Analysis
-
max time kernel
190s -
max time network
187s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
19-02-2022 08:39
Static task
static1
Behavioral task
behavioral1
Sample
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe
Resource
win10v2004-en-20220112
General
-
Target
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe
-
Size
193KB
-
MD5
95fd26f6908ef7a718a4392c5c91e2c7
-
SHA1
31d98aeca3e2d27a2882fc65fba78e31e7aaee0f
-
SHA256
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4
-
SHA512
08679e973186546c87163fd93179f341a4de4f8241d937c42e4524fc1eb63e9f9f0d3381368226716fb927ea59df7975ec69b0b029038ac5eadcfdd1d001ca73
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
PhaPDxf.exepid process 2220 PhaPDxf.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exePhaPDxf.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation PhaPDxf.exe -
Drops file in Windows directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 49 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.035386" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899102776029995" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4200" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.970876" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4364" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exePhaPDxf.exepid process 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe 2220 PhaPDxf.exe 2220 PhaPDxf.exe 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exePhaPDxf.exedescription pid process Token: SeBackupPrivilege 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe Token: SeBackupPrivilege 2220 PhaPDxf.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exePhaPDxf.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 544 wrote to memory of 2220 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe PhaPDxf.exe PID 544 wrote to memory of 2220 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe PhaPDxf.exe PID 544 wrote to memory of 2220 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe PhaPDxf.exe PID 544 wrote to memory of 2504 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 2504 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 2504 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 2220 wrote to memory of 1928 2220 PhaPDxf.exe net.exe PID 2220 wrote to memory of 1928 2220 PhaPDxf.exe net.exe PID 2220 wrote to memory of 1928 2220 PhaPDxf.exe net.exe PID 544 wrote to memory of 2144 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 2144 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 2144 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 832 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 832 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 832 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 2220 wrote to memory of 4056 2220 PhaPDxf.exe net.exe PID 2220 wrote to memory of 4056 2220 PhaPDxf.exe net.exe PID 2220 wrote to memory of 4056 2220 PhaPDxf.exe net.exe PID 544 wrote to memory of 648 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 648 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 544 wrote to memory of 648 544 06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe net.exe PID 832 wrote to memory of 3964 832 net.exe net1.exe PID 832 wrote to memory of 3964 832 net.exe net1.exe PID 832 wrote to memory of 3964 832 net.exe net1.exe PID 2144 wrote to memory of 3880 2144 net.exe net1.exe PID 2144 wrote to memory of 3880 2144 net.exe net1.exe PID 2144 wrote to memory of 3880 2144 net.exe net1.exe PID 2504 wrote to memory of 4108 2504 net.exe net1.exe PID 2504 wrote to memory of 4108 2504 net.exe net1.exe PID 2504 wrote to memory of 4108 2504 net.exe net1.exe PID 648 wrote to memory of 4116 648 net.exe net1.exe PID 648 wrote to memory of 4116 648 net.exe net1.exe PID 648 wrote to memory of 4116 648 net.exe net1.exe PID 1928 wrote to memory of 3036 1928 net.exe net1.exe PID 1928 wrote to memory of 3036 1928 net.exe net1.exe PID 1928 wrote to memory of 3036 1928 net.exe net1.exe PID 4056 wrote to memory of 4100 4056 net.exe net1.exe PID 4056 wrote to memory of 4100 4056 net.exe net1.exe PID 4056 wrote to memory of 4100 4056 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe"C:\Users\Admin\AppData\Local\Temp\06a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\PhaPDxf.exe"C:\Users\Admin\AppData\Local\Temp\PhaPDxf.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2MD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\PhaPDxf.exeMD5
95fd26f6908ef7a718a4392c5c91e2c7
SHA131d98aeca3e2d27a2882fc65fba78e31e7aaee0f
SHA25606a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4
SHA51208679e973186546c87163fd93179f341a4de4f8241d937c42e4524fc1eb63e9f9f0d3381368226716fb927ea59df7975ec69b0b029038ac5eadcfdd1d001ca73
-
C:\Users\Admin\AppData\Local\Temp\PhaPDxf.exeMD5
95fd26f6908ef7a718a4392c5c91e2c7
SHA131d98aeca3e2d27a2882fc65fba78e31e7aaee0f
SHA25606a7b97d2800561df9435bf60de8e261ac8f9079b588aa1d83347e52f7a7c5f4
SHA51208679e973186546c87163fd93179f341a4de4f8241d937c42e4524fc1eb63e9f9f0d3381368226716fb927ea59df7975ec69b0b029038ac5eadcfdd1d001ca73
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
be46918f25b1aa58c459770d493a5b68
SHA1daf0a7ac0dc43646b8da0bdc775e78287820fed5
SHA256c34a56230ecb6d340795fed9f38c34e43b1faed0770bfa852ae5b1129883dec9
SHA51289ae71f3058537ee1c67d4a2b1820584fe5c4698df81e6c4f9e62c638cb96e95c9c2424d1bf62b7f42cac5ebb5af507ca70aca66676ae4765864191914473342