Overview

overview

10

Static

static

10

Ryuk .Net ...er.exe

windows7-x64

10

Ryuk .Net ...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    330s
  • max time network
    319s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14-08-2024 03:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Ryuk .Net Ransomware Builder.exe

  • Size

    287KB

  • MD5

    b20d5ada2e81683bda32aa80cd71c025

  • SHA1

    1ab3daa872761d887ef0be9ace528ee323201211

  • SHA256

    0d8b4a07e91e02335f600332644e8f0e504f75ab19899a58b2c85ecb0887c738

  • SHA512

    94da5ae4e43e6b0fdc8d0a83d8a3f2991a47b6e12f6781cc6aecb2d8d97a2d0da6dc456e3618c1a36697862e1a7a50b27a036b3569f33889452fe921c6981d91

  • SSDEEP

    3072:GVgr8/vRx5cCPaEy3YxB+DV0Ugr8/vfx:GSrS/yKrS

Score
10/10
chaospersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\read_it.txt

Ransom Note
All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 5 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ryuk .Net Ransomware Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\Ryuk .Net Ransomware Builder.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB52C.tmp" "c:\Users\Admin\Desktop\CSCB39A415F9C4F44DFA18A801699B89EB1.TMP"
        3⤵
          PID:2804
    • C:\Users\Admin\Desktop\dddd.exe
      "C:\Users\Admin\Desktop\dddd.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:2068
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:816

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RESB52C.tmp
      Filesize

      1KB

      MD5

      c83886992cd850a2b57e802f60d2f3c7

      SHA1

      fc8eddeb1da3a7bb6b2b1276c937553f047a731d

      SHA256

      6819ecfc13493bbed510e5c4ab800614e7f5d93cede4796c5c24e1b3ab18f8f4

      SHA512

      cdabd46cd66bfc76e63797a45b95be6130b01f582985571f1ef237abeb7e73149356e33708a9405f41b2537169415f012c426d951648b0575eeb13163f7887df

      Download Submit

    • C:\Users\Admin\Desktop\dddd.exe
      Filesize

      15KB

      MD5

      2df0d82bbc1627424d2adceae27f1812

      SHA1

      61cc42d4b7b0a30e047d02b63271be4565bcc159

      SHA256

      0721fe0a20c3cd84221c2f1cb412c3349bfb06bf73b86292508a159fa8e4fbd6

      SHA512

      f9cf14f2a3d02a0fcec23ac0a77cccc539250337b030fcce2919c1d7931beb8564f050af2e3f863242747eae4205ab0c0d54ae70d128b9a79ee3e67a8339adc0

      Download Submit

    • C:\Users\Admin\Downloads\read_it.txt
      Filesize

      877B

      MD5

      9814b140eb85668b095096dc0ac32702

      SHA1

      27e792330b4526b0f1ccb1eb212f9a80262353fd

      SHA256

      3d3a137cdf8a12a35f67451a8afead595b6281f3de271673606ee80a47de9eb0

      SHA512

      4caa4a28649dd76b4e845e928eb0893ad1a50cd4aaa6d58d3123303dcf07f42379171740a4d2c77ceb854b54c86f3c430ef6429bd5d10ad2b96fbcfef0a4fb13

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.0.cs
      Filesize

      18KB

      MD5

      586f17e9f5b8200f4fde447e8072dac5

      SHA1

      6a6f9325dbf7b027032f98b13f0897692aab2b2d

      SHA256

      4c85e5a27c2136aa3d32216a6814db744ce86bba526c2fa818d0683f10134971

      SHA512

      020c29eb0e21464fe61b138aa50a7f8371083100a26daa918e32e894a2d1a181118ce750ef73208198af5013f16039c3449c85f2832b0dcb02a25afefdd90601

      Download Submit

    • \??\c:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.cmdline
      Filesize

      330B

      MD5

      07a8a51887d17313ce43136f94838573

      SHA1

      bc68b31aa99d83bd58d267443a4b755bff1fac43

      SHA256

      6be145c50b94a1727181b9a1caa87b8c0b51e48bc87935449e9e9d4d827dab10

      SHA512

      b36a6b0325c2219691995b30e398461c55c113f0969f0722a9ef11fe8e2bd11f6069407cb362ad27be7acb1542010dc6e73441bbb5a02d2b3b9f9b34e5a9bff4

      Download Submit

    • \??\c:\Users\Admin\Desktop\CSCB39A415F9C4F44DFA18A801699B89EB1.TMP
      Filesize

      1KB

      MD5

      e804d3c5b28a522b6479f72d9ea12b49

      SHA1

      0cda5073274182c3a83e3bfbe1f82627d912b2c3

      SHA256

      1af6647e1296e434e7e5f3864c52d76254ab267223dfebea3a8f9caf5189e1a6

      SHA512

      3ca6b6c3a6f80acd31446e62aef3ec2dc37a644037da26e56ffdb586c16ca61e261e2d111c4650484615c13a2febc87da1110a149aec9846d7e61713efac19d0

      Download Submit

    • memory/816-137-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/816-141-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/816-140-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/816-139-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/816-138-0x0000000140000000-0x00000001405E8000-memory.dmp

      Filesize

      5.9MB

      Download

    • memory/844-22-0x0000000000160000-0x000000000016A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/1020-28-0x0000000000830000-0x000000000083A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/2388-4-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2388-1-0x0000000000010000-0x000000000005E000-memory.dmp

      Filesize

      312KB

      Download

    • memory/2388-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

      Filesize

      4KB

      Download

    • memory/2388-135-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-136-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-7-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-5-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

      Filesize

      9.9MB

      Download

    • memory/2388-6-0x000000001ECB0000-0x000000001ECC0000-memory.dmp

      Filesize

      64KB

      Download