Analysis
-
max time kernel
188s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 05:08
Static task
static1
Behavioral task
behavioral1
Sample
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe
Resource
win10v2004-en-20220113
General
-
Target
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe
-
Size
187KB
-
MD5
2ee9a7ce3356c032d49c1947761c63b2
-
SHA1
30181311c46b89cc3e01d3d8207c4c533199fa88
-
SHA256
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2
-
SHA512
d2e8c140e5935ab0761283c8f85a0f9881129a0f131e51d1d4e1257d47874be9326437bac33c1f921eff3f0658b0147f026492083e47d8bea6b50ddc9873afd2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
KgJNfBI.exepid process 760 KgJNfBI.exe -
Loads dropped DLL 2 IoCs
Processes:
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exepid process 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exeKgJNfBI.exepid process 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 760 KgJNfBI.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 760 KgJNfBI.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exeKgJNfBI.exedescription pid process Token: SeBackupPrivilege 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe Token: SeBackupPrivilege 760 KgJNfBI.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exenet.exenet.exenet.exenet.exeKgJNfBI.exenet.exenet.exenet.exedescription pid process target process PID 1916 wrote to memory of 760 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe KgJNfBI.exe PID 1916 wrote to memory of 760 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe KgJNfBI.exe PID 1916 wrote to memory of 760 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe KgJNfBI.exe PID 1916 wrote to memory of 760 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe KgJNfBI.exe PID 1916 wrote to memory of 240 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 240 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 240 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 240 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 240 wrote to memory of 1092 240 net.exe net1.exe PID 240 wrote to memory of 1092 240 net.exe net1.exe PID 240 wrote to memory of 1092 240 net.exe net1.exe PID 240 wrote to memory of 1092 240 net.exe net1.exe PID 1916 wrote to memory of 1860 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1860 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1860 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1860 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1860 wrote to memory of 364 1860 net.exe net1.exe PID 1860 wrote to memory of 364 1860 net.exe net1.exe PID 1860 wrote to memory of 364 1860 net.exe net1.exe PID 1860 wrote to memory of 364 1860 net.exe net1.exe PID 1916 wrote to memory of 1116 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1116 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1116 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 1116 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1116 wrote to memory of 1608 1116 net.exe net1.exe PID 1116 wrote to memory of 1608 1116 net.exe net1.exe PID 1116 wrote to memory of 1608 1116 net.exe net1.exe PID 1116 wrote to memory of 1608 1116 net.exe net1.exe PID 1916 wrote to memory of 896 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 896 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 896 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 896 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 896 wrote to memory of 2188 896 net.exe net1.exe PID 896 wrote to memory of 2188 896 net.exe net1.exe PID 896 wrote to memory of 2188 896 net.exe net1.exe PID 896 wrote to memory of 2188 896 net.exe net1.exe PID 760 wrote to memory of 5532 760 KgJNfBI.exe net.exe PID 760 wrote to memory of 5532 760 KgJNfBI.exe net.exe PID 760 wrote to memory of 5532 760 KgJNfBI.exe net.exe PID 760 wrote to memory of 5532 760 KgJNfBI.exe net.exe PID 5532 wrote to memory of 5556 5532 net.exe net1.exe PID 5532 wrote to memory of 5556 5532 net.exe net1.exe PID 5532 wrote to memory of 5556 5532 net.exe net1.exe PID 5532 wrote to memory of 5556 5532 net.exe net1.exe PID 1916 wrote to memory of 16864 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16864 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16864 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16864 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 16864 wrote to memory of 16888 16864 net.exe net1.exe PID 16864 wrote to memory of 16888 16864 net.exe net1.exe PID 16864 wrote to memory of 16888 16864 net.exe net1.exe PID 16864 wrote to memory of 16888 16864 net.exe net1.exe PID 1916 wrote to memory of 16904 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16904 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16904 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16904 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 16904 wrote to memory of 16928 16904 net.exe net1.exe PID 16904 wrote to memory of 16928 16904 net.exe net1.exe PID 16904 wrote to memory of 16928 16904 net.exe net1.exe PID 16904 wrote to memory of 16928 16904 net.exe net1.exe PID 1916 wrote to memory of 16996 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16996 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16996 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe PID 1916 wrote to memory of 16996 1916 8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe"C:\Users\Admin\AppData\Local\Temp\8366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\Temp\KgJNfBI.exe"C:\Users\Admin\AppData\Local\Temp\KgJNfBI.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:5532 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:5556
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵PID:17080
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:17104
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1092
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1860 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:364
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1608
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2188
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:16864 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:16888
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:16904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:16928
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:16996
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:17020
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:17036
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:17064
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8e
MD593a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
MD5
2ee9a7ce3356c032d49c1947761c63b2
SHA130181311c46b89cc3e01d3d8207c4c533199fa88
SHA2568366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2
SHA512d2e8c140e5935ab0761283c8f85a0f9881129a0f131e51d1d4e1257d47874be9326437bac33c1f921eff3f0658b0147f026492083e47d8bea6b50ddc9873afd2
-
MD5
cc9731a1394a7195d52b9770a4b1f71e
SHA1b39a6e2e5b63caf53add9b3596dd7426f02f1969
SHA256545183ba23f32b6ad8a4ee26e0101171eb398ad4f528506a99e2720ab30a5476
SHA512fa29e221fe23962d550490e61e32a8193fb23d20894b1e10a2b97c9133e1c4bec3c02d42fc0046a3cc16918e981337301e4863817d25ca3f13422b9babd5e273
-
MD5
2ee9a7ce3356c032d49c1947761c63b2
SHA130181311c46b89cc3e01d3d8207c4c533199fa88
SHA2568366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2
SHA512d2e8c140e5935ab0761283c8f85a0f9881129a0f131e51d1d4e1257d47874be9326437bac33c1f921eff3f0658b0147f026492083e47d8bea6b50ddc9873afd2
-
MD5
2ee9a7ce3356c032d49c1947761c63b2
SHA130181311c46b89cc3e01d3d8207c4c533199fa88
SHA2568366f63d37f8cefda19657c49000b662c4dde38463517c34168b33bf427db5d2
SHA512d2e8c140e5935ab0761283c8f85a0f9881129a0f131e51d1d4e1257d47874be9326437bac33c1f921eff3f0658b0147f026492083e47d8bea6b50ddc9873afd2