Potential Ryuk Ransomware Activity

 1title: Potential Ryuk Ransomware Activity
 2id: c37510b8-2107-4b78-aa32-72f251e7a844
 3related:
 4    - id: 58bf96d9-ff5f-44bd-8dcc-1c4f79bf3a27
 5      type: similar
 6    - id: 0acaad27-9f02-4136-a243-c357202edd74
 7      type: obsolete
 8status: stable
 9description: Detects Ryuk ransomware activity
10references:
11    - https://app.any.run/tasks/d860402c-3ff4-4c1f-b367-0237da714ed1/
12    - https://research.checkpoint.com/ryuk-ransomware-targeted-campaign-break/
13author: Florian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)
14date: 2019-12-16
15modified: 2023-02-03
16tags:
17    - attack.privilege-escalation
18    - attack.persistence
19    - attack.t1547.001
20    - detection.emerging-threats
21logsource:
22    category: process_creation
23    product: windows
24detection:
25    selection_reg:
26        CommandLine|contains|all:
27            - 'Microsoft\Windows\CurrentVersion\Run'
28            - 'C:\users\Public\'
29    selection_del:
30        CommandLine|contains|all:
31            - 'del /s /f /q c:\'
32            - '\*.bac'
33            - '\*.bak'
34            - '\*.bkf'
35    selection_net:
36        Image|endswith:
37            - '\net.exe'
38            - '\net1.exe'
39        CommandLine|contains|all:
40            - ' stop '
41            - ' /y'
42        CommandLine|contains:
43            - 'samss'
44            - 'audioendpointbuilder'
45            - 'unistoresvc_'
46            - 'AcrSch2Svc'
47    condition: 1 of selection_*
48fields:
49    - CommandLine
50    - ParentCommandLine
51falsepositives:
52    - Unlikely
53level: high

References

• Analysis 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2 (MD5: 5AC0F050F93F86E69026FAEA1FBB4450) Malicious activity - Interactive analysis ANY.RUN

  

  Interactive malware hunting service. Live testing of most type of threats in any environments. No installation and no waiting necessary.

  
  Read More

• A Targeted Campaign Break-Down - Ryuk Ransomware - Check Point Research

  

  Ryuk, a targeted and well-planned Ransomware, has attacked various organizations worldwide. The campaign has targeted several enterprises, while encrypting hundreds of PC, storage and data centers in each infected company.

  
  Read More

Related rules

• Forest Blizzard APT - Custom Protocol Handler Creation
• Forest Blizzard APT - Custom Protocol Handler DLL Registry Set
• Kapeka Backdoor Autorun Persistence
• Leviathan Registry Key Activity
• Potential KamiKakaBot Activity - Winlogon Shell Persistence