Analysis
-
max time kernel
175s -
max time network
141s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
19-02-2022 08:17
Static task
static1
Behavioral task
behavioral1
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win10v2004-en-20220113
General
-
Target
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
-
Size
219KB
-
MD5
c4d162f04eb0464adc841390f42431ed
-
SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045
-
SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
-
SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
FOABCWP.exepid process 1392 FOABCWP.exe -
Loads dropped DLL 2 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exepid process 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exepid process 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 1392 FOABCWP.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exedescription pid process Token: SeBackupPrivilege 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe Token: SeBackupPrivilege 1392 FOABCWP.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeFOABCWP.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe FOABCWP.exe PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe FOABCWP.exe PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe FOABCWP.exe PID 788 wrote to memory of 1392 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe FOABCWP.exe PID 1392 wrote to memory of 2072 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2072 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2072 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2072 1392 FOABCWP.exe net.exe PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2080 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2144 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1392 wrote to memory of 2184 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2184 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2184 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 2184 1392 FOABCWP.exe net.exe PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2196 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 2264 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 2072 wrote to memory of 2388 2072 net.exe net1.exe PID 2072 wrote to memory of 2388 2072 net.exe net1.exe PID 2072 wrote to memory of 2388 2072 net.exe net1.exe PID 2072 wrote to memory of 2388 2072 net.exe net1.exe PID 2264 wrote to memory of 2404 2264 net.exe net1.exe PID 2264 wrote to memory of 2404 2264 net.exe net1.exe PID 2264 wrote to memory of 2404 2264 net.exe net1.exe PID 2264 wrote to memory of 2404 2264 net.exe net1.exe PID 2184 wrote to memory of 2396 2184 net.exe net1.exe PID 2184 wrote to memory of 2396 2184 net.exe net1.exe PID 2184 wrote to memory of 2396 2184 net.exe net1.exe PID 2184 wrote to memory of 2396 2184 net.exe net1.exe PID 2080 wrote to memory of 2380 2080 net.exe net1.exe PID 2080 wrote to memory of 2380 2080 net.exe net1.exe PID 2080 wrote to memory of 2380 2080 net.exe net1.exe PID 2080 wrote to memory of 2380 2080 net.exe net1.exe PID 2196 wrote to memory of 2372 2196 net.exe net1.exe PID 2196 wrote to memory of 2372 2196 net.exe net1.exe PID 2196 wrote to memory of 2372 2196 net.exe net1.exe PID 2196 wrote to memory of 2372 2196 net.exe net1.exe PID 2144 wrote to memory of 2412 2144 net.exe net1.exe PID 2144 wrote to memory of 2412 2144 net.exe net1.exe PID 2144 wrote to memory of 2412 2144 net.exe net1.exe PID 2144 wrote to memory of 2412 2144 net.exe net1.exe PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 788 wrote to memory of 36800 788 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1392 wrote to memory of 36808 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 36808 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 36808 1392 FOABCWP.exe net.exe PID 1392 wrote to memory of 36808 1392 FOABCWP.exe net.exe PID 36800 wrote to memory of 36848 36800 net.exe net1.exe PID 36800 wrote to memory of 36848 36800 net.exe net1.exe PID 36800 wrote to memory of 36848 36800 net.exe net1.exe PID 36800 wrote to memory of 36848 36800 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe"C:\Users\Admin\AppData\Local\Temp\FOABCWP.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462aMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\FOABCWP.exeMD5
c4d162f04eb0464adc841390f42431ed
SHA1a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA2560dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA51207fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
5c1543434c0c7e2b00f6709fcf8241fd
SHA15791c19f4c38eaaf573192c6c39f8a6cc2c43ffe
SHA2564b59af349b6a429cb5599090fc74cd00dc435ce39f0dfcd3cdbefb116fcace23
SHA512034f366ab29e06adebbff1db76093b14fdb174aba916f846472d8b9de3a711afbf208863d20d680f8282a3e31d7c494375e4eb5f14f50b1742ea0275af63dc5b
-
\Users\Admin\AppData\Local\Temp\FOABCWP.exeMD5
c4d162f04eb0464adc841390f42431ed
SHA1a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA2560dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA51207fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
-
\Users\Admin\AppData\Local\Temp\FOABCWP.exeMD5
c4d162f04eb0464adc841390f42431ed
SHA1a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA2560dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA51207fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
-
memory/788-55-0x0000000076B81000-0x0000000076B83000-memory.dmpFilesize
8KB