Analysis
-
max time kernel
170s -
max time network
193s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
19-02-2022 08:17
Static task
static1
Behavioral task
behavioral1
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
Resource
win10v2004-en-20220113
General
-
Target
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe
-
Size
219KB
-
MD5
c4d162f04eb0464adc841390f42431ed
-
SHA1
a25bcbafb2b70ab2b214a7fe0446abee02602045
-
SHA256
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
-
SHA512
07fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 12184 created 4412 12184 WerFault.exe BmHRIGz.exe -
Executes dropped EXE 1 IoCs
Processes:
BmHRIGz.exepid process 4412 BmHRIGz.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation BmHRIGz.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 14084 4412 WerFault.exe BmHRIGz.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exepid process 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 4412 BmHRIGz.exe 4412 BmHRIGz.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exeBmHRIGz.exeWerFault.exedescription pid process Token: SeBackupPrivilege 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe Token: SeBackupPrivilege 4412 BmHRIGz.exe Token: SeRestorePrivilege 14084 WerFault.exe Token: SeBackupPrivilege 14084 WerFault.exe -
Suspicious use of WriteProcessMemory 57 IoCs
Processes:
0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exenet.exenet.exenet.exenet.exeBmHRIGz.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1340 wrote to memory of 4412 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe BmHRIGz.exe PID 1340 wrote to memory of 4412 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe BmHRIGz.exe PID 1340 wrote to memory of 4412 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe BmHRIGz.exe PID 1340 wrote to memory of 4792 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 4792 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 4792 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 4792 wrote to memory of 1468 4792 net.exe net1.exe PID 4792 wrote to memory of 1468 4792 net.exe net1.exe PID 4792 wrote to memory of 1468 4792 net.exe net1.exe PID 1340 wrote to memory of 2372 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 2372 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 2372 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 2372 wrote to memory of 1848 2372 net.exe net1.exe PID 2372 wrote to memory of 1848 2372 net.exe net1.exe PID 2372 wrote to memory of 1848 2372 net.exe net1.exe PID 1340 wrote to memory of 4580 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 4580 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 4580 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 4580 wrote to memory of 1896 4580 net.exe net1.exe PID 4580 wrote to memory of 1896 4580 net.exe net1.exe PID 4580 wrote to memory of 1896 4580 net.exe net1.exe PID 1340 wrote to memory of 848 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 848 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 848 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 848 wrote to memory of 4596 848 net.exe net1.exe PID 848 wrote to memory of 4596 848 net.exe net1.exe PID 848 wrote to memory of 4596 848 net.exe net1.exe PID 4412 wrote to memory of 3412 4412 BmHRIGz.exe net.exe PID 4412 wrote to memory of 3412 4412 BmHRIGz.exe net.exe PID 4412 wrote to memory of 3412 4412 BmHRIGz.exe net.exe PID 3412 wrote to memory of 4752 3412 net.exe net1.exe PID 3412 wrote to memory of 4752 3412 net.exe net1.exe PID 3412 wrote to memory of 4752 3412 net.exe net1.exe PID 1340 wrote to memory of 11876 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 11876 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 11876 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 11876 wrote to memory of 11936 11876 net.exe net1.exe PID 11876 wrote to memory of 11936 11876 net.exe net1.exe PID 11876 wrote to memory of 11936 11876 net.exe net1.exe PID 1340 wrote to memory of 3728 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 3728 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 3728 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 3728 wrote to memory of 12024 3728 net.exe net1.exe PID 3728 wrote to memory of 12024 3728 net.exe net1.exe PID 3728 wrote to memory of 12024 3728 net.exe net1.exe PID 1340 wrote to memory of 13240 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 13240 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 13240 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 13252 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 13252 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 1340 wrote to memory of 13252 1340 0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe net.exe PID 13252 wrote to memory of 13512 13252 net.exe net1.exe PID 13252 wrote to memory of 13512 13252 net.exe net1.exe PID 13252 wrote to memory of 13512 13252 net.exe net1.exe PID 13240 wrote to memory of 13532 13240 net.exe net1.exe PID 13240 wrote to memory of 13532 13240 net.exe net1.exe PID 13240 wrote to memory of 13532 13240 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"C:\Users\Admin\AppData\Local\Temp\0dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe"C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4412 -s 90043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4412 -ip 44121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_e269d2c1-0edf-4391-ac7b-818b8e88b04fMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exeMD5
c4d162f04eb0464adc841390f42431ed
SHA1a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA2560dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA51207fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
-
C:\Users\Admin\AppData\Local\Temp\BmHRIGz.exeMD5
c4d162f04eb0464adc841390f42431ed
SHA1a25bcbafb2b70ab2b214a7fe0446abee02602045
SHA2560dbbb09ec558a7e92a9ad24cce946e1737bc944992dbdb377fc7af18008bc9d6
SHA51207fd20fa8f27e2d236333dbec7bf4318000207f321544944d9f4c83a808b475d7904ad411f94cb8c1407c95ea0a49a72c784991ef7b4a158c5554e87e07a91af
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
5c1543434c0c7e2b00f6709fcf8241fd
SHA15791c19f4c38eaaf573192c6c39f8a6cc2c43ffe
SHA2564b59af349b6a429cb5599090fc74cd00dc435ce39f0dfcd3cdbefb116fcace23
SHA512034f366ab29e06adebbff1db76093b14fdb174aba916f846472d8b9de3a711afbf208863d20d680f8282a3e31d7c494375e4eb5f14f50b1742ea0275af63dc5b