Malware Analysis Report

2024-10-23 18:35

Sample ID 220220-j5ww7sbecj
Target 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
Tags
ryuk ransomware
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V6

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689

Threat Level: Known bad

The file 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689 was found to be: Known bad.

Malicious Activity Summary

ryuk ransomware

Ryuk

Executes dropped EXE

Loads dropped DLL

Checks computer location settings

Drops file in Windows directory

Enumerates physical storage devices

Modifies data under HKEY_USERS

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Checks processor information in registry

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2022-02-20 08:15

Signatures

N/A

Analysis: behavioral2

Detonation Overview

Submitted

2022-02-20 08:15

Reported

2022-02-20 09:34

Platform

win10v2004-en-20220112

Max time kernel

210s

Max time network

218s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe"

Signatures

Ryuk

ransomware ryuk

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe N/A

Drops file in Windows directory

Description Indicator Process Target
File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat C:\Windows\System32\svchost.exe N/A
File opened for modification C:\Windows\Logs\CBS\CBS.log C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
File opened for modification C:\Windows\WinSxS\pending.xml C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Enumerates physical storage devices

Checks processor information in registry

Description Indicator Process Target
Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 C:\Windows\system32\MusNotifyIcon.exe N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Windows\system32\MusNotifyIcon.exe N/A

Modifies data under HKEY_USERS

Description Indicator Process Target
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.500063" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "4.547179" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4328" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" C:\Windows\System32\svchost.exe N/A
Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4120" C:\Windows\System32\svchost.exe N/A
Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "2.325084" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132899995908541781" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" C:\Windows\System32\svchost.exe N/A
Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" C:\Windows\System32\svchost.exe N/A

Runs net.exe

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeBackupPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeRestorePrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A
Token: SeSecurityPrivilege N/A C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3800 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe
PID 3800 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe
PID 3800 wrote to memory of 788 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe
PID 3800 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 3352 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2600 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 3356 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2800 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 3800 wrote to memory of 2396 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 788 wrote to memory of 2404 N/A C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe C:\Windows\SysWOW64\net.exe
PID 2800 wrote to memory of 3372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2800 wrote to memory of 3372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2800 wrote to memory of 3372 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3352 wrote to memory of 2044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3352 wrote to memory of 2044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3352 wrote to memory of 2044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2600 wrote to memory of 216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2600 wrote to memory of 216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2600 wrote to memory of 216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2396 wrote to memory of 4044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2396 wrote to memory of 4044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2396 wrote to memory of 4044 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3356 wrote to memory of 1140 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3356 wrote to memory of 1140 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 3356 wrote to memory of 1140 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 1888 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 1888 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2404 wrote to memory of 1888 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe

"C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe"

C:\Windows\system32\MusNotifyIcon.exe

%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13

C:\Windows\System32\svchost.exe

C:\Windows\System32\svchost.exe -k NetworkService -p

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe

C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding

C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe

"C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe" 8 LAN

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
US 209.197.3.8:80 tcp
US 93.184.221.240:80 tcp
US 8.8.8.8:53 geo.prod.do.dsp.mp.microsoft.com udp
IE 51.104.167.255:443 geo.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 kv801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 kv801.prod.do.dsp.mp.microsoft.com tcp
US 8.8.8.8:53 cp801.prod.do.dsp.mp.microsoft.com udp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
NL 184.29.205.60:443 cp801.prod.do.dsp.mp.microsoft.com tcp
N/A 10.127.0.1:7 udp
NL 154.61.71.13:7 udp
N/A 224.0.0.22:7 udp
N/A 224.0.0.251:7 udp
N/A 224.0.0.252:7 udp
N/A 239.255.255.250:7 udp

Files

C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe

MD5 aa8d5eec0c68de288fdd55a128e77e95
SHA1 496e01324adba5e4db50cb723cc0f4593dfdf6b3
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA512 86700f73ac9da32ff9c5e6ea249ff0dd362a11ca3fd5dd4730c3cc5ccbdc2893a288e4ad26c89dd30e33e841c43cd4cb55ee989efa9e2ecad947ab1a198a7fe2

C:\Users\Admin\AppData\Local\Temp\jcbKeBo.exe

MD5 aa8d5eec0c68de288fdd55a128e77e95
SHA1 496e01324adba5e4db50cb723cc0f4593dfdf6b3
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA512 86700f73ac9da32ff9c5e6ea249ff0dd362a11ca3fd5dd4730c3cc5ccbdc2893a288e4ad26c89dd30e33e841c43cd4cb55ee989efa9e2ecad947ab1a198a7fe2

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_0d751396-3164-4736-b931-4f59d47ff1f2

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 c6b39645b1dbfb5cef7ff3a06eb45a5f
SHA1 582fc94349b00e518bbb5c706e7cc8adc75ecab6
SHA256 4962251e42282a3fd2b73dacc827a09cfae86f5474cd14ec59d39ed085b77206
SHA512 21471cd47aae47ca7c391a8fd4fab58824c7cf536ed037c7e88bf3b7d33a3df285c0860e21984234e38dea4021db77f5b3f6b571d4b2892cb4ef6ffc6430c186

Analysis: behavioral1

Detonation Overview

Submitted

2022-02-20 08:15

Reported

2022-02-20 09:34

Platform

win7-en-20211208

Max time kernel

182s

Max time network

101s

Command Line

"C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe"

Signatures

Ryuk

ransomware ryuk

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A

Enumerates physical storage devices

Runs net.exe

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe N/A
Token: SeBackupPrivilege N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 804 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe
PID 804 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe
PID 804 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe
PID 804 wrote to memory of 1636 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe
PID 804 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 764 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 764 wrote to memory of 1496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 764 wrote to memory of 1496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 764 wrote to memory of 1496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 764 wrote to memory of 1496 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1488 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 1488 wrote to memory of 516 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 516 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 516 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1488 wrote to memory of 516 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1980 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 1980 wrote to memory of 2100 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1980 wrote to memory of 2100 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1980 wrote to memory of 2100 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1980 wrote to memory of 2100 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 2168 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 2168 wrote to memory of 2616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2168 wrote to memory of 2616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2168 wrote to memory of 2616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 2168 wrote to memory of 2616 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 1636 wrote to memory of 7752 N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe C:\Windows\SysWOW64\net.exe
PID 1636 wrote to memory of 7752 N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe C:\Windows\SysWOW64\net.exe
PID 1636 wrote to memory of 7752 N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe C:\Windows\SysWOW64\net.exe
PID 1636 wrote to memory of 7752 N/A C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe C:\Windows\SysWOW64\net.exe
PID 7752 wrote to memory of 7776 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 7752 wrote to memory of 7776 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 7752 wrote to memory of 7776 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 7752 wrote to memory of 7776 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 22240 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 22240 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 22240 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 22240 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 22240 wrote to memory of 23248 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 22240 wrote to memory of 23248 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 22240 wrote to memory of 23248 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 22240 wrote to memory of 23248 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 24192 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 24192 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 24192 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 24192 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 24192 wrote to memory of 24216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 24192 wrote to memory of 24216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 24192 wrote to memory of 24216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 24192 wrote to memory of 24216 N/A C:\Windows\SysWOW64\net.exe C:\Windows\SysWOW64\net1.exe
PID 804 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe
PID 804 wrote to memory of 1604 N/A C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe C:\Windows\SysWOW64\net.exe

Processes

C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe

"C:\Users\Admin\AppData\Local\Temp\3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689.exe"

C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe

"C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe" 8 LAN

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "audioendpointbuilder" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

C:\Windows\SysWOW64\net.exe

"C:\Windows\System32\net.exe" stop "samss" /y

C:\Windows\SysWOW64\net1.exe

C:\Windows\system32\net1 stop "samss" /y

Network

Country Destination Domain Proto
N/A 10.127.0.1:7 udp
NL 154.61.71.51:7 udp
N/A 224.0.0.22:7 udp
N/A 224.0.0.252:7 udp
N/A 239.255.255.250:7 udp

Files

memory/804-54-0x0000000075341000-0x0000000075343000-memory.dmp

\Users\Admin\AppData\Local\Temp\iWrgMWM.exe

MD5 aa8d5eec0c68de288fdd55a128e77e95
SHA1 496e01324adba5e4db50cb723cc0f4593dfdf6b3
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA512 86700f73ac9da32ff9c5e6ea249ff0dd362a11ca3fd5dd4730c3cc5ccbdc2893a288e4ad26c89dd30e33e841c43cd4cb55ee989efa9e2ecad947ab1a198a7fe2

\Users\Admin\AppData\Local\Temp\iWrgMWM.exe

MD5 aa8d5eec0c68de288fdd55a128e77e95
SHA1 496e01324adba5e4db50cb723cc0f4593dfdf6b3
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA512 86700f73ac9da32ff9c5e6ea249ff0dd362a11ca3fd5dd4730c3cc5ccbdc2893a288e4ad26c89dd30e33e841c43cd4cb55ee989efa9e2ecad947ab1a198a7fe2

C:\Users\Admin\AppData\Local\Temp\iWrgMWM.exe

MD5 aa8d5eec0c68de288fdd55a128e77e95
SHA1 496e01324adba5e4db50cb723cc0f4593dfdf6b3
SHA256 3d240e8f42c1ea380b06300235f77423f09bae5b81021150ad4e7aaaf18e8689
SHA512 86700f73ac9da32ff9c5e6ea249ff0dd362a11ca3fd5dd4730c3cc5ccbdc2893a288e4ad26c89dd30e33e841c43cd4cb55ee989efa9e2ecad947ab1a198a7fe2

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_bc8e1036-7fb3-448e-8ad9-a824b1a03b8e

MD5 93a5aadeec082ffc1bca5aa27af70f52
SHA1 47a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256 a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512 df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

MD5 c6b39645b1dbfb5cef7ff3a06eb45a5f
SHA1 582fc94349b00e518bbb5c706e7cc8adc75ecab6
SHA256 4962251e42282a3fd2b73dacc827a09cfae86f5474cd14ec59d39ed085b77206
SHA512 21471cd47aae47ca7c391a8fd4fab58824c7cf536ed037c7e88bf3b7d33a3df285c0860e21984234e38dea4021db77f5b3f6b571d4b2892cb4ef6ffc6430c186