94717ff72ab2c2465df984bed7d3c81e0625ae27324f59e0aed6b5f9e428c3ef

General

Target

2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Size

4.9MB
MD5

af5d43475fb5a2cfb98d359d08df7fd1
SHA1

af757310b7d75513842e7b05d9ebe0855c88ee00
SHA256

94717ff72ab2c2465df984bed7d3c81e0625ae27324f59e0aed6b5f9e428c3ef
SHA512

4767b0407fb5cb617f56bcfc35863ae0537e06563bbd213b401c068053326092e4e9d1186f6702827fb547046c7c848f7fa07ddd78f235b6e0ccd25d2bc9df8e
SSDEEP

98304:KAsskRAdKvmGy0cljyi9vzlVkOekp/ekPjqgBE0d:OskRM3U0BV4kYmqQ9

Score

10^/10

evasion

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 6 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Set value (int)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0"	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Deletes itself 1 IoCs

pid	Process
1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Executes dropped EXE 1 IoCs

pid	Process
1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\BAGMRU	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Key deleted	\REGISTRY\USER\S-1-5-21-566096764-1992588923-1249862864-1000_CLASSES\LOCAL SETTINGS\SOFTWARE\MICROSOFT\WINDOWS\SHELL\MUICACHE	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeBackupPrivilege	1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Token: SeSecurityPrivilege	1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Token: SeShutdownPrivilege	1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Token: SeBackupPrivilege	1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Token: SeSecurityPrivilege	1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
Token: SeShutdownPrivilege	1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
1760	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1496 wrote to memory of 1760	1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe	91
PID 1496 wrote to memory of 1760	1496	2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe	91

C:\Users\Admin\AppData\Local\Temp\2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe"
1⤵
- Modifies firewall policy service
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1496
- C:\Users\Admin\AppData\Local\Temp\2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe
  "2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe"
  2⤵
  - Modifies firewall policy service
  - Deletes itself
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Privilege Escalation

Create or Modify System Process

1

T1543

Windows Service

1

T1543.003

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Filesize
2.5MB

MD5
5732f0f1e61a9acade47001c14b5f0aa

SHA1
ee6c27541a14de398ea5786cac1d655b299f6311

SHA256
b390855947c8c19bb3182343e71f23dea349f130efbca232e766163107bf794b

SHA512
d5cb6576482a8be3741573f003d861e36e03fbafcaab9b50b53c77260f53d51f3fab395594480379a470ddc33724ab5a869661a21fdbc0f171e76970e8ee4f1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\2024-03-28_af5d43475fb5a2cfb98d359d08df7fd1_ryuk.exe

Filesize
1.0MB

MD5
0612cc41547a26435fac1191a1fd0e52

SHA1
d3998104678aa4027e53d99553ce5126762d06bc

SHA256
9e4259c6eeb32de47d1c00910eaaf6dbdd38e63fc9301a3c7f5008f8980d4aab

SHA512
6ab895f7c210f65d8100b420a43173e3cd88102a43f25755b3c2d01ea2456c13a8aee794c5738fa2bbdcefe5fd49908e1567018b2d61026896bf7b241d45a2ea

Download Submit
memory/1496-7-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-9-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-4-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-5-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-6-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-8-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-20-0x00007FF7185A0000-0x00007FF718A91000-memory.dmp

Filesize
4.9MB

Download
memory/1496-3-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-10-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-12-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-13-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-16-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-2-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-1-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1496-0-0x000001B77DA40000-0x000001B77DF38000-memory.dmp

Filesize
5.0MB

Download
memory/1760-21-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-19-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-22-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-23-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-24-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-25-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-26-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-27-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-28-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-29-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-18-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-31-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-32-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download
memory/1760-35-0x00007FF783B30000-0x00007FF784020000-memory.dmp

Filesize
4.9MB

Download
memory/1760-37-0x00000258CFC60000-0x00000258D0155000-memory.dmp

Filesize
5.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads