Analysis
-
max time kernel
189s -
max time network
177s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
20-02-2022 09:18
Static task
static1
Behavioral task
behavioral1
Sample
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe
Resource
win10v2004-en-20220112
General
-
Target
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe
-
Size
170KB
-
MD5
c4a5c4a20aa92002fd73ffa1eae12875
-
SHA1
de32df32c920015197ed7304d67ac3475876502b
-
SHA256
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8
-
SHA512
0c8b7702f0f8cfb715f4c7d2c254d3224c7f4f2aacc6cef30f774be8d3210b2defacbabf812d936d590ec720ab7c19c69ae8844f5a55993d0e31d3041fdf9e0b
Malware Config
Extracted
C:\RyukReadMe.txt
ryuk
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 3368 created 2736 3368 WerFault.exe DllHost.exe PID 2360 created 2428 2360 WerFault.exe BackgroundTransferHost.exe PID 3376 created 2912 3376 WerFault.exe StartMenuExperienceHost.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
Processes:
sihost.exedescription ioc process File opened for modification C:\Program Files\Common Files\System\es-ES\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\LINEAR_RGB.pf sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_zh_CN.properties sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fonts\LucidaSansDemiBold.ttf sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsid.xml sihost.exe File opened for modification C:\Program Files\7-Zip\History.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskclearui\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\net.properties sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\1033\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkServerCP.bat sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\i640.hash sihost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\it-IT\sqlxmlx.rll.mui sihost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\fr-FR\sqlxmlx.rll.mui sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\fontconfig.properties.src sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt sihost.exe File opened for modification C:\Program Files\7-Zip\readme.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\da-DK\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\ado\msadomd28.tlb sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_ru.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\win32\bridge\AccessBridgeCalls.h sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\sl.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\sysinfo.bat sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\jdwpTransport.h sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\de-DE\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-CA\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\System\Ole DB\de-DE\sqloledb.rll.mui sihost.exe File opened for modification C:\Program Files\7-Zip\7z.sfx sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\NetworkServerControl sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknav\osknavbase.xml sihost.exe File opened for modification C:\Program Files\Internet Explorer\fr-FR\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_zh_CN.jar sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\startNetworkServer sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\bin\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setNetworkClientCP.bat sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\jvm.hprof.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\resources.jar sihost.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\Office Setup Controller\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\configuration\org.eclipse.update\platform.xml sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\RyukReadMe.txt sihost.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\RyukReadMe.txt sihost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 4 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3444 2736 WerFault.exe DllHost.exe 4464 2912 WerFault.exe StartMenuExperienceHost.exe 4456 2736 WerFault.exe DllHost.exe 4448 2428 WerFault.exe BackgroundTransferHost.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Modifies registry class 49 IoCs
Processes:
RuntimeBroker.exedescription ioc process Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7fbd87a2-352b-4e4f- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c4d77a68-267a-4eae- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b41b289d-10b2-49de- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = "8324" RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = "\\\\?\\Volume{018D5B2B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\a72a14d75061bdb198fa37c9c06ef29beb2404c1063da768c6273080f2bc13b2" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d7990d16-d40a-45b6- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\372648e5-7051-420f- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\2796326f-259a-41c6- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\6e596e76-6694-4b6a- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\350ac738-f71c-4e0e- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7b3f86c6-204a-4aef- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\39b057ce-e6a4-4cc5- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d83c6f60-c18f-44b2- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0588bf78-d0ba-4ad9- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = 52f0b92a4a26d801 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\7ef6ce77-0574-4114- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\723521ca-35ea-4ca2- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\0b25730e-ca38-4245- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\eff43256-4a46-44cc- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\a3b31170-7da0-424b- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b6a6161e-5cb4-49e0- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e1473e18-4917-4bc5- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\1ff1a76a-9004-4008- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\8950997b-c499-4d6a- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\4442dfbf-c1e0-457b- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\63801e7a-0ef4-4b97- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- RuntimeBroker.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy" RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ff003ece-753f-4a31- RuntimeBroker.exe Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\35205c5b-23f0-4b97- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c0aae89a-b94d-43ad- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\18869554-407b-4146- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\e01810eb-5451-4024- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\d503cd3a-7258-4f06- RuntimeBroker.exe Set value (data) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000058da9e224a26d8013e9be1224a26d8013e9be1224a26d801d35807000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000545403592000613732613134643735303631626462313938666133376339633036656632396265623234303463313036336461373638633632373330383066326263313362320000b20009000400efbe54540359545403592e0000000000000000000000000000000000000000000000000078a8f900610037003200610031003400640037003500300036003100620064006200310039003800660061003300370063003900630030003600650066003200390062006500620032003400300034006300310030003600330064006100370036003800630036003200370033003000380030006600320062006300310033006200320000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea0000001800000003000000ed69aa6d1000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c61373261313464373530363162646231393866613337633963303665663239626562323430346331303633646137363863363237333038306632626331336232000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696263717568710000000000000000bad9b5dc40371b4eb595e9fc647d27d60d3c3ef89083ec1182d0f2d670b75582bad9b5dc40371b4eb595e9fc647d27d60d3c3ef89083ec1182d0f2d670b75582ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003700390030003700310034003400390038002d0031003500340039003400320031003400390031002d0031003600340033003300390037003100330039002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002b5b8d01000000000000d01200000000000000000000000000000000 RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\08575564-2e83-47aa- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ad260dcd-1358-4c8a- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\58d18500-ba43-463a- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\be7985af-2a32-4c92- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ee059171-2c14-410a- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\dab46085-9921-46cb- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\ed72c7f8-1ab7-433c- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\de88a669-9c76-47e3- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\497944cb-8553-4e75- RuntimeBroker.exe Key deleted \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\c3c1c821-b672-4753- RuntimeBroker.exe Set value (int) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\b07463c7-48f4-42cc- = "0" RuntimeBroker.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exeWerFault.exeWerFault.exeWerFault.exepid process 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe 4448 WerFault.exe 4464 WerFault.exe 4448 WerFault.exe 4464 WerFault.exe 3444 WerFault.exe 3444 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exedescription pid process Token: SeDebugPrivilege 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.execmd.exeDllHost.exeWerFault.exeWerFault.exeWerFault.exedescription pid process target process PID 536 wrote to memory of 3740 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe cmd.exe PID 536 wrote to memory of 3740 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe cmd.exe PID 536 wrote to memory of 2236 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe sihost.exe PID 3740 wrote to memory of 3780 3740 cmd.exe reg.exe PID 3740 wrote to memory of 3780 3740 cmd.exe reg.exe PID 536 wrote to memory of 2252 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe svchost.exe PID 536 wrote to memory of 2296 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe taskhostw.exe PID 536 wrote to memory of 2540 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe svchost.exe PID 536 wrote to memory of 2736 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe DllHost.exe PID 536 wrote to memory of 2912 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe StartMenuExperienceHost.exe PID 536 wrote to memory of 2984 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe RuntimeBroker.exe PID 536 wrote to memory of 3068 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe SearchApp.exe PID 536 wrote to memory of 3144 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe RuntimeBroker.exe PID 536 wrote to memory of 3544 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe RuntimeBroker.exe PID 536 wrote to memory of 1836 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe RuntimeBroker.exe PID 536 wrote to memory of 384 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe backgroundTaskHost.exe PID 536 wrote to memory of 2100 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe backgroundTaskHost.exe PID 536 wrote to memory of 2428 536 23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe BackgroundTransferHost.exe PID 2736 wrote to memory of 3444 2736 DllHost.exe WerFault.exe PID 2736 wrote to memory of 3444 2736 DllHost.exe WerFault.exe PID 3376 wrote to memory of 2912 3376 WerFault.exe StartMenuExperienceHost.exe PID 3376 wrote to memory of 2912 3376 WerFault.exe StartMenuExperienceHost.exe PID 3368 wrote to memory of 2736 3368 WerFault.exe DllHost.exe PID 3368 wrote to memory of 2736 3368 WerFault.exe DllHost.exe PID 2360 wrote to memory of 2428 2360 WerFault.exe BackgroundTransferHost.exe PID 2360 wrote to memory of 2428 2360 WerFault.exe BackgroundTransferHost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
- Drops file in Program Files directory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Modifies registry class
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca1⤵
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2912 -s 33122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 10122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2736 -s 10122⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p1⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Users\Admin\AppData\Local\Temp\23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe"C:\Users\Admin\AppData\Local\Temp\23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\23e7c1b52d6ea8adec233eaff38c6a00153de3b99f51b02fe6a297ee5210f9c8.exe" /f3⤵
- Adds Run key to start application
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.11⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2428 -s 21802⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 432 -p 2736 -ip 27361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 472 -p 2912 -ip 29121⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 496 -p 2428 -ip 24281⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\MusNotifyIcon.exe%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 131⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k wusvcs -p1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-130-0x00007FF6B7590000-0x00007FF6B791E000-memory.dmpFilesize
3.6MB
-
memory/2296-131-0x00007FF6B7590000-0x00007FF6B791E000-memory.dmpFilesize
3.6MB
-
memory/2736-133-0x000002A692210000-0x000002A692218000-memory.dmpFilesize
32KB
-
memory/2736-134-0x000002A692020000-0x000002A692021000-memory.dmpFilesize
4KB
-
memory/3544-132-0x00007FF6B7590000-0x00007FF6B791E000-memory.dmpFilesize
3.6MB