Malware Analysis Report

2024-10-19 06:16

Sample ID 220220-ge513sacfn
Target 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
Tags
ryuk persistence ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9

Threat Level: Known bad

The file 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9 was found to be: Known bad.

Malicious Activity Summary

ryuk persistence ransomware

Ryuk

Executes dropped EXE

Checks computer location settings

Loads dropped DLL

Adds Run key to start application

Enumerates physical storage devices

Suspicious use of WriteProcessMemory

Suspicious use of AdjustPrivilegeToken

Runs net.exe

Suspicious behavior: EnumeratesProcesses

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-20 05:44

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-20 05:44

Reported

2022-02-20 06:32

Platform

win7-en-20211208

Max time kernel

174s

Max time network

148s

Command Line

"taskhost.exe"

Signatures

Ryuk

ransomware ryuk

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\QUkJTEr.exe" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1700 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe
PID 1700 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe
PID 1700 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe
PID 1700 wrote to memory of 1660 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe
PID 1700 wrote to memory of 1108 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\taskhost.exe
PID 1700 wrote to memory of 1172 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\Dwm.exe
PID 1700 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 528 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1816 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1156 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1700 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 1700 wrote to memory of 1860 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1864 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1660 wrote to memory of 1904 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\net.exe
PID 1816 wrote to memory of 1680 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1816 wrote to memory of 1680 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1816 wrote to memory of 1680 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1816 wrote to memory of 1680 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1156 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1156 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1156 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1156 wrote to memory of 1548 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 528 wrote to memory of 1668 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 528 wrote to memory of 1668 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 528 wrote to memory of 1668 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 528 wrote to memory of 1668 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1864 wrote to memory of 1620 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1864 wrote to memory of 1620 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1864 wrote to memory of 1620 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1864 wrote to memory of 1620 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 1336 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 1336 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 1336 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 1336 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1860 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1860 wrote to memory of 1868 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 1904 wrote to memory of 916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1904 wrote to memory of 916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1904 wrote to memory of 916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1904 wrote to memory of 916 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1660 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\cmd.exe
PID 1660 wrote to memory of 3064 N/A C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe C:\Windows\SysWOW64\cmd.exe

Processes

C:\Windows\system32\taskhost.exe

"taskhost.exe"

C:\Windows\system32\Dwm.exe

"C:\Windows\system32\Dwm.exe"

C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe

"C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe"

C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe

"C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" 8 LAN

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:64

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:64

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe" /f /reg:64

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
N/A 10.127.0.1:7 udp
NL 154.61.71.13:7 udp
N/A 224.0.0.22:7 udp
N/A 224.0.0.252:7 udp
N/A 239.255.255.250:7 udp

Files

memory/1700-55-0x0000000075F91000-0x0000000075F93000-memory.dmp

\Users\Admin\AppData\Local\Temp\QUkJTEr.exe

MD5 708f63f5ef0bafa61743f242f470480f
SHA1 96233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA512 5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9

\Users\Admin\AppData\Local\Temp\QUkJTEr.exe

MD5 708f63f5ef0bafa61743f242f470480f
SHA1 96233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA512 5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9

C:\Users\Admin\AppData\Local\Temp\QUkJTEr.exe

MD5 708f63f5ef0bafa61743f242f470480f
SHA1 96233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA512 5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9

memory/1108-60-0x0000000030000000-0x0000000030170000-memory.dmp

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 b99d47f48bba763d4eded8882f9d3fae
SHA1 aa0b195e158e91b93ea7aa97c3f02461b86b0163
SHA256 577cfa8bd59e6c4b007b33f03fffe15adf180ca48b121bfe6a837cf481a234fb
SHA512 ce3186e760f8c441a14a01cb52ed147985946d5a672095024aade10db7238ef38ee71fecbe2b3266a0c5018f694c79f28e4a87849861c1ba74a307240548714b

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-20 05:44

Reported

2022-02-20 06:34

Platform

win10v2004-en-20220113

Max time kernel

176s

Max time network

215s

Command Line

C:\Windows\System32\RuntimeBroker.exe -Embedding

Signatures

Ryuk

ransomware ryuk

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" C:\Windows\SysWOW64\reg.exe N/A
Key created \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run C:\Windows\SysWOW64\reg.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\oChGcDY.exe" C:\Windows\SysWOW64\reg.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 4608 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe
PID 4608 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe
PID 4608 wrote to memory of 312 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe
PID 4608 wrote to memory of 2288 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\sihost.exe
PID 4608 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 4196 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4196 wrote to memory of 2428 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4196 wrote to memory of 2428 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4196 wrote to memory of 2428 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4608 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 1492 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 2324 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\svchost.exe
PID 1492 wrote to memory of 696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1492 wrote to memory of 696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1492 wrote to memory of 696 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4608 wrote to memory of 2416 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\taskhostw.exe
PID 4608 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\svchost.exe
PID 4608 wrote to memory of 3240 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\DllHost.exe
PID 4608 wrote to memory of 3344 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
PID 4608 wrote to memory of 3408 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\System32\RuntimeBroker.exe
PID 4608 wrote to memory of 3496 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
PID 4608 wrote to memory of 3688 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\System32\RuntimeBroker.exe
PID 4608 wrote to memory of 3580 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\System32\RuntimeBroker.exe
PID 4608 wrote to memory of 1084 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\system32\backgroundTaskHost.exe
PID 4608 wrote to memory of 3672 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\System32\RuntimeBroker.exe
PID 4608 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 1232 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 1232 wrote to memory of 5024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1232 wrote to memory of 5024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1232 wrote to memory of 5024 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4608 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 4608 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 4608 wrote to memory of 3628 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\cmd.exe
PID 3628 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3628 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 3628 wrote to memory of 4100 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4608 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 3952 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 3952 wrote to memory of 1820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3952 wrote to memory of 1820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3952 wrote to memory of 1820 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 312 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\net.exe
PID 312 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\net.exe
PID 312 wrote to memory of 4760 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\net.exe
PID 4760 wrote to memory of 2036 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4760 wrote to memory of 2036 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4760 wrote to memory of 2036 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 312 wrote to memory of 5228 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 5228 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\cmd.exe
PID 312 wrote to memory of 5228 N/A C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe C:\Windows\SysWOW64\cmd.exe
PID 5228 wrote to memory of 5288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5228 wrote to memory of 5288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 5228 wrote to memory of 5288 N/A C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\reg.exe
PID 4608 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 4608 wrote to memory of 5328 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe
PID 5328 wrote to memory of 5392 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5328 wrote to memory of 5392 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 5328 wrote to memory of 5392 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 4608 wrote to memory of 11108 N/A C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe C:\Windows\SysWOW64\net.exe

Processes

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe

"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\system32\backgroundTaskHost.exe

"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\System32\RuntimeBroker.exe

C:\Windows\System32\RuntimeBroker.exe -Embedding

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe

"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca

C:\Windows\system32\DllHost.exe

C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc

C:\Windows\system32\taskhostw.exe

taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc

C:\Windows\system32\sihost.exe

sihost.exe

C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe

"C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe"

C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe

"C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe" 8 LAN

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9.exe" /f /reg:64

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\cmd.exe

"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe" /f /reg:64

C:\Windows\SysWOW64\reg.exe

REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe" /f /reg:64

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
NL 178.79.208.1:80 tcp
NL 178.79.208.1:80 tcp
N/A 10.127.0.1:7 udp
NL 154.61.71.51:7 udp
N/A 224.0.0.22:7 udp
N/A 224.0.0.251:7 udp
N/A 224.0.0.252:7 udp
N/A 239.255.255.250:7 udp

Files

C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe

MD5 708f63f5ef0bafa61743f242f470480f
SHA1 96233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA512 5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9

C:\Users\Admin\AppData\Local\Temp\oChGcDY.exe

MD5 708f63f5ef0bafa61743f242f470480f
SHA1 96233bf3b488a31852b8e32f7cb91dd5d935f9c2
SHA256 7433f2a47d324d386ed215930ab6607a7cce28d5cef868afe994582c409e5dc9
SHA512 5e202f916430e179373c814e2b2cefbb993b83c597776afecea731c190f3aec1ce21c76ce1786afc8ab5d92c060201ce0828b9ac81d709407a8b6358146260c9

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_e269d2c1-0edf-4391-ac7b-818b8e88b04f

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 b99d47f48bba763d4eded8882f9d3fae
SHA1 aa0b195e158e91b93ea7aa97c3f02461b86b0163
SHA256 577cfa8bd59e6c4b007b33f03fffe15adf180ca48b121bfe6a837cf481a234fb
SHA512 ce3186e760f8c441a14a01cb52ed147985946d5a672095024aade10db7238ef38ee71fecbe2b3266a0c5018f694c79f28e4a87849861c1ba74a307240548714b