Analysis
-
max time kernel
165s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 09:01
Static task
static1
Behavioral task
behavioral1
Sample
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe
Resource
win10v2004-en-20220113
General
-
Target
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe
-
Size
193KB
-
MD5
cfb761465693bd4511f038d8e468e62e
-
SHA1
c8d64b3d2208a3cf40f4d9c182c9829beaa1eb86
-
SHA256
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912
-
SHA512
2622751f9f5ab89287a1d88c9f027a7117549fcd0280f104a598c7953713d32e6ce5adfdd26abec709e1c848b8bc9f50e5226185721a22d2b3573d2d0264d36c
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
Processes:
lsdyXfy.exepid process 268 lsdyXfy.exe -
Loads dropped DLL 2 IoCs
Processes:
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exepid process 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 32 IoCs
Processes:
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exelsdyXfy.exepid process 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 268 lsdyXfy.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 268 lsdyXfy.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 268 lsdyXfy.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe 268 lsdyXfy.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exelsdyXfy.exedescription pid process Token: SeBackupPrivilege 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe Token: SeBackupPrivilege 268 lsdyXfy.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exelsdyXfy.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 1396 wrote to memory of 268 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe lsdyXfy.exe PID 1396 wrote to memory of 268 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe lsdyXfy.exe PID 1396 wrote to memory of 268 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe lsdyXfy.exe PID 1396 wrote to memory of 268 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe lsdyXfy.exe PID 268 wrote to memory of 2136 268 lsdyXfy.exe net.exe PID 1396 wrote to memory of 2144 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 268 wrote to memory of 2136 268 lsdyXfy.exe net.exe PID 1396 wrote to memory of 2144 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 268 wrote to memory of 2136 268 lsdyXfy.exe net.exe PID 1396 wrote to memory of 2144 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 268 wrote to memory of 2136 268 lsdyXfy.exe net.exe PID 1396 wrote to memory of 2144 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2128 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2128 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2128 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2128 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2220 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2220 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2220 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2220 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 268 wrote to memory of 2228 268 lsdyXfy.exe net.exe PID 268 wrote to memory of 2228 268 lsdyXfy.exe net.exe PID 268 wrote to memory of 2228 268 lsdyXfy.exe net.exe PID 268 wrote to memory of 2228 268 lsdyXfy.exe net.exe PID 1396 wrote to memory of 2236 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2236 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2236 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 2236 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 2128 wrote to memory of 2656 2128 net.exe net1.exe PID 2128 wrote to memory of 2656 2128 net.exe net1.exe PID 2128 wrote to memory of 2656 2128 net.exe net1.exe PID 2128 wrote to memory of 2656 2128 net.exe net1.exe PID 2136 wrote to memory of 2664 2136 net.exe net1.exe PID 2136 wrote to memory of 2664 2136 net.exe net1.exe PID 2136 wrote to memory of 2664 2136 net.exe net1.exe PID 2136 wrote to memory of 2664 2136 net.exe net1.exe PID 2144 wrote to memory of 2672 2144 net.exe net1.exe PID 2144 wrote to memory of 2672 2144 net.exe net1.exe PID 2144 wrote to memory of 2672 2144 net.exe net1.exe PID 2144 wrote to memory of 2672 2144 net.exe net1.exe PID 2228 wrote to memory of 2640 2228 net.exe net1.exe PID 2228 wrote to memory of 2640 2228 net.exe net1.exe PID 2228 wrote to memory of 2640 2228 net.exe net1.exe PID 2228 wrote to memory of 2640 2228 net.exe net1.exe PID 2236 wrote to memory of 2680 2236 net.exe net1.exe PID 2236 wrote to memory of 2680 2236 net.exe net1.exe PID 2236 wrote to memory of 2680 2236 net.exe net1.exe PID 2236 wrote to memory of 2680 2236 net.exe net1.exe PID 2220 wrote to memory of 2692 2220 net.exe net1.exe PID 2220 wrote to memory of 2692 2220 net.exe net1.exe PID 2220 wrote to memory of 2692 2220 net.exe net1.exe PID 2220 wrote to memory of 2692 2220 net.exe net1.exe PID 1396 wrote to memory of 36816 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36816 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36816 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36816 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 36816 wrote to memory of 35980 36816 net.exe net1.exe PID 36816 wrote to memory of 35980 36816 net.exe net1.exe PID 36816 wrote to memory of 35980 36816 net.exe net1.exe PID 36816 wrote to memory of 35980 36816 net.exe net1.exe PID 1396 wrote to memory of 36012 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36012 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36012 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe PID 1396 wrote to memory of 36012 1396 2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe"C:\Users\Admin\AppData\Local\Temp\2a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\lsdyXfy.exe"C:\Users\Admin\AppData\Local\Temp\lsdyXfy.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462aMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
d6d77d9000b3decc7ee5b1c70137ce31
SHA1ddaac70c0f89ca1dad8609896f46a1b406815276
SHA256e70be40aecb791c2b2fa0b2475e94bbf2c3d70b015d41d7675b38a94a6e9eaae
SHA51297c3525a0cc41f2d58b7fbe742e76fac365ea0530386cb9b2d891ac918760c64eac643f01823acdd7109d6d548aa40726253c46c242390e230da07685c5d23a9
-
C:\Users\Admin\AppData\Local\Temp\lsdyXfy.exeMD5
cfb761465693bd4511f038d8e468e62e
SHA1c8d64b3d2208a3cf40f4d9c182c9829beaa1eb86
SHA2562a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912
SHA5122622751f9f5ab89287a1d88c9f027a7117549fcd0280f104a598c7953713d32e6ce5adfdd26abec709e1c848b8bc9f50e5226185721a22d2b3573d2d0264d36c
-
\Users\Admin\AppData\Local\Temp\lsdyXfy.exeMD5
cfb761465693bd4511f038d8e468e62e
SHA1c8d64b3d2208a3cf40f4d9c182c9829beaa1eb86
SHA2562a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912
SHA5122622751f9f5ab89287a1d88c9f027a7117549fcd0280f104a598c7953713d32e6ce5adfdd26abec709e1c848b8bc9f50e5226185721a22d2b3573d2d0264d36c
-
\Users\Admin\AppData\Local\Temp\lsdyXfy.exeMD5
cfb761465693bd4511f038d8e468e62e
SHA1c8d64b3d2208a3cf40f4d9c182c9829beaa1eb86
SHA2562a97228a72f59f4a7095efcadf5adf6d2f6365e094b7c3de34348ab38a3e9912
SHA5122622751f9f5ab89287a1d88c9f027a7117549fcd0280f104a598c7953713d32e6ce5adfdd26abec709e1c848b8bc9f50e5226185721a22d2b3573d2d0264d36c
-
memory/268-62-0x000000000E140000-0x000000000EBFA000-memory.dmpFilesize
10.7MB
-
memory/268-63-0x000000000EE40000-0x000000000EF64000-memory.dmpFilesize
1.1MB
-
memory/1396-55-0x0000000075AC1000-0x0000000075AC3000-memory.dmpFilesize
8KB