Analysis
-
max time kernel
7s -
max time network
8s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
11-04-2024 08:53
Static task
static1
Behavioral task
behavioral1
Sample
2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe
Resource
win10v2004-20240226-en
General
-
Target
2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe
-
Size
170KB
-
MD5
b70b4f1a3b72fa2c76814d97b4dae493
-
SHA1
6ea045b469eea3eabfed96263ff4bb97e1a6b2c3
-
SHA256
dc8074b3b2a22876150975c7abf68296f232246cbbcae06d2bddc114d3a77905
-
SHA512
f0906f7de8517cc0ff658ba4395d7085d16026043fa4d48482e18b16bdba4a958740e769bacbc89f4ec2aab2c7fc3e31ab0fe5002cb6ae8e7eac5e40baa751ff
-
SSDEEP
3072:2HeriftL/WSo1vDb53j/8WGUzaqVh4LI8zQpn3:2+rA/WSo1rl3ALrlHQpn3
Malware Config
Signatures
-
Detects command variations typically used by ransomware 2 IoCs
resource yara_rule behavioral2/memory/2548-0-0x00007FF772DC0000-0x00007FF77314E000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware behavioral2/memory/2548-1-0x00007FF772DC0000-0x00007FF77314E000-memory.dmp INDICATOR_SUSPICIOUS_GENRansomware -
Detects executables containing many references to VEEAM. Observed in ransomware 2 IoCs
resource yara_rule behavioral2/memory/2548-0-0x00007FF772DC0000-0x00007FF77314E000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM behavioral2/memory/2548-1-0x00007FF772DC0000-0x00007FF77314E000-memory.dmp INDICATOR_SUSPICOUS_EXE_References_VEEAM -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Control Panel\International\Geo\Nation 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 4548 wrote to memory of 1112 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 87 PID 4548 wrote to memory of 1112 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 87 PID 4548 wrote to memory of 2548 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 43 PID 1112 wrote to memory of 1740 1112 cmd.exe 89 PID 1112 wrote to memory of 1740 1112 cmd.exe 89 PID 4548 wrote to memory of 2564 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 44 PID 4548 wrote to memory of 2660 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 47 PID 4548 wrote to memory of 3664 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 58 PID 4548 wrote to memory of 3856 4548 2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe 59
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵PID:2548
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2564
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2660
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵PID:3664
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3856
-
C:\Users\Admin\AppData\Local\Temp\2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4548 -
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1112 -
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2024-04-11_b70b4f1a3b72fa2c76814d97b4dae493_ryuk.exe" /f3⤵
- Adds Run key to start application
PID:1740
-
-