Analysis
-
max time kernel
174s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 05:44
Static task
static1
Behavioral task
behavioral1
Sample
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe
Resource
win10v2004-en-20220113
General
-
Target
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe
-
Size
191KB
-
MD5
708f63f5ef0bafa61743f242f470480f
-
SHA1
96233bf3b488a31852b8e32f7cb91dd5d935f9c2
-
SHA256
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
-
SHA512
5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
QUkJTEr.exepid process 1660 QUkJTEr.exe -
Loads dropped DLL 2 IoCs
Processes:
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exepid process 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QUkJTEr.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 20 IoCs
Processes:
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exeQUkJTEr.exepid process 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1660 QUkJTEr.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1660 QUkJTEr.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe 1660 QUkJTEr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exeQUkJTEr.exedescription pid process Token: SeDebugPrivilege 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe Token: SeBackupPrivilege 1660 QUkJTEr.exe Token: SeBackupPrivilege 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exeQUkJTEr.exenet.exenet.exenet.exenet.exenet.execmd.exenet.exedescription pid process target process PID 1700 wrote to memory of 1660 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe QUkJTEr.exe PID 1700 wrote to memory of 1660 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe QUkJTEr.exe PID 1700 wrote to memory of 1660 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe QUkJTEr.exe PID 1700 wrote to memory of 1660 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe QUkJTEr.exe PID 1700 wrote to memory of 1108 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe taskhost.exe PID 1700 wrote to memory of 1172 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe Dwm.exe PID 1700 wrote to memory of 528 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 528 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 528 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 528 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1488 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1488 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1488 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1488 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1816 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1816 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1816 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1816 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1156 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1156 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1156 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1156 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe net.exe PID 1700 wrote to memory of 1860 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe cmd.exe PID 1700 wrote to memory of 1860 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe cmd.exe PID 1700 wrote to memory of 1860 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe cmd.exe PID 1700 wrote to memory of 1860 1700 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe cmd.exe PID 1660 wrote to memory of 1864 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1864 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1864 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1864 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1904 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1904 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1904 1660 QUkJTEr.exe net.exe PID 1660 wrote to memory of 1904 1660 QUkJTEr.exe net.exe PID 1816 wrote to memory of 1680 1816 net.exe net1.exe PID 1816 wrote to memory of 1680 1816 net.exe net1.exe PID 1816 wrote to memory of 1680 1816 net.exe net1.exe PID 1816 wrote to memory of 1680 1816 net.exe net1.exe PID 1156 wrote to memory of 1548 1156 net.exe net1.exe PID 1156 wrote to memory of 1548 1156 net.exe net1.exe PID 1156 wrote to memory of 1548 1156 net.exe net1.exe PID 1156 wrote to memory of 1548 1156 net.exe net1.exe PID 528 wrote to memory of 1668 528 net.exe net1.exe PID 528 wrote to memory of 1668 528 net.exe net1.exe PID 528 wrote to memory of 1668 528 net.exe net1.exe PID 528 wrote to memory of 1668 528 net.exe net1.exe PID 1864 wrote to memory of 1620 1864 net.exe net1.exe PID 1864 wrote to memory of 1620 1864 net.exe net1.exe PID 1864 wrote to memory of 1620 1864 net.exe net1.exe PID 1864 wrote to memory of 1620 1864 net.exe net1.exe PID 1488 wrote to memory of 1336 1488 net.exe net1.exe PID 1488 wrote to memory of 1336 1488 net.exe net1.exe PID 1488 wrote to memory of 1336 1488 net.exe net1.exe PID 1488 wrote to memory of 1336 1488 net.exe net1.exe PID 1860 wrote to memory of 1868 1860 cmd.exe reg.exe PID 1860 wrote to memory of 1868 1860 cmd.exe reg.exe PID 1860 wrote to memory of 1868 1860 cmd.exe reg.exe PID 1860 wrote to memory of 1868 1860 cmd.exe reg.exe PID 1904 wrote to memory of 916 1904 net.exe net1.exe PID 1904 wrote to memory of 916 1904 net.exe net1.exe PID 1904 wrote to memory of 916 1904 net.exe net1.exe PID 1904 wrote to memory of 916 1904 net.exe net1.exe PID 1660 wrote to memory of 3064 1660 QUkJTEr.exe cmd.exe PID 1660 wrote to memory of 3064 1660 QUkJTEr.exe cmd.exe
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe"C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe"C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" /f /reg:644⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:642⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:643⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462aMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exeMD5
708f63f5ef0bafa61743f242f470480f
SHA196233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA2567433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA5125e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
b99d47f48bba763d4eded8882f9d3fae
SHA1aa0b195e158e91b93ea7aa97c3f02461b86b0163
SHA256577cfa8bd59e6c4b007b33f03fffe15adf180ca48b121bfe6a837cf481a234fb
SHA512ce3186e760f8c441a14a01cb52ed147985946d5a672095024aade10db7238ef38ee71fecbe2b3266a0c5018f694c79f28e4a87849861c1ba74a307240548714b
-
\Users\Admin\AppData\Local\Temp\QUkJTEr.exeMD5
708f63f5ef0bafa61743f242f470480f
SHA196233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA2567433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA5125e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9
-
\Users\Admin\AppData\Local\Temp\QUkJTEr.exeMD5
708f63f5ef0bafa61743f242f470480f
SHA196233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA2567433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA5125e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9
-
memory/1108-60-0x0000000030000000-0x0000000030170000-memory.dmpFilesize
1.4MB
-
memory/1700-55-0x0000000075F91000-0x0000000075F93000-memory.dmpFilesize
8KB