Malware Analysis Report

2024-09-23 07:02

Sample ID 240616-n4l3tswejq
Target 2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk
SHA256 ede2d38d5b84b16e3bd0aabd1a94056996d7e03660027bc3f5897787986ecd5c
Tags
azov persistence ransomware spyware stealer wiper
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

ede2d38d5b84b16e3bd0aabd1a94056996d7e03660027bc3f5897787986ecd5c

Threat Level: Known bad

The file 2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk was found to be: Known bad.

Malicious Activity Summary

azov persistence ransomware spyware stealer wiper

Azov

Renames multiple (1962) files with added filename extension

Renames multiple (381) files with added filename extension

Reads user/profile data of web browsers

Enumerates connected drives

Adds Run key to start application

Drops file in Program Files directory

Unsigned PE

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-06-16 11:57

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral2

Detonation Overview

Submitted

2024-06-16 11:57

Reported

2024-06-16 11:59

Platform

win10v2004-20240611-en

Max time kernel

148s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (381) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\es.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Java\Java Update\jaureg.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleApp.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\ru.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\si.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\uk-UA\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\System\de-DE\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\dotnet\swidtag\Microsoft Windows Desktop Runtime - 8.0.2 (x64).swidtag C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\en-GB.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\wmprph.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\System\en-US\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\uk.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\System\Ole DB\es-ES\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_10.1907.2471.0_x64__8wekyb3d8bbwe\ScreenSketch.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\include\jdwpTransport.h C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\jopt-simple.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\System\msadc\it-IT\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\oledbvbs.inc C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\uz.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\Office16\msoev.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\SmartTagInstall.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\santuario.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sq.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Internet Explorer\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\legal\jdk\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\bcel.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\lib\fonts\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SubsystemController.man C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\ink\lv-LV\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\.version C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\ea-sym.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsita.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\cmm\sRGB.pf C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\dom.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Internet Explorer\ieinstal.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\rmiregistry.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\System\ja-JP\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Common Files\Oracle\Java\javapath\javaws.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\7-zip.chm C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\legal\jdk\relaxngom.md C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ru\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Java\jdk-1.8\jre\bin\server\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\pt-BR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Google\Chrome\Application\110.0.5481.104\default_apps\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Windows Media Player\wmpshare.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\FrequentOfficeUpdateSchedule.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\microsoft shared\MSInfo\fr-FR\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre-1.8\bin\klist.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Office\root\vfs\Windows\Installer\{90160000-000F-0000-1000-0000000FF1CE}\sscicons.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ADelRCP.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\110.0.5481.104\Locales\id.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk-1.8\jre\lib\images\cursors\win32_LinkNoDrop32x32.gif C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 g.bing.com udp
US 13.107.21.237:443 g.bing.com tcp
US 8.8.8.8:53 237.21.107.13.in-addr.arpa udp
US 8.8.8.8:53 20.160.190.20.in-addr.arpa udp
NL 23.62.61.97:443 www.bing.com tcp
US 8.8.8.8:53 55.36.223.20.in-addr.arpa udp
US 8.8.8.8:53 97.61.62.23.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 21.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 71.121.18.2.in-addr.arpa udp
US 8.8.8.8:53 104.193.132.51.in-addr.arpa udp

Files

memory/4932-2-0x00007FF76C870000-0x00007FF76C907000-memory.dmp

memory/4932-4-0x0000029AD3B80000-0x0000029AD3B87000-memory.dmp

memory/4932-8-0x0000029AD3BB0000-0x0000029AD3BB4000-memory.dmp

memory/4932-13-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp

memory/4932-5-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp

memory/4932-3-0x0000029AD3BA0000-0x0000029AD3BA5000-memory.dmp

memory/4932-0-0x0000029AD3BB0000-0x0000029AD3BB4000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-16 11:57

Reported

2024-06-16 11:59

Platform

win7-20240611-en

Max time kernel

120s

Max time network

121s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"

Signatures

Azov

ransomware wiper azov

Renames multiple (1962) files with added filename extension

ransomware

Reads user/profile data of web browsers

spyware stealer

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Bandera = "C:\\ProgramData\\rdpclient.exe" C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Enumerates connected drives

Description Indicator Process Target
File opened (read-only) \??\S: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\T: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\W: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Y: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\G: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\H: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\M: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\O: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Z: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\X: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\A: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\I: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\P: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\R: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\K: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\Q: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\U: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\V: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\N: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\B: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\E: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\J: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened (read-only) \??\L: C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\e4_classic_winxp.css C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-cli_ja.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-core_ja.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\specialmainsubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyNotesBackground_PAL.wmv C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_it.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.services_3.4.0.v20140312-2051.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-services.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrenclm.dat C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\WidevineCdm\LICENSE C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.services_1.1.0.v20140328-1925.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-filesystems.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\VideoWall\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_es.properties C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\javafx-mx.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.artifact.repository.nl_zh_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-options-api.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-profiling.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\deploy\messages.properties C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-previous-static.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\DVD Maker\Shared\DvdStyles\Sports\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\id.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\North_Dakota\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\boxed-split.avi C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Chita C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jre7\lib\ext\localedata.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\Locales\lv.pak C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application-views_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Regina C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationRight_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_it.properties C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.publisher.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\ModuleAutoDeps\org-netbeans-modules-options-api.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\zh-CN\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Microsoft Games\Solitaire\Solitaire.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Halifax C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\README.html C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Tanspecks.jpg C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\bin\jps.exe C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Google\Chrome\Application\106.0.5249.119\MEIPreload\manifest.json C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-11 C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\lv.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\3RDPARTY C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Volgograd C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\META-INF\MANIFEST.MF C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.win32.nl_ja_4.4.0.v20140623020002.jar C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-tools.xml C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File created C:\Program Files\Common Files\Microsoft Shared\ink\pl-PL\RESTORE_FILES.txt C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\setEmbeddedCP C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A
File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\server\classes.jsa C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe N/A

Processes

C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-06-16_53e275e2b858405ce407fd21501b98a9_ryuk.exe"

Network

N/A

Files

memory/2740-3-0x00000000000F0000-0x00000000000F5000-memory.dmp

memory/2740-2-0x00000000000D0000-0x00000000000D7000-memory.dmp

memory/2740-4-0x000000013FBD0000-0x000000013FC67000-memory.dmp

memory/2740-0-0x0000000000100000-0x0000000000104000-memory.dmp

memory/2740-6-0x0000000000100000-0x0000000000104000-memory.dmp

memory/2740-10-0x00000000000F0000-0x00000000000F5000-memory.dmp

memory/2740-21-0x00000000000F0000-0x00000000000F5000-memory.dmp

C:\Program Files\7-Zip\Lang\RESTORE_FILES.txt

MD5 78ede93114e65f9160fd03d3357c56e6
SHA1 88d531b101e57655f1d0d26c6b3257aa2468d460
SHA256 c97412fbf88da8f91099a52888dea4c3f222cd95af3e681e3271cbca8b6b7bb5
SHA512 074a4c741273902ccacb6f573b96d8accedb2ee405dbd04350cdbf54d180c1fd577a4e90c2aae26bf72f3782403f4494db6e3501a04cfd9d7d81a6bc14884b9d