Analysis
-
max time kernel
172s -
max time network
181s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-02-2022 08:24
Static task
static1
Behavioral task
behavioral1
Sample
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe
Resource
win10v2004-en-20220112
General
-
Target
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe
-
Size
170KB
-
MD5
0af3265285656fe17d144bb1080e4dc2
-
SHA1
e2d30dde5224a79963037e6f654b1e77f1ed5f4c
-
SHA256
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5
-
SHA512
46cf7d96769a092c702b8573c5a5d2770ac7577dcada868bb204727d0dbb42dd0eb0fc895e985b3a2e87e09984926331cd856728ea18297ee0d92d3815192932
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Suspicious use of NtCreateProcessExOtherParentProcess 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3016 created 2620 3016 WerFault.exe DllHost.exe PID 3988 created 3752 3988 WerFault.exe BackgroundTransferHost.exe PID 1020 created 2728 1020 WerFault.exe StartMenuExperienceHost.exe PID 1968 created 1444 1968 WerFault.exe backgroundTaskHost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
sihost.exedescription ioc process File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\content-types.properties sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\el.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man sihost.exe File opened for modification C:\Program Files\Common Files\System\ado\adovbs.inc sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\resources.jar sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrcommonlm.dat sihost.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\access-bridge-64.jar sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipskor.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\de-DE\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\snmp.acl.template sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\localedata.jar sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hr-HR\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\MSInfo\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VC\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\sqloledb.rll.mui sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\calendars.properties sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\ext\zipfs.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\javafx.properties sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\th-TH\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_de_DE.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbynet.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansRegular.ttf sihost.exe File opened for modification C:\Program Files\7-Zip\7-zip.chm sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_heb.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\es-ES\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\it-IT\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\jni_md.h sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\msadc\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\sqloledb.rll sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaTypewriterRegular.ttf sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\SharedPerformance.man sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml sihost.exe File opened for modification C:\Program Files\CopyReset.search-ms sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar sihost.exe File opened for modification C:\Program Files\7-Zip\readme.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\classes.jsa sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management-agent.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\PYCC.pf sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Stationery\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\fr-FR\RyukReadMe.txt sihost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 5 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 4208 2620 WerFault.exe DllHost.exe 4756 3752 WerFault.exe BackgroundTransferHost.exe 4768 2620 WerFault.exe DllHost.exe 4752 1444 WerFault.exe backgroundTaskHost.exe 4800 2728 WerFault.exe StartMenuExperienceHost.exe -
Checks processor information in registry 2 TTPs 5 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exeWerFault.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies data under HKEY_USERS 19 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe -
Modifies registry class 2 IoCs
Processes:
RuntimeBroker.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exeWerFault.exeWerFault.exeWerFault.exepid process 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe 4756 WerFault.exe 4756 WerFault.exe 4800 WerFault.exe 4800 WerFault.exe 4208 WerFault.exe 4208 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exedescription pid process Token: SeDebugPrivilege 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
RuntimeBroker.exepid process 2888 RuntimeBroker.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.execmd.exeDllHost.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 2028 wrote to memory of 1980 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe cmd.exe PID 2028 wrote to memory of 1980 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe cmd.exe PID 2028 wrote to memory of 2096 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe sihost.exe PID 1980 wrote to memory of 3324 1980 cmd.exe reg.exe PID 1980 wrote to memory of 3324 1980 cmd.exe reg.exe PID 2028 wrote to memory of 2112 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe svchost.exe PID 2028 wrote to memory of 2156 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe taskhostw.exe PID 2028 wrote to memory of 2416 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe svchost.exe PID 2028 wrote to memory of 2620 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe DllHost.exe PID 2028 wrote to memory of 2728 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe StartMenuExperienceHost.exe PID 2028 wrote to memory of 2888 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe RuntimeBroker.exe PID 2028 wrote to memory of 3032 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe SearchApp.exe PID 2028 wrote to memory of 3108 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe RuntimeBroker.exe PID 2028 wrote to memory of 3460 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe RuntimeBroker.exe PID 2028 wrote to memory of 2880 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe RuntimeBroker.exe PID 2028 wrote to memory of 3292 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe backgroundTaskHost.exe PID 2028 wrote to memory of 1444 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe backgroundTaskHost.exe PID 2028 wrote to memory of 3752 2028 0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe BackgroundTransferHost.exe PID 2620 wrote to memory of 4208 2620 DllHost.exe WerFault.exe PID 2620 wrote to memory of 4208 2620 DllHost.exe WerFault.exe PID 1968 wrote to memory of 1444 1968 WerFault.exe backgroundTaskHost.exe PID 1968 wrote to memory of 1444 1968 WerFault.exe backgroundTaskHost.exe PID 3016 wrote to memory of 2620 3016 WerFault.exe DllHost.exe PID 3016 wrote to memory of 2620 3016 WerFault.exe DllHost.exe PID 1020 wrote to memory of 2728 1020 WerFault.exe StartMenuExperienceHost.exe PID 1020 wrote to memory of 2728 1020 WerFault.exe StartMenuExperienceHost.exe PID 3988 wrote to memory of 3752 3988 WerFault.exe BackgroundTransferHost.exe PID 3988 wrote to memory of 3752 3988 WerFault.exe BackgroundTransferHost.exe
Processes
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1444 -s 19202⤵
- Program crash
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of UnmapMainImage
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2728 -s 27802⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2620 -s 10162⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2620 -s 10162⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Drops file in Program Files directory
-
C:\Users\Admin\AppData\Local\Temp\0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe"C:\Users\Admin\AppData\Local\Temp\0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0bbcd5a1b2752b281cb4acefcf62343d6a9a923ac114da6e68affd01da000ac5.exe" /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3752 -s 6642⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 420 -p 2620 -ip 26201⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 476 -p 1444 -ip 14441⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 496 -p 3752 -ip 37521⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 528 -p 2728 -ip 27281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Packages\microsoft.windows.contentdeliverymanager_cw5n1h2txyewy\AC\Microsoft\Crypto\RSA\S-1-5-21-790714498-1549421491-1643397139-1000\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2_4e5a6fffd34f5a98a3ffc9d0e34ac87bMD5
469aa816010c9c8639a9176f625189af
SHA12f1050adf64f33298ff0ce423eb86d4728441b21
SHA2567955cb2de90dd9efc6df9fdbf5f5d10c114f4135a9a6b52db1003be749e32f7a
SHA512c331a2a21695186c1ebd2c9facdc5fa856bedc757a50936b72577e76147373747d26bacfce0e165f089e182cc227ada737a0b42e51d9bdec16fb5f8ca795b091
-
memory/2096-130-0x00007FF706DD0000-0x00007FF70715E000-memory.dmpFilesize
3.6MB
-
memory/2156-131-0x00007FF706DD0000-0x00007FF70715E000-memory.dmpFilesize
3.6MB