Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows7_x64
  • resource
    win7-20230831-en
  • resource tags

    arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
  • submitted
    11/10/2023, 13:44

General

  • Target

    2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe

  • Size

    18.3MB

  • MD5

    766570ee2d440ad20d9c66db404aed77

  • SHA1

    edcc78d12e0db840d0bba98f32e55d5bb6705f73

  • SHA256

    7a066da4ee12ee941bf942f798ab84828c09f60e05f948dc97dff85d4eac4deb

  • SHA512

    d1e6d22cfa1c7a6bf9807f2da3d688beae4c2394ef26a13608a5d5046afc9d18253810a35576d924b166f47136e7cd0acdc3957f8e3468a41288cef1e5689264

  • SSDEEP

    98304:9E2RpMMHMMMvMMZMMMlmMMMiMMMYJMMHMMM6MMZMMMqNMMzMMMUMMVMMMYJMMzMJ:9nwngnwnO

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 2 IoCs
  • Drops startup file 3 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops autorun.inf file 1 TTPs 3 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\2023-08-26_766570ee2d440ad20d9c66db404aed77_ryuk_JC.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Drops startup file
    • Loads dropped DLL
    • Enumerates connected drives
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:2184
    • C:\Windows\SysWOW64\HelpMe.exe
      C:\Windows\system32\HelpMe.exe
      2⤵
      • Modifies WinLogon for persistence
      • Drops startup file
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops autorun.inf file
      • Drops file in System32 directory
      PID:2260

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-21-2180306848-1874213455-4093218721-1000\desktop.ini.exe

    Filesize

    18.3MB

    MD5

    90aae091fa5bdfdce5086c18aff6d2fd

    SHA1

    2f6a80ad8d9c03ecf2a27d035af4437daebd99d4

    SHA256

    339b526388063d6c081be1a52d7e5cb53cd37b9f5e8a8cfa642b486101798ee4

    SHA512

    289b2d49bcfe9594403a27393609a4638c87f0cf36973c00d3b674af3f1d0d654731fa08bd1c004247cf5da7bde741093c978d3cba62240505742618c4a6af6b

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    ff7b730672f8bce93a4f345913008fd6

    SHA1

    46ece055875c9548f6959c4d3b662d96be5b6558

    SHA256

    02998aa1ccc7bfd8e638802d8e30a6bf3b49d18d4ff9bb33d9312fb8f9fca816

    SHA512

    3e95fa467c571f8bc66b31fec771254e54696164003066e7dae8b93a382159b0c91d49bba0ed0a989690b6b86469a2cdcad682b7f5018b56480bdf0c2e97d5c7

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    1KB

    MD5

    7a79e25a8fbdaaf7d21a74db049caa50

    SHA1

    8a5842644359cd32beaf00a97b7eaf1436f439e8

    SHA256

    077c16483cc28a0cf2507ab51f6474db7e7d98c4ce3271df507aa806929d19c3

    SHA512

    acab24b8ac7efa7b7b59ee9bb71c7b886153a140d32f911da95ca5a3da4200dda34096e9ac27f3602d05addcf3a2bc182cd8ba5e397aed4784b2162e6a24f0a0

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Soft.lnk

    Filesize

    954B

    MD5

    568585c2c9d63194fff7d71ec8d2a4db

    SHA1

    1b1bed89ae21854e5791e55279f59f7874b9f1b6

    SHA256

    32408eaf10962b6e3ee52c01e9b97890b3e1ea63548b3b8f5b60c28176c7799b

    SHA512

    05ec76911fe21642272b734652ef7a00cfa96af72fb8f666155ddf334a09ea5fe4d69770376a6c83b3ef1022b0dba3be1504eee1e693cf321777d4539107d584

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.3MB

    MD5

    701eeda0ac2b02bb8ee81a7ae0c231ea

    SHA1

    14d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e

    SHA256

    6a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9

    SHA512

    caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.3MB

    MD5

    701eeda0ac2b02bb8ee81a7ae0c231ea

    SHA1

    14d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e

    SHA256

    6a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9

    SHA512

    caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a

  • C:\Windows\SysWOW64\HelpMe.exe

    Filesize

    18.3MB

    MD5

    701eeda0ac2b02bb8ee81a7ae0c231ea

    SHA1

    14d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e

    SHA256

    6a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9

    SHA512

    caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a

  • F:\AUTORUN.INF

    Filesize

    145B

    MD5

    ca13857b2fd3895a39f09d9dde3cca97

    SHA1

    8b78c5b2ec97c372ebdcef92d14b0998f8dd6dd0

    SHA256

    cfe448b4506a95b33b529efa88f1ac704d8bdf98a941c065650ead27609318ae

    SHA512

    55e5b5325968d1e5314527fb2d26012f5aae4a1c38e305417be273400cb1c6d0c22b85bddb501d7a5720a3f53bb5caf6ada8a7894232344c4f6c6ef85d226b47

  • F:\AutoRun.exe

    Filesize

    18.3MB

    MD5

    766570ee2d440ad20d9c66db404aed77

    SHA1

    edcc78d12e0db840d0bba98f32e55d5bb6705f73

    SHA256

    7a066da4ee12ee941bf942f798ab84828c09f60e05f948dc97dff85d4eac4deb

    SHA512

    d1e6d22cfa1c7a6bf9807f2da3d688beae4c2394ef26a13608a5d5046afc9d18253810a35576d924b166f47136e7cd0acdc3957f8e3468a41288cef1e5689264

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    18.3MB

    MD5

    701eeda0ac2b02bb8ee81a7ae0c231ea

    SHA1

    14d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e

    SHA256

    6a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9

    SHA512

    caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a

  • \Windows\SysWOW64\HelpMe.exe

    Filesize

    18.3MB

    MD5

    701eeda0ac2b02bb8ee81a7ae0c231ea

    SHA1

    14d3c19c0a0cd14a1e7d7e60b9d2c0c0e6af312e

    SHA256

    6a60a53a75017ce4c2d544d75a4b6fffb8fde65e6db69af5f9bbb95f44b841c9

    SHA512

    caf030b79284cfc62342045cee082a5ad021ae06be0b6e7a61e430d7f79cc6ac2a9427018d60bebc226a55b27c7c4fd9861ab9b2820afdc7db404a2a2f6dbf6a

  • memory/2184-0-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2184-1-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2184-10-0x0000000000480000-0x00000000004FB000-memory.dmp

    Filesize

    492KB

  • memory/2184-60-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2184-63-0x0000000000220000-0x0000000000221000-memory.dmp

    Filesize

    4KB

  • memory/2184-74-0x0000000000480000-0x00000000004FB000-memory.dmp

    Filesize

    492KB

  • memory/2260-13-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB

  • memory/2260-12-0x00000000001B0000-0x00000000001B1000-memory.dmp

    Filesize

    4KB

  • memory/2260-78-0x0000000000400000-0x000000000047B000-memory.dmp

    Filesize

    492KB