ryuk

General

Target

RNSM00418.7z
Size

72.4MB
Sample

241028-twcr3stcjf
MD5

e76f67ce8f37735cab7ec703c66a7f1a
SHA1

b46226f376c2db14733fad3ee9da0123813dd883
SHA256

a557030cc9f043d4da36db198e6306372a9cac06e4372c7cac548f2150647cc4
SHA512

079e6e27f67b9233e6634522600cffb53c2167f6957bece42f60a38f66383c6c0413aa38e98bce141f4501b77aa15fad696cf7c2e87923a74ded8c89e3ba5e62
SSDEEP

1572864:HYiWrkjLRoyPWyf9CcWR1OVrLy7FTMcLoMNvSQ9AjQQHrP:cg+yNf0c1Vr8gccBhQQT

Score

10^/10

Malware Config

Targets

- Target
  
  RNSM00418.7z
- Size
  
  72.4MB
- MD5
  
  e76f67ce8f37735cab7ec703c66a7f1a
- SHA1
  
  b46226f376c2db14733fad3ee9da0123813dd883
- SHA256
  
  a557030cc9f043d4da36db198e6306372a9cac06e4372c7cac548f2150647cc4
- SHA512
  
  079e6e27f67b9233e6634522600cffb53c2167f6957bece42f60a38f66383c6c0413aa38e98bce141f4501b77aa15fad696cf7c2e87923a74ded8c89e3ba5e62
- SSDEEP
  
  1572864:HYiWrkjLRoyPWyf9CcWR1OVrLy7FTMcLoMNvSQ9AjQQHrP:cg+yNf0c1Vr8gccBhQQT
Score

10^/10

ryuk credential_access discovery evasion exploit persistence ransomware stealer
- Modifies WinLogon for persistence
  persistence
- Ryuk
  Ransomware distributed via existing botnets, often Trickbot or Emotet.
  ransomware ryuk
- Ryuk family
  ryuk
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
  evasion
- Renames multiple (171) files with added filename extension
  This suggests ransomware activity of encrypting all the files on the system.
  ransomware
- Disables RegEdit via registry modification
  evasion
- Disables Task Manager via registry modification
  evasion
- Possible privilege escalation attempt
  exploit
- Checks BIOS information in registry
  BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Credentials from Password Stores: Windows Credential Manager
  Suspicious access to Credentials History.
  credential_access stealer
- Executes dropped EXE
- Identifies Wine through registry keys
  Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
  evasion
- Loads dropped DLL
- Modifies file permissions
  discovery
- Sets desktop wallpaper using registry
  ransomware
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
behavioral1