Malware Analysis Report

2024-10-19 06:16

Sample ID 220220-frlbrsaabr
Target 8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4
SHA256 8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4
Tags
ryuk persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4

Threat Level: Known bad

The file 8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4 was found to be: Known bad.

Malicious Activity Summary

ryuk persistence ransomware

Ryuk

Checks computer location settings

Adds Run key to start application

Drops desktop.ini file(s)

Drops file in Program Files directory

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-20 05:06

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-20 05:06

Reported

2022-02-20 05:49

Platform

win7-en-20211208

Max time kernel

171s

Max time network

149s

Command Line

"C:\Windows\system32\Dwm.exe"

Signatures

Ryuk

ransomware ryuk

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A

Drops desktop.ini file(s)

Description Indicator Process Target
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\desktop.ini C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Drops file in Program Files directory

Description Indicator Process Target
File opened for modification C:\Program Files\7-Zip\Lang\id.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ja.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\AddUse.vsd C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipschs.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\osppobjs-spp-plugin-manifest-signed.xrm-ms C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Roses.jpg C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\HWRCustomization\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Scene_loop.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\203x8subpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\1047x576black.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptb.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Notes_loop.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\pushplaysubpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\720x480icongraphic.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\rectangle_scrapbook_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMainMask_PAL.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pt.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\tt.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsnor.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-BR\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\menu_style_default_Thumbnail.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576_91n92.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\NavigationRight_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ne.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\web.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lv-LV\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\To_Do_List.emf C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\VSTO\10.0\1033\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\ja-JP\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\History.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Genko_2.emf C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\LayeredTitles\blackbars60.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationLeft_ButtonGraphic.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\NavigationLeft_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\TravelIntroToMain.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\ar.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsdeu.xml C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\Title_mainImage-mask.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_SelectionSubpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_btn-over-DOT.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_frame-shadow.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrcatlm.dat C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\bear_formatted_rgb6.wmv C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\TitleButtonSubpicture.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push.png C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\sv-SE\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\7-Zip\Lang\pl.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\Microsoft Shared\MSInfo\es-ES\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\ado\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A
File opened for modification C:\Program Files\Common Files\System\Ole DB\es-ES\RyukReadMe.txt C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1136 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 1208 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\taskhost.exe
PID 1136 wrote to memory of 1300 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\Dwm.exe
PID 1136 wrote to memory of 792 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 1136 wrote to memory of 320 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\conhost.exe
PID 792 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 792 wrote to memory of 1632 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe

Processes

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe

"C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" /f /reg:64

C:\Windows\system32\conhost.exe

\??\C:\Windows\system32\conhost.exe "454446870-2078751958176106590-8134576631384567631-18451716916430804871910280670"

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" /f /reg:64

Network

N/A

Files

memory/1136-55-0x0000000076511000-0x0000000076513000-memory.dmp

memory/1208-56-0x0000000030000000-0x0000000030384000-memory.dmp

memory/792-60-0x0000000030000000-0x0000000030384000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-20 05:06

Reported

2022-02-20 05:48

Platform

win10v2004-en-20220113

Max time kernel

177s

Max time network

222s

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Signatures

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 772 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 3500 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SysWOW64\cmd.exe
PID 772 wrote to memory of 2280 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\sihost.exe
PID 3500 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3500 wrote to memory of 2744 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 772 wrote to memory of 2312 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\svchost.exe
PID 772 wrote to memory of 2432 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\taskhostw.exe
PID 772 wrote to memory of 744 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\svchost.exe
PID 772 wrote to memory of 3252 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\DllHost.exe
PID 772 wrote to memory of 3348 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 772 wrote to memory of 3424 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\System32\RuntimeBroker.exe
PID 772 wrote to memory of 3516 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 772 wrote to memory of 3848 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\System32\RuntimeBroker.exe
PID 772 wrote to memory of 4052 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\System32\RuntimeBroker.exe
PID 772 wrote to memory of 1672 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\system32\backgroundTaskHost.exe
PID 772 wrote to memory of 4880 N/A C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe C:\Windows\System32\RuntimeBroker.exe

Processes

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe

"C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe"

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8442a6a136ea46c9c5815736b4ba8a12e7976a21d75c229198d42b1c7213bfe4.exe" /f /reg:64

Network

Country Destination Domain Proto
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 93.184.220.29:80 tcp
US 72.21.81.240:80 tcp
US 72.21.81.240:80 tcp
US 168.62.240.75:443 tcp
US 204.79.197.200:443 tcp

Files

N/A