ryuk | 8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

Analysis

max time kernel
183s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20-02-2022 04:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
Size

119KB
MD5

fc5473e4320cedbb353b77955ecf2366
SHA1

081a837503dfa82c177ef1229b2c00215d676442
SHA256

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd
SHA512

3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'hKC4IfX'; $torlink = 'http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://oc6mkf4efqrjp2ue6qp6vmz4ofyjmlo6dtqiklqb2q546bnqeu66tbyd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Executes dropped EXE 3 IoCs

Processes:

npuePOEKgrep.exezdRavdrYslan.exezUIamlpUklan.exe

pid process

3352 npuePOEKgrep.exe
408 zdRavdrYslan.exe
3460 zUIamlpUklan.exe

pid	process
3352	npuePOEKgrep.exe
408	zdRavdrYslan.exe
3460	zUIamlpUklan.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

27704 icacls.exe
27716 icacls.exe

pid	process
27704	icacls.exe
27716	icacls.exe

Drops file in Program Files directory 64 IoCs

Processes:

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

description	ioc	process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ru-RU\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\en-US\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\tipresx.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ms.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\zh-changjei.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\7zCon.sfx	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_altgr.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InkObj.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\ShapeCollector.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\ja-jp.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hr-HR\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\nb-NO\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fy.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\uk.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\InputPersonalization.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsdan.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ba.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\gl.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\TipRes.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\rtscom.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\ShapeCollector.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\pt-PT\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\mshwLatin.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\MSInfo\de-DE\msinfo32.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\cy.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fr-FR\rtscom.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshi.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\tabskb.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\tipresx.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\et-EE\tipresx.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipscat.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sq.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lij.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\yo.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\de-DE\TabTip.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsfin.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\mshwLatin.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ko-KR\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\be.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\sl.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\en-US\TipRes.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\mshwLatin.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-ES\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\es-MX\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\oskclearuibase.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptg.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\DESIGNER\MSADDNDR.OLB	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\zh-TW\tipresx.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\ShapeCollector.exe.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\it-IT\mshwLatin.dll.mui	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\el-GR\RyukReadMe.html	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\auxbase.xml	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\ca.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
File opened for modification	C:\Program Files\7-Zip\Lang\zh-tw.txt	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

Drops file in Windows directory 1 IoCs

Processes:

svchost.exe

description	ioc	process
File opened for modification	C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

MusNotifyIcon.exe

description	ioc	process
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	MusNotifyIcon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	MusNotifyIcon.exe

Modifies data under HKEY_USERS 49 IoCs

Processes:

svchost.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "6.249953"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899830083754440"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4108"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4324"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.000000"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0"	svchost.exe
Key created	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0"	svchost.exe
Set value (str)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.684522"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0"	svchost.exe
Set value (int)	\REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0"	svchost.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

Processes:

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

pid	process
780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe

description	pid	process	target process
PID 780 wrote to memory of 3352	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	npuePOEKgrep.exe
PID 780 wrote to memory of 3352	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	npuePOEKgrep.exe
PID 780 wrote to memory of 3352	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	npuePOEKgrep.exe
PID 780 wrote to memory of 408	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zdRavdrYslan.exe
PID 780 wrote to memory of 408	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zdRavdrYslan.exe
PID 780 wrote to memory of 408	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zdRavdrYslan.exe
PID 780 wrote to memory of 3460	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zUIamlpUklan.exe
PID 780 wrote to memory of 3460	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zUIamlpUklan.exe
PID 780 wrote to memory of 3460	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	zUIamlpUklan.exe
PID 780 wrote to memory of 27704	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe
PID 780 wrote to memory of 27704	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe
PID 780 wrote to memory of 27704	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe
PID 780 wrote to memory of 27716	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe
PID 780 wrote to memory of 27716	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe
PID 780 wrote to memory of 27716	780	8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe	icacls.exe

C:\Users\Admin\AppData\Local\Temp\8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe
"C:\Users\Admin\AppData\Local\Temp\8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd.exe"
1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:780

C:\Users\Admin\AppData\Local\Temp\npuePOEKgrep.exe
"C:\Users\Admin\AppData\Local\Temp\npuePOEKgrep.exe" 9 REP
2⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\AppData\Local\Temp\zdRavdrYslan.exe
"C:\Users\Admin\AppData\Local\Temp\zdRavdrYslan.exe" 8 LAN
2⤵
- Executes dropped EXE
PID:408

C:\Users\Admin\AppData\Local\Temp\zUIamlpUklan.exe
"C:\Users\Admin\AppData\Local\Temp\zUIamlpUklan.exe" 8 LAN
2⤵
- Executes dropped EXE
PID:3460

C:\Windows\SysWOW64\icacls.exe
icacls "C:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:27704

C:\Windows\SysWOW64\icacls.exe
icacls "D:\*" /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:27716

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
- Checks processor information in registry
PID:2588

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k NetworkService -p
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:19596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\$Recycle.Bin\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\$Recycle.Bin\S-1-5-21-790714498-1549421491-1643397139-1000\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\DumpStack.log.tmp

MD5
8fe235bba7667b6f7d85d5563dcd8b4b

SHA1
55671f13fb9cdf2652273573d7654cf69a3b0821

SHA256
d9334f436e8623621bf987b09aa2ed95f7f91499bdc7e0c21bd63fe947567258

SHA512
7cb563c04922f15953abade70c80f4ffabdfd070f97edc6b250c6e6ea26c4e55972e3a56b815a9aa0d2e19242ffd147d36cbc077d00bd2d7315adcd9297350ba

Download Submit
C:\PerfLogs\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\ProgramData\USOShared\Logs\User\NotifyIcon.ea8a7b8e-02e5-435f-9264-f01ff78d8e8b.1.etl

MD5
6f34c815b46f5989efdf421b1d034e9a

SHA1
c599488a20fadb81bfa6da680e99dc10ebe684b9

SHA256
abd1d02b549ed7d1f54ca91be84474c7e8637bb0852d306b97bb1be23145669a

SHA512
2e4de185f94809ecb44932a1792eac4aa9150baa95b86b836aa52b109be68a18a48c553cba3a1ffd07e1e9aeae627304ed17c55e5db0a8e37e38603624db70ba

Download Submit
C:\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\npuePOEKgrep.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\npuePOEKgrep.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zUIamlpUklan.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zUIamlpUklan.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zdRavdrYslan.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\Admin\AppData\Local\Temp\zdRavdrYslan.exe

MD5
fc5473e4320cedbb353b77955ecf2366

SHA1
081a837503dfa82c177ef1229b2c00215d676442

SHA256
8fe01ec7a48e40dc8292e1ee22db0e59b549c46cb3163447f920a420bfb91cdd

SHA512
3f378525a049557b46193b4f0b4611fbb73cac095983ac75da46f5574ba829cc51bb5c3ab6747591607e73ce89a77da0843e1c6098be7e56c7a3a5fa8578f7c1

Download Submit
C:\Users\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\odt\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit
C:\odt\config.xml

MD5
5d5a885c4f1a8032e79406b386604092

SHA1
820b9ba556167d367a93d5576e0bc167ba51197f

SHA256
5c39615688316f2748a354cc81174dc3e2db7bc6718e4e3224d6861daba89ee7

SHA512
5347d89d1c676d520154969c3235e9f11db4d211fd903e7162a8ba846a5f4f7d0a58576c720e3305fc6b9bb6c967e8578b7f83ffd44e276e0faf19e8fa5b017b

Download Submit
C:\users\Public\RyukReadMe.html

MD5
f8d3ea8320a566aaf69b624c5e4dbe02

SHA1
d51a8ef0d34a40806297de5faef9ae73f3857823

SHA256
b05dd37cfa30a42eba05a0a109c1a5ddc8004bc0f45f76bd8b71fab214576bac

SHA512
1bcf121dbad592da9fc6fea1cdac586965048b334a68c90d043dd1a1457f936bd25b503631ea693289880b49caa9a85b13612944cfe85199b18c6ed967f874bf

Download Submit