Analysis

  • max time kernel
    176s
  • max time network
    181s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01-09-2022 23:44

General

  • Target

    9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe

  • Size

    119KB

  • MD5

    c68395e474088d5339972e2bf5a30f3c

  • SHA1

    502e42240969399c09337ecc7b5ca8fc1ba4baf3

  • SHA256

    9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

  • SHA512

    5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

  • SSDEEP

    1536:j/t3fhrg5rw0lQa2+T37us7RidSkPq9IiJ/EXrAyPca7m94nqHBmQSsWZcdH2kB/:lG55XP0Vq9IiKXrxkKNqHBmEHNVKA

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note
contact balance of shadow universe Ryuk $password = 'BVb1qR2'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Modifies file permissions 1 TTPs 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe
    "C:\Users\Admin\AppData\Local\Temp\9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8.exe"
    1⤵
    • Checks computer location settings
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:4888
    • C:\Users\Admin\AppData\Local\Temp\eKOOBlncorep.exe
      "C:\Users\Admin\AppData\Local\Temp\eKOOBlncorep.exe" 9 REP
      2⤵
      • Executes dropped EXE
      PID:2144
    • C:\Users\Admin\AppData\Local\Temp\pxpvXGULvlan.exe
      "C:\Users\Admin\AppData\Local\Temp\pxpvXGULvlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:4644
    • C:\Users\Admin\AppData\Local\Temp\pnCURCWNSlan.exe
      "C:\Users\Admin\AppData\Local\Temp\pnCURCWNSlan.exe" 8 LAN
      2⤵
      • Executes dropped EXE
      PID:11744
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 11744 -s 13532
        3⤵
        • Program crash
        PID:205712
    • C:\Windows\SysWOW64\icacls.exe
      icacls "C:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:36396
    • C:\Windows\SysWOW64\icacls.exe
      icacls "D:\*" /grant Everyone:F /T /C /Q
      2⤵
      • Modifies file permissions
      PID:36408
    • C:\Windows\SysWOW64\net.exe
      "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:74388
      • C:\Windows\SysWOW64\net1.exe
        C:\Windows\system32\net1 stop "audioendpointbuilder" /y
        3⤵
          PID:78252
      • C:\Windows\SysWOW64\net.exe
        "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:74400
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop "audioendpointbuilder" /y
          3⤵
            PID:78276
        • C:\Windows\SysWOW64\net.exe
          "C:\Windows\System32\net.exe" stop "samss" /y
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:74556
          • C:\Windows\SysWOW64\net1.exe
            C:\Windows\system32\net1 stop "samss" /y
            3⤵
              PID:78268
          • C:\Windows\SysWOW64\net.exe
            "C:\Windows\System32\net.exe" stop "samss" /y
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:74548
            • C:\Windows\SysWOW64\net1.exe
              C:\Windows\system32\net1 stop "samss" /y
              3⤵
                PID:78260
          • C:\Windows\SysWOW64\WerFault.exe
            C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 11744 -ip 11744
            1⤵
              PID:196784

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\$Recycle.Bin\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\DumpStack.log.tmp.RYK

              Filesize

              8KB

              MD5

              bdd2373e6fe9c2b28e334ec8ee0c49a6

              SHA1

              ed616bfc377bfd1cc55efd6e6943d75e5e50a043

              SHA256

              5cf1f6517b6373b1d37dfe9fb28cd0385061e007c349eb5f35717ce64baf0ee7

              SHA512

              149d6690406941ec9dde363e14cb6a8808134e13a9e569448a7928587d4d6c738c1461471751c3a803e55787471ee99e71a24348e1aeebf756e5fd6f6d833e33

            • C:\PerfLogs\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\Users\Admin\AppData\Local\Temp\eKOOBlncorep.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\Admin\AppData\Local\Temp\eKOOBlncorep.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\Admin\AppData\Local\Temp\pnCURCWNSlan.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\Admin\AppData\Local\Temp\pnCURCWNSlan.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\Admin\AppData\Local\Temp\pxpvXGULvlan.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\Admin\AppData\Local\Temp\pxpvXGULvlan.exe

              Filesize

              119KB

              MD5

              c68395e474088d5339972e2bf5a30f3c

              SHA1

              502e42240969399c09337ecc7b5ca8fc1ba4baf3

              SHA256

              9eb7abf2228ad28d8b7f571e0495d4a35da40607f04355307077975e271553b8

              SHA512

              5320fe8144071dde940ebd0285e6fcf573d36c28ea51fca3b5aecc49bfe5ffcf25d1afbd294e0d0b565a3a621d5ea189b075d868bbef521f2e1fe6702e8be75a

            • C:\Users\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\odt\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15

            • C:\odt\config.xml.RYK

              Filesize

              978B

              MD5

              1edd6777d04d26fecd25b751796ec078

              SHA1

              6ce0df88f834834f317cbd473d11b113ba9df50a

              SHA256

              9b945b750a87cad966a682e51e6da3d3ade9bfb9556e5a5a3772b581a928ee1c

              SHA512

              c44aa048b645357d36828e363dd1ae0105e9d7b0c30ae23d0c6679c495b090ded40cd9610ee85a9a6ae3393c5b3520d6f3c2f27de950a55a7d1f2bb6d71c130a

            • C:\users\Public\RyukReadMe.html

              Filesize

              1KB

              MD5

              98d3b55cce54a33a6648f5b02a11f65d

              SHA1

              8c0fd3cb0ab6b4bf962199b2187d0984490fa8ef

              SHA256

              807979e800f4efcf68130c5b6c5af3c333c76e8b7198419ab0a2966a84322131

              SHA512

              9e8d9707a15bdd0e6a7ee360359d01220c5fe95ff472bef0c7460c2749eb8a1a480392b426a62709838d1260a25cff8f5da512eedd61fe2485ca61f3df451a15