ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Resubmissions

25-12-2024 03:42

241225-d9c21axjdn 10

25-12-2024 03:39

241225-d74ryawqfw 10

25-12-2024 03:37

241225-d6fzgswqbw 10

25-12-2024 03:21

241225-dwt4cswpdj 10

Analysis

max time kernel
19s
max time network
20s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:37

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Size

143KB
MD5

b77cc8a1ede23a80a4a4c9d0a8b40735
SHA1

254c97abab837687c779b57c7ef1bec4c1e2351a
SHA256

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581
SHA512

f94546161808210ada027d03465f88336de4f2d24581801566f7ff17a9641b389c43946a98275ed637759a0205b8d09f9028d26bb75ab44e3f7038c5b4667ffd
SSDEEP

3072:dgKsEF7Wf33SdvlRmhYHP+CPt1OOxkgQe:WBwK3SBDmhYfFQe

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

F:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\et\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\tzdb.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green Yellow.xml	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial4-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Retail2-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\GR8GALRY.GRA	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.scale-80.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\BackupUpdate.cab	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\currency.data	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcDemoR_BypassTrial365-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\deploy\messages_zh_TW.properties	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLV.DOC	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\office.x-none.msi.16.x-none.boot.tree.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqlxmlx.rll.mui	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription2-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_KMS_Client-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientVolumeLicense_eula.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ONENOTE_K_COL.HXK	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PersonaSpy\PersonaSpy.js	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\security\policy\unlimited\US_export_policy.jar	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\fonts\LucidaBrightDemiBold.ttf	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_MAK_AE-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_Subscription-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\msjet.xsl	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\colorimaging.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\Services\verisign.bmp	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_Trial-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTest-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\POWERPNT_F_COL.HXK	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\OneNoteLogo.contrast-black_scale-140.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\QUERIES\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrdeslm.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Trial-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSSP7EN.LEX	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Integration\C2RManifest.PowerPivot.PowerPivot.x-none.msi.16.x-none.xml	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\freebxml.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\icu.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusE5R_SubTrial-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_MAKC2R-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PowerPointInterProviderRanker.bin	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.boot.tree.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\applet\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\legal\jdk\jpeg.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_SubTrial2-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019VL_KMS_Client_AE-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\CancelGlyph.16.GrayF.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ku-ckb.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-phn.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlusR_OEM_Perp3-ul-phn.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherR_Trial-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Resources\1033\msmdsrvi_xl.rll	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookR_Retail-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\PowerPivot Excel Add-in\Cartridges\db2v0801.xsl	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 2920 wrote to memory of 4620	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 2920 wrote to memory of 4620	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 2920 wrote to memory of 4620	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 2920 wrote to memory of 2892	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	50
PID 4620 wrote to memory of 4760	4620	cmd.exe	86
PID 4620 wrote to memory of 4760	4620	cmd.exe	86
PID 4620 wrote to memory of 4760	4620	cmd.exe	86
PID 2920 wrote to memory of 2952	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	51
PID 2920 wrote to memory of 3104	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	53
PID 2920 wrote to memory of 3728	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	57
PID 2920 wrote to memory of 3908	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	58
PID 2920 wrote to memory of 4004	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	59
PID 2920 wrote to memory of 4072	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	60
PID 2920 wrote to memory of 2796	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	61
PID 2920 wrote to memory of 4104	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	62
PID 2920 wrote to memory of 1596	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	75
PID 2920 wrote to memory of 3704	2920	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	76

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2892

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2952

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:3104

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3728

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3908

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4004

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4072

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:2796

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4104

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:1596

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3704

C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
"C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

Filesize
1.2MB

MD5
895ec644570d01d7abb6d731f05d1839

SHA1
8fe2d1d62e4ce75ab70f4edd80895b363e022249

SHA256
c3f1c234832471277d74e57d8103e7f291c62e8bd338b8d88b34dfed869ba6de

SHA512
65aab4ba1365c57eefd27cc5032b8b4e19f0a5c590ed609d3c3fb6801420ea788b15d1be05e9107a3d84ae29116e43e0d2e5c32d28f842e469298645f5c2c6f3

Download Submit
F:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads