.dmp
    Filesize

    152KB

  • memory/2640-176-0x0000000000000000-mapping.dmp
  • memory/3012-163-0x0000000000000000-mapping.dmp
  • memory/3012-166-0x00000000022C0000-0x00000000022E6000-memory.dmp
    Filesize

    152KB

  • memory/4800-144-0x00000000022A0000-0x00000000022C6000-memory.dmp
    Filesize

    152KB

  • memory/4800-141-0x0000000000000000-mapping.dmp
  • memory/4880-137-0x0000000035000000-0x000000003502B000-memory.dmp
    Filesize

    172KB

  • memory/4880-132-0x0000000000720000-0x0000000000746000-memory.dmp
    Filesize

    152KB

  • memory/4880-136-0x00000000006F0000-0x0000000000714000-memory.dmp
    Filesize

    144KB

  • memory/4924-175-0x0000000000000000-mapping.dmp