Analysis
-
max time kernel
167s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 01:31
Static task
static1
Behavioral task
behavioral1
Sample
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
Resource
win10v2004-en-20220113
General
-
Target
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe
-
Size
192KB
-
MD5
9c2f2398a853063303817e181b7cd140
-
SHA1
f0c032844d33537e7f270374f1f1c28ef7670683
-
SHA256
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
-
SHA512
4ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
UOBpfwJ.exepid process 268 UOBpfwJ.exe -
Loads dropped DLL 2 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exepid process 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\UOBpfwJ.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exeUOBpfwJ.exepid process 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 268 UOBpfwJ.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 268 UOBpfwJ.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe 268 UOBpfwJ.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exeUOBpfwJ.exedescription pid process Token: SeDebugPrivilege 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe Token: SeBackupPrivilege 268 UOBpfwJ.exe Token: SeBackupPrivilege 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exenet.exenet.exeUOBpfwJ.exenet.exenet.execmd.exenet.execmd.exedescription pid process target process PID 1600 wrote to memory of 268 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe UOBpfwJ.exe PID 1600 wrote to memory of 268 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe UOBpfwJ.exe PID 1600 wrote to memory of 268 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe UOBpfwJ.exe PID 1600 wrote to memory of 268 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe UOBpfwJ.exe PID 1600 wrote to memory of 1096 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe taskhost.exe PID 1600 wrote to memory of 560 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 560 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 560 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 560 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 560 wrote to memory of 568 560 net.exe net1.exe PID 560 wrote to memory of 568 560 net.exe net1.exe PID 560 wrote to memory of 568 560 net.exe net1.exe PID 560 wrote to memory of 568 560 net.exe net1.exe PID 1600 wrote to memory of 1092 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1092 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1092 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1092 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1180 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe Dwm.exe PID 1092 wrote to memory of 772 1092 net.exe net1.exe PID 1092 wrote to memory of 772 1092 net.exe net1.exe PID 1092 wrote to memory of 772 1092 net.exe net1.exe PID 1092 wrote to memory of 772 1092 net.exe net1.exe PID 268 wrote to memory of 976 268 UOBpfwJ.exe net.exe PID 268 wrote to memory of 976 268 UOBpfwJ.exe net.exe PID 268 wrote to memory of 976 268 UOBpfwJ.exe net.exe PID 268 wrote to memory of 976 268 UOBpfwJ.exe net.exe PID 976 wrote to memory of 1928 976 net.exe net1.exe PID 976 wrote to memory of 1928 976 net.exe net1.exe PID 976 wrote to memory of 1928 976 net.exe net1.exe PID 976 wrote to memory of 1928 976 net.exe net1.exe PID 1600 wrote to memory of 1132 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1132 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1132 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 1132 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1132 wrote to memory of 1248 1132 net.exe net1.exe PID 1132 wrote to memory of 1248 1132 net.exe net1.exe PID 1132 wrote to memory of 1248 1132 net.exe net1.exe PID 1132 wrote to memory of 1248 1132 net.exe net1.exe PID 1600 wrote to memory of 2044 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 1600 wrote to memory of 2044 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 1600 wrote to memory of 2044 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 1600 wrote to memory of 2044 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe cmd.exe PID 2044 wrote to memory of 1688 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1688 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1688 2044 cmd.exe reg.exe PID 2044 wrote to memory of 1688 2044 cmd.exe reg.exe PID 268 wrote to memory of 6756 268 UOBpfwJ.exe cmd.exe PID 268 wrote to memory of 6756 268 UOBpfwJ.exe cmd.exe PID 268 wrote to memory of 6756 268 UOBpfwJ.exe cmd.exe PID 268 wrote to memory of 6756 268 UOBpfwJ.exe cmd.exe PID 1600 wrote to memory of 7264 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 7264 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 7264 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 7264 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 7264 wrote to memory of 7292 7264 net.exe net1.exe PID 7264 wrote to memory of 7292 7264 net.exe net1.exe PID 7264 wrote to memory of 7292 7264 net.exe net1.exe PID 7264 wrote to memory of 7292 7264 net.exe net1.exe PID 6756 wrote to memory of 7300 6756 cmd.exe reg.exe PID 6756 wrote to memory of 7300 6756 cmd.exe reg.exe PID 6756 wrote to memory of 7300 6756 cmd.exe reg.exe PID 6756 wrote to memory of 7300 6756 cmd.exe reg.exe PID 1600 wrote to memory of 7760 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe PID 1600 wrote to memory of 7760 1600 d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe net.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe"C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\UOBpfwJ.exe"C:\Users\Admin\AppData\Local\Temp\UOBpfwJ.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOBpfwJ.exe" /f /reg:643⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\UOBpfwJ.exe" /f /reg:644⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" /f /reg:642⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f.exe" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8eMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
5cedf73dbf75099b8abcefc3f07e9975
SHA12ecabc828715573e9d7aefaf82bfb0e7379e92cc
SHA256beb3695bb9be64d641570104a56889b776cdbebd9c132045c52b9543d1f82b63
SHA512dfe8485e7138ee9d0a03b9f3000bc8513856f82b51d2ef9f7c6be66b28ea0df86521c2b3b3c575f11061b3820758f280a99fbf77e482fa34c3a53c40c3928c56
-
C:\Users\Admin\AppData\Local\Temp\UOBpfwJ.exeMD5
9c2f2398a853063303817e181b7cd140
SHA1f0c032844d33537e7f270374f1f1c28ef7670683
SHA256d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
SHA5124ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
-
\Users\Admin\AppData\Local\Temp\UOBpfwJ.exeMD5
9c2f2398a853063303817e181b7cd140
SHA1f0c032844d33537e7f270374f1f1c28ef7670683
SHA256d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
SHA5124ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
-
\Users\Admin\AppData\Local\Temp\UOBpfwJ.exeMD5
9c2f2398a853063303817e181b7cd140
SHA1f0c032844d33537e7f270374f1f1c28ef7670683
SHA256d4b8cbfa94bac3dbd58452fcc6c4e0b56b65a54a671a2184d9fb6e3694a0266f
SHA5124ad5d989e5e50c7cd9a5f65de4312fe63e53c97ceddd9b33a4a026c1b2fccdc27ac7406f3ec38132fb6da6c5439396bed2fee482775f55e265934fdc80425319
-
memory/1096-59-0x0000000030000000-0x0000000030170000-memory.dmpFilesize
1.4MB
-
memory/1600-54-0x0000000075CE1000-0x0000000075CE3000-memory.dmpFilesize
8KB