Analysis
-
max time kernel
1s -
max time network
90s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
-
submitted
10-01-2024 05:57
General
-
Target
2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe
-
Size
1.1MB
-
MD5
8fad5909fa55c7230235da604a6ea6b2
-
SHA1
4b8959103aad431f95e425431a14205999d5514e
-
SHA256
1ad0ff543542701cf58816ff9a7451d89b71e9aa23c95a8d39fccc600c3f6411
-
SHA512
525b3398460ec92cdb8b483eb215442a047bcbb93505914496045444ec87b731ae1249c8e6f6fcc0d3c0984704ac7dba799529fbc15c943a0773c415981a2ba4
-
SSDEEP
24576:sSi1SoCU5qJSr1eWPSCsP0MugC6eTFt/sBlDqgZQd6XKtiMJYiPU:ES7PLjeTn/snji6attJM
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
-
Drops file in System32 directory 8 IoCs
-
Drops file in Program Files directory 5 IoCs
-
Drops file in Windows directory 1 IoCs
-
Modifies data under HKEY_USERS 5 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-01-09_8fad5909fa55c7230235da604a6ea6b2_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 8962⤵
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
79KB
MD59331eccfeb449d101cf374012c488f63
SHA104f2163867bdbe19d72f3761c133e59f11623805
SHA2563370305303f865012addde772d32148f593a1d88f7c7c7a8fe43b0637b9f8e50
SHA51254e447500321b10995c25c560deb58c44607f543498bbc0734efe99622317838b7b8a86ef3b85058fa3c0e3d206d5696dab04a2779523a9f14f4d74a65fd027f
-
Filesize
51KB
MD5266dd88907f2547f30c6a188003b8ee9
SHA1796e812855c81b177ac9a50d9cdebaaa0d61e469
SHA2567e2d2e50ed580a658a64e9ee960ac562cc13c4ecb0184313ed3e064b4119e51e
SHA51240c28ceeba2f177e8489cac5419d60a51f8e265e92638e43b83e4e6ea1f6ba29e258ffa79625823e85575d8a63b36ad7846827f94c4c61485a9751e7aef7abfa
-
Filesize
160KB
MD5ffc8b844743b23a8575b6d6cd98db68b
SHA1ab244a886981e75aadc68ad16b99e09cadfdbe52
SHA2567b2db1b9d1807252beb981e94e0b44f28500dc93f8e0682b6ac8ee140c0955e1
SHA512663951f0a4409c030808ea45949c3ceef1b9d1ae1ad1c90d0078f0e1bbc750bec74fdbb95a80079ccdf9d5c3fef95dd30c41881be937109eaeb68a999b830414
-
Filesize
124KB
MD53db7c7413b4d9e36e77920fb8ad4dacd
SHA1a69ed803b31a0fcd527f77f9bd69590b56d7938b
SHA25637b26bfc7acf063b6a4f1039c4dd32d908d0a28100f6bca825f9aee15e6f702a
SHA512c904b26181736b2b0768dad9190b3bc5210911be359da1bc80d0d56dca625d46c5831212176956090e91bc2d6c7f91ff6bb5a1266b35fc78a89cb515e446e398
-
Filesize
42KB
MD565b9cedc7b218b0b1104bbf27c73e809
SHA15e805d01f7fbf37770809fb821d4cf68ba7f2314
SHA256af07304b5a7ff27a4c5fbb74ca05cf0f330d10870d1105f47dd747e5d1c0f669
SHA512b181976eafa037ac1b8415d5b8eeda2b2e3297355cbf9ac895ccd2222a609217009a5290122b878cdbdf9746d6e01d4325d50fdb8b877211fc6d29c651925cfb
-
Filesize
9KB
MD55d6d3ba5649366ea9deb19d3172d802a
SHA108fe9c22900aeff247854bd82523c8dd0a16a537
SHA256b108d20e234862fd1b9354b6858fc6a1bcd6c9c3c792e3f72532966f5025eab6
SHA512a4a4a5f214055e62c3ff0dfe28a7585a2a32495e05b17e518214d4ac851ad9287c48a0a6f1c4254a02c98ea5258e83423915ee84f2836587ba6ce9a4dea0bd01
-
Filesize
143KB
MD5d197513f630bd7ede2459942041096a3
SHA11adf09beed465f29ea5ad5f631ddc7e1ddf68fd1
SHA256e983d79d465875bd06ad87c0e9194976df2b9a863f127d1d9e0f3e0ac7ca440b
SHA5120363ab2537b2db208317a7403653c44bec1b835e0c616711afbb98a37cb91a5d50edf6ae8739534f07261a8fb5eb1cba4edb09d536e188b1dc5ae1b8bad4df9f
-
Filesize
71KB
MD59fff01fc98a57dd2c662a28c76270465
SHA157271aac64b5ea9f2499d79d1088be2a45ccbd36
SHA2566a1063b9b04f5ba93099608232c45fc67eb59d00a9768668d1534aabad38a0e9
SHA5124ef67ed4a9811bc4506ffefb2165f3aac9d2733b0ea3f0425ef1b8c36f44d90b07c160a19b7d3c08eabd9ca11712c9fa0be18469b4060d7af0f62fd335bcbfd2
-
Filesize
1.1MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.1MB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
828KB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
412KB
-
Filesize
604KB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
1.3MB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
1.5MB
-
Filesize
384KB
-
Filesize
64KB
-
Filesize
64KB