Analysis
-
max time kernel
194s -
max time network
209s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-02-2022 01:38
Static task
static1
Behavioral task
behavioral1
Sample
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe
Resource
win10v2004-en-20220112
General
-
Target
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe
-
Size
188KB
-
MD5
28b6df2007a3b33b43a13ab518f2947d
-
SHA1
7ea40bac1432c34736bd0cce346d8f9b983c627b
-
SHA256
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82
-
SHA512
e851fae2a441a1b0814d4725ea288875cd44229573449eddff2af1db66433d27461edf246a6f9ce01a32025985f008c0b6a0ada134aaaf2020b8f8d2ce683f58
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
VapMbAo.exepid process 1596 VapMbAo.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exeVapMbAo.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation VapMbAo.exe -
Drops file in Windows directory 2 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
MusNotifyIcon.exedescription ioc process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 MusNotifyIcon.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz MusNotifyIcon.exe -
Modifies data under HKEY_USERS 50 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899719546587811" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.391330" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4232" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.121360" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4100" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4224" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exeVapMbAo.exepid process 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe 1596 VapMbAo.exe 1596 VapMbAo.exe 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exeVapMbAo.exeTiWorker.exedescription pid process Token: SeBackupPrivilege 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe Token: SeBackupPrivilege 1596 VapMbAo.exe Token: SeSecurityPrivilege 1008 TiWorker.exe Token: SeRestorePrivilege 1008 TiWorker.exe Token: SeBackupPrivilege 1008 TiWorker.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exeVapMbAo.exedescription pid process target process PID 3284 wrote to memory of 1596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe VapMbAo.exe PID 3284 wrote to memory of 1596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe VapMbAo.exe PID 3284 wrote to memory of 1596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe VapMbAo.exe PID 3284 wrote to memory of 1512 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 1512 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 1512 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 1596 wrote to memory of 400 1596 VapMbAo.exe net.exe PID 1596 wrote to memory of 400 1596 VapMbAo.exe net.exe PID 1596 wrote to memory of 400 1596 VapMbAo.exe net.exe PID 3284 wrote to memory of 752 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 752 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 752 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 4052 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 4052 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 4052 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 1596 wrote to memory of 1220 1596 VapMbAo.exe net.exe PID 1596 wrote to memory of 1220 1596 VapMbAo.exe net.exe PID 1596 wrote to memory of 1220 1596 VapMbAo.exe net.exe PID 3284 wrote to memory of 2596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 2596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe PID 3284 wrote to memory of 2596 3284 d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe"C:\Users\Admin\AppData\Local\Temp\d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\VapMbAo.exe"C:\Users\Admin\AppData\Local\Temp\VapMbAo.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
- Checks processor information in registry
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2MD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\VapMbAo.exeMD5
28b6df2007a3b33b43a13ab518f2947d
SHA17ea40bac1432c34736bd0cce346d8f9b983c627b
SHA256d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82
SHA512e851fae2a441a1b0814d4725ea288875cd44229573449eddff2af1db66433d27461edf246a6f9ce01a32025985f008c0b6a0ada134aaaf2020b8f8d2ce683f58
-
C:\Users\Admin\AppData\Local\Temp\VapMbAo.exeMD5
28b6df2007a3b33b43a13ab518f2947d
SHA17ea40bac1432c34736bd0cce346d8f9b983c627b
SHA256d29d9915be6d41e899cec8593a36bf55acf63a1d574c65d7562898dab6dafa82
SHA512e851fae2a441a1b0814d4725ea288875cd44229573449eddff2af1db66433d27461edf246a6f9ce01a32025985f008c0b6a0ada134aaaf2020b8f8d2ce683f58