{"id":17918,"date":"2020-03-17T20:34:00","date_gmt":"2020-03-18T04:34:00","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2020\/03\/17\/news-11651\/"},"modified":"2020-03-17T20:34:00","modified_gmt":"2020-03-18T04:34:00","slug":"news-11651","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2020\/03\/17\/news-11651\/","title":{"rendered":"Ryuk Revisited – Analysis of Recent Ryuk Attack"},"content":{"rendered":"
\n
\n
<\/div>\n<\/p><\/div>\n
\n

FortiGuard Labs<\/a>\u00a0Threat Analysis Report<\/b><\/p>\n

Introduction<\/h2>\n

Affected Platforms:\u00a0\u00a0\u00a0\u00a0Windows
Impacted Users:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0Any organization
Threat Severity:\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0High<\/p>\n

FortiGuard Labs, leveraging the FortiEDR<\/a> endpoint protection platform\u00a0and the FortiResponder managed detection and response service, recently detected and blocked a new variant of Ryuk ransomware. Ryuk ransomware has been targeting large organizations, and is thought to be tailored by each operator to the unique configurations and network designs of the victim organization.\u00a0<\/p>\n

Ryuk is a well-known ransomware variant, and different versions have been reviewed in the past. However, due to its targeted and ever-evolving nature, it is interesting to see what the latest variants hold in store.\u00a0<\/p>\n

In this blog post, we will\u00a0analyze the tactics, techniques, and procedures (TTPs) used by this recently discovered Ryuk variant, review similarities to past variants, and highlight the methods it uses to maximize the damage it can cause to the networks of targeted organizations. Reviewing these TTPs will allow you to test the current security controls within your network to ensure you are able to detect, and ultimately protect against them.<\/p>\n

We have also provided a mapping of the TTPs to the Mitre ATT&CK knowledgebase.\u00a0\u00a0<\/p>\n

Technical Analysis<\/h2>\n

Ryuk Ransomware Execution Steps<\/h3>\n

The sample starts by unpacking its actual payload in-memory. Once the unpacking process is done, the sample creates a copy of itself that it names with a 7-letter random name, and then places it in the same directory from which it was executed. It then invokes the new executable using \u201c8 LAN\u201d as the command line argument.\u00a0<\/p>\n

The initial execution of the sample focuses on encrypting files on the local machine and mapped drives, while the second invocation focuses on the encryption of network drives. This second invocation also attempts to wake machines on the network. Both invocations carry out the same steps as part of the attack, except that the original invocation also injects itself into multiple legitimate processes to run the encryption process in order to increase the chances of a successful attack.\u00a0<\/p>\n

Note that all executions, including injected payloads, attempt to encrypt network drives. More on this later.\u00a0<\/p>\n

Here is a high-level breakdown of the steps taken by this Ryuk sample:<\/p>\n