Overview

overview

10

Static

static

10

Ryuk .Net ...er.exe

windows7-x64

10

Ryuk .Net ...er.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    330s
  • max time network
    319s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    14/08/2024, 03:00

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    Ryuk .Net Ransomware Builder.exe

  • Size

    287KB

  • MD5

    b20d5ada2e81683bda32aa80cd71c025

  • SHA1

    1ab3daa872761d887ef0be9ace528ee323201211

  • SHA256

    0d8b4a07e91e02335f600332644e8f0e504f75ab19899a58b2c85ecb0887c738

  • SHA512

    94da5ae4e43e6b0fdc8d0a83d8a3f2991a47b6e12f6781cc6aecb2d8d97a2d0da6dc456e3618c1a36697862e1a7a50b27a036b3569f33889452fe921c6981d91

  • SSDEEP

    3072:GVgr8/vRx5cCPaEy3YxB+DV0Ugr8/vfx:GSrS/yKrS

Score
10/10
chaospersistenceransomware

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\read_it.txt

Ransom Note
All of your files have been encrypted Your computer was infected with a ransomware virus. Your files have been encrypted and you won't be able to decrypt them without our help.What can I do to get my files back?You can buy our special decryption software, this software will allow you to recover all of your data and remove the ransomware from your computer.The price for the software is $1,500. Payment can be made in Bitcoin only. How do I pay, where do I get Bitcoin? Purchasing Bitcoin varies from country to country, you are best advised to do a quick google search yourself to find out how to buy Bitcoin. Many of our customers have reported these sites to be fast and reliable: Coinmama - hxxps://www.coinmama.com Bitpanda - hxxps://www.bitpanda.com Payment informationAmount: 0.1473766 BTC Bitcoin Address: bc1qw0ll8p9m8uezhqhyd7z459ajrk722yn8c5j4fg

Signatures

  • Chaos

    Ransomware family first seen in June 2021.

    ransomwarechaos
  • Chaos Ransomware 5 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Drops desktop.ini file(s) 14 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 64 IoCs
  • Opens file in notepad (likely ransom note) 1 IoCs
    ransomware
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Ryuk .Net Ransomware Builder.exe
    "C:\Users\Admin\AppData\Local\Temp\Ryuk .Net Ransomware Builder.exe"
    1⤵
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2388
    • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2660
      • C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESB52C.tmp" "c:\Users\Admin\Desktop\CSCB39A415F9C4F44DFA18A801699B89EB1.TMP"
        3⤵
          PID:2804
    • C:\Users\Admin\Desktop\dddd.exe
      "C:\Users\Admin\Desktop\dddd.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:844
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        2⤵
        • Drops startup file
        • Executes dropped EXE
        • Adds Run key to start application
        • Drops desktop.ini file(s)
        • Suspicious behavior: AddClipboardFormatListener
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1020
        • C:\Windows\system32\NOTEPAD.EXE
          "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\read_it.txt
          3⤵
          • Opens file in notepad (likely ransom note)
          PID:2068
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /4
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:816

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Temp\RESB52C.tmp
            Filesize

            1KB

            MD5

            c83886992cd850a2b57e802f60d2f3c7

            SHA1

            fc8eddeb1da3a7bb6b2b1276c937553f047a731d

            SHA256

            6819ecfc13493bbed510e5c4ab800614e7f5d93cede4796c5c24e1b3ab18f8f4

            SHA512

            cdabd46cd66bfc76e63797a45b95be6130b01f582985571f1ef237abeb7e73149356e33708a9405f41b2537169415f012c426d951648b0575eeb13163f7887df

            Download Submit

          • C:\Users\Admin\Desktop\dddd.exe
            Filesize

            15KB

            MD5

            2df0d82bbc1627424d2adceae27f1812

            SHA1

            61cc42d4b7b0a30e047d02b63271be4565bcc159

            SHA256

            0721fe0a20c3cd84221c2f1cb412c3349bfb06bf73b86292508a159fa8e4fbd6

            SHA512

            f9cf14f2a3d02a0fcec23ac0a77cccc539250337b030fcce2919c1d7931beb8564f050af2e3f863242747eae4205ab0c0d54ae70d128b9a79ee3e67a8339adc0

            Download Submit

          • C:\Users\Admin\Downloads\read_it.txt
            Filesize

            877B

            MD5

            9814b140eb85668b095096dc0ac32702

            SHA1

            27e792330b4526b0f1ccb1eb212f9a80262353fd

            SHA256

            3d3a137cdf8a12a35f67451a8afead595b6281f3de271673606ee80a47de9eb0

            SHA512

            4caa4a28649dd76b4e845e928eb0893ad1a50cd4aaa6d58d3123303dcf07f42379171740a4d2c77ceb854b54c86f3c430ef6429bd5d10ad2b96fbcfef0a4fb13

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.0.cs
            Filesize

            18KB

            MD5

            586f17e9f5b8200f4fde447e8072dac5

            SHA1

            6a6f9325dbf7b027032f98b13f0897692aab2b2d

            SHA256

            4c85e5a27c2136aa3d32216a6814db744ce86bba526c2fa818d0683f10134971

            SHA512

            020c29eb0e21464fe61b138aa50a7f8371083100a26daa918e32e894a2d1a181118ce750ef73208198af5013f16039c3449c85f2832b0dcb02a25afefdd90601

            Download Submit

          • \??\c:\Users\Admin\AppData\Local\Temp\f2p3uor3\f2p3uor3.cmdline
            Filesize

            330B

            MD5

            07a8a51887d17313ce43136f94838573

            SHA1

            bc68b31aa99d83bd58d267443a4b755bff1fac43

            SHA256

            6be145c50b94a1727181b9a1caa87b8c0b51e48bc87935449e9e9d4d827dab10

            SHA512

            b36a6b0325c2219691995b30e398461c55c113f0969f0722a9ef11fe8e2bd11f6069407cb362ad27be7acb1542010dc6e73441bbb5a02d2b3b9f9b34e5a9bff4

            Download Submit

          • \??\c:\Users\Admin\Desktop\CSCB39A415F9C4F44DFA18A801699B89EB1.TMP
            Filesize

            1KB

            MD5

            e804d3c5b28a522b6479f72d9ea12b49

            SHA1

            0cda5073274182c3a83e3bfbe1f82627d912b2c3

            SHA256

            1af6647e1296e434e7e5f3864c52d76254ab267223dfebea3a8f9caf5189e1a6

            SHA512

            3ca6b6c3a6f80acd31446e62aef3ec2dc37a644037da26e56ffdb586c16ca61e261e2d111c4650484615c13a2febc87da1110a149aec9846d7e61713efac19d0

            Download Submit

          • memory/816-137-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/816-141-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/816-140-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/816-139-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/816-138-0x0000000140000000-0x00000001405E8000-memory.dmp

            Filesize

            5.9MB

            Download

          • memory/844-22-0x0000000000160000-0x000000000016A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/1020-28-0x0000000000830000-0x000000000083A000-memory.dmp

            Filesize

            40KB

            Download

          • memory/2388-4-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2388-1-0x0000000000010000-0x000000000005E000-memory.dmp

            Filesize

            312KB

            Download

          • memory/2388-0-0x000007FEF5B73000-0x000007FEF5B74000-memory.dmp

            Filesize

            4KB

            Download

          • memory/2388-135-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-136-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-3-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-7-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-2-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-5-0x000007FEF5B70000-0x000007FEF655C000-memory.dmp

            Filesize

            9.9MB

            Download

          • memory/2388-6-0x000000001ECB0000-0x000000001ECC0000-memory.dmp

            Filesize

            64KB

            Download