Analysis
-
max time kernel
175s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 06:01
Static task
static1
Behavioral task
behavioral1
Sample
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
Resource
win10v2004-en-20220113
General
-
Target
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe
-
Size
186KB
-
MD5
d0020f73e4567c9a96b92c78419ed215
-
SHA1
10766dfbedd4ffba1c23bad0d83324bd04d2700a
-
SHA256
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096
-
SHA512
fa075796f4192b8249708f0d18b3dadf56874b75a1619e17ae3a3e61ff72eec010e9d53bb69e5627255119a1ade463dd432b8d9a046da74b653c7f5e83238d8a
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
vSCrxOE.exepid process 4476 vSCrxOE.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exevSCrxOE.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation vSCrxOE.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exevSCrxOE.exepid process 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4476 vSCrxOE.exe 4476 vSCrxOE.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe 4476 vSCrxOE.exe 4476 vSCrxOE.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exevSCrxOE.exedescription pid process Token: SeBackupPrivilege 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe Token: SeBackupPrivilege 4476 vSCrxOE.exe -
Suspicious use of WriteProcessMemory 63 IoCs
Processes:
6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exenet.exenet.exevSCrxOE.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 4832 wrote to memory of 4476 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe vSCrxOE.exe PID 4832 wrote to memory of 4476 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe vSCrxOE.exe PID 4832 wrote to memory of 4476 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe vSCrxOE.exe PID 4832 wrote to memory of 3496 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 3496 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 3496 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2788 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2788 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2788 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 2788 wrote to memory of 1640 2788 net.exe net1.exe PID 2788 wrote to memory of 1640 2788 net.exe net1.exe PID 2788 wrote to memory of 1640 2788 net.exe net1.exe PID 3496 wrote to memory of 4028 3496 net.exe net1.exe PID 3496 wrote to memory of 4028 3496 net.exe net1.exe PID 3496 wrote to memory of 4028 3496 net.exe net1.exe PID 4476 wrote to memory of 4192 4476 vSCrxOE.exe net.exe PID 4476 wrote to memory of 4192 4476 vSCrxOE.exe net.exe PID 4476 wrote to memory of 4192 4476 vSCrxOE.exe net.exe PID 4832 wrote to memory of 4384 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 4384 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 4384 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2580 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2580 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 2580 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4192 wrote to memory of 4056 4192 net.exe net1.exe PID 4192 wrote to memory of 4056 4192 net.exe net1.exe PID 4192 wrote to memory of 4056 4192 net.exe net1.exe PID 4476 wrote to memory of 828 4476 vSCrxOE.exe net.exe PID 4476 wrote to memory of 828 4476 vSCrxOE.exe net.exe PID 4476 wrote to memory of 828 4476 vSCrxOE.exe net.exe PID 2580 wrote to memory of 3688 2580 net.exe net1.exe PID 2580 wrote to memory of 3688 2580 net.exe net1.exe PID 2580 wrote to memory of 3688 2580 net.exe net1.exe PID 4384 wrote to memory of 3848 4384 net.exe net1.exe PID 4384 wrote to memory of 3848 4384 net.exe net1.exe PID 4384 wrote to memory of 3848 4384 net.exe net1.exe PID 828 wrote to memory of 2612 828 net.exe net1.exe PID 828 wrote to memory of 2612 828 net.exe net1.exe PID 828 wrote to memory of 2612 828 net.exe net1.exe PID 4832 wrote to memory of 9944 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 9944 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 9944 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 9952 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 9952 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 9952 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10008 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10008 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10008 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10024 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10024 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 4832 wrote to memory of 10024 4832 6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe net.exe PID 9952 wrote to memory of 10120 9952 net.exe net1.exe PID 9952 wrote to memory of 10120 9952 net.exe net1.exe PID 9952 wrote to memory of 10120 9952 net.exe net1.exe PID 10008 wrote to memory of 10136 10008 net.exe net1.exe PID 10008 wrote to memory of 10136 10008 net.exe net1.exe PID 10008 wrote to memory of 10136 10008 net.exe net1.exe PID 10024 wrote to memory of 10148 10024 net.exe net1.exe PID 10024 wrote to memory of 10148 10024 net.exe net1.exe PID 10024 wrote to memory of 10148 10024 net.exe net1.exe PID 9944 wrote to memory of 10156 9944 net.exe net1.exe PID 9944 wrote to memory of 10156 9944 net.exe net1.exe PID 9944 wrote to memory of 10156 9944 net.exe net1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe"C:\Users\Admin\AppData\Local\Temp\6e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exe"C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4476 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵PID:4056
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:2612
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3496 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:4028
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1640
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4384 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3848
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3688
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:9952 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:10120
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:9944 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:10156
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:10008 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:10136
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:10024 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:10148
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_e269d2c1-0edf-4391-ac7b-818b8e88b04fMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
8c33ca1dad936c07e8e48b3e8d0862d5
SHA17923dfab163b61fa58a77b27c398baacd73b03ae
SHA256866a171150877caf5af6011ec36f9dab92d9faae37e15ba58d1054d2fba281cb
SHA5126604d5328034671a105b569ebb2dc533e5b162e6d291da056a0a376c0d5c82b39a7e1093817ced4c25a3d68f839e1237b17586e26328a87aef648caed651fdfa
-
C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exeMD5
d0020f73e4567c9a96b92c78419ed215
SHA110766dfbedd4ffba1c23bad0d83324bd04d2700a
SHA2566e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096
SHA512fa075796f4192b8249708f0d18b3dadf56874b75a1619e17ae3a3e61ff72eec010e9d53bb69e5627255119a1ade463dd432b8d9a046da74b653c7f5e83238d8a
-
C:\Users\Admin\AppData\Local\Temp\vSCrxOE.exeMD5
d0020f73e4567c9a96b92c78419ed215
SHA110766dfbedd4ffba1c23bad0d83324bd04d2700a
SHA2566e96d221514a919ea0366b4ce51b84fbac21a9da920b5281e4aa27ed2cf3b096
SHA512fa075796f4192b8249708f0d18b3dadf56874b75a1619e17ae3a3e61ff72eec010e9d53bb69e5627255119a1ade463dd432b8d9a046da74b653c7f5e83238d8a