ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Resubmissions

25-12-2024 03:42

241225-d9c21axjdn 10

25-12-2024 03:39

241225-d74ryawqfw 10

25-12-2024 03:37

241225-d6fzgswqbw 10

25-12-2024 03:21

241225-dwt4cswpdj 10

Analysis

max time kernel
21s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
25-12-2024 03:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Size

143KB
MD5

b77cc8a1ede23a80a4a4c9d0a8b40735
SHA1

254c97abab837687c779b57c7ef1bec4c1e2351a
SHA256

4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581
SHA512

f94546161808210ada027d03465f88336de4f2d24581801566f7ff17a9641b389c43946a98275ed637759a0205b8d09f9028d26bb75ab44e3f7038c5b4667ffd
SSDEEP

3072:dgKsEF7Wf33SdvlRmhYHP+CPt1OOxkgQe:WBwK3SBDmhYfFQe

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

F:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each host in the network have been encrypted with a strong algorithm. Backups were either encrypted or deleted or backup disks were formatted. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. We exclusively have decryption software for your situation No decryption software is available in the public. DO NOT RESET OR SHUTDOWN - files may be damaged. DO NOT RENAME OR MOVE the encrypted and readme files. DO NOT DELETE readme files. This may lead to the impossibility of recovery of the certain files. To get info (decrypt your files) contact us at [email protected] or [email protected] BTC wallet: 14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk Ryuk No system is safe

Emails

[email protected]

Wallets

14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Ryuk family
ryuk

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\Control Panel\International\Geo\Nation	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4050598569-1597076380-177084960-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"	reg.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_OEM_Perp-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ThirdPartyNotices.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fi-FI\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Garamond-TrebuchetMs.xml	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_Grace-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\catalog.json	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\THANKS.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\1494870C-9912-C184-4CC9-B401-A53F4D8DE290.pdf	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdXC2RVL_MAKC2R-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL048.XML	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\7-Zip\Lang\eo.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\System\ado\fr-FR\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\jdk\bcel.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\PREVIEW.GIF	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\codec\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\legal\jdk\thaidict.md	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\security\trusted.libraries	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SATIN\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OutlookVL_MAK-ul-phn.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.scale-140.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.scale-180.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_KMS_Client_AE-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\wordmui.msi.16.en-us.tree.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\CASCADE.ELM	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Internet Explorer\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_OEM_Perp3-ul-phn.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\en\DatabaseCompare_f_col.hxk	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\7-Zip\Lang\kab.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\fre\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusinessVL_MAK-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Internet Explorer\en-US\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusiness2019R_Retail-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_OEM_Perp-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription5-ul-oob.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessDemoR_BypassTrial365-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\cardview-addtotable.png	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Crashpad\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\legal\javafx\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdO365R_SubTrial-pl.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\custom.lua	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription4-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\BOOKOS.TTF	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\msjet.xsl	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ar-SA\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\Office16\SLERROR.XML	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Ion Boardroom.thmx	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ppd.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\ODBC\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Java\jre-1.8\lib\amd64\jvm.cfg	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL097.XML	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\REFSPCL.TTF	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\PRISTINA.TTF	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\dotnet\host\fxr\7.0.16\RyukReadMe.txt	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019XC2RVL_KMS_ClientC2R-ul.xrm-ms	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\excel.x-none.msi.16.x-none.tree.dat	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2576	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 3120 wrote to memory of 2576	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 3120 wrote to memory of 2576	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	84
PID 3120 wrote to memory of 2588	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	44
PID 2576 wrote to memory of 452	2576	cmd.exe	86
PID 2576 wrote to memory of 452	2576	cmd.exe	86
PID 2576 wrote to memory of 452	2576	cmd.exe	86
PID 3120 wrote to memory of 2668	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	45
PID 3120 wrote to memory of 2804	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	47
PID 3120 wrote to memory of 3748	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	57
PID 3120 wrote to memory of 3928	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	58
PID 3120 wrote to memory of 4032	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	59
PID 3120 wrote to memory of 3004	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	60
PID 3120 wrote to memory of 3176	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	61
PID 3120 wrote to memory of 4212	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	62
PID 3120 wrote to memory of 764	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	74
PID 3120 wrote to memory of 1744	3120	4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe	76

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
PID:2588

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc
1⤵
PID:2668

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2804

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc
1⤵
PID:3748

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
PID:3928

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
PID:4032

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3004

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3176

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:4212

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\InputApp\TextInputHost.exe" -ServerName:InputApp.AppX9jnwykgrccxc8by3hsrsh07r423xzvav.mca
1⤵
PID:764

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:1744

C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
"C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\ClickToRun\MachineData\Catalog\Packages\{9AC08E99-230B-47E8-9721-4577B7F124EA}\{1A8308C7-90D1-4200-B16E-646F163A08E8}\Manifest.xml

Filesize
3.2MB

MD5
f2de2e7f32da563b7fdfa9728c41a501

SHA1
2884d24bd7ff40e12342a96f4f6da33a33c6031b

SHA256
b495c4a35f6ceb4d6a44d64d4fcb79f5070e7b5b24ed1474bdbad4974efcbf66

SHA512
b1cc4fd3dda7f53e722b78e8af0a981eea38b301e415b3d818a2178d757c93944e34da305a039fdfe304e253bdfa816e5209a9e8f4a217223ffb7809df300811

Download Submit
F:\RyukReadMe.txt

Filesize
804B

MD5
cd99cba6153cbc0b14b7a849e4d0180f

SHA1
375961866404a705916cbc6cd4915de7d9778923

SHA256
74c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2

SHA512
0c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda

Download Submit

Resubmissions

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads