Analysis
-
max time kernel
169s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
-
submitted
12/03/2024, 14:53
General
-
Target
2024-03-12_f1a9847484806401ae1bcb5849f94607_ryuk.exe
-
Size
691KB
-
MD5
f1a9847484806401ae1bcb5849f94607
-
SHA1
2ff5f5ab4d5a42d221d9e36e779aee66bb9e51e7
-
SHA256
68e3e732019b48203715fa1a3bc05c4ee592e6e902cc0c57382a48b38afe0501
-
SHA512
0db2749e07b2ddb533e4fb61240aceabd6d1ee0a25802b3cdb5d53fcf49cfef4ec16f8a5a01ffc827cd16f709784c797214cc00915006aa70ecd5d6d5f89db37
-
SSDEEP
12288:4racl3u3JW2gh92q5H8k/jLUKciwGEBg/jKypVrtvzESII:aaclkJW2Q2tA+Bg/jNRV
Malware Config
Signatures
-
Executes dropped EXE 22 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Drops file in System32 directory 24 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 64 IoCs
-
Suspicious behavior: EnumeratesProcesses 35 IoCs
-
Suspicious behavior: LoadsDriver 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 42 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2024-03-12_f1a9847484806401ae1bcb5849f94607_ryuk.exe"C:\Users\Admin\AppData\Local\Temp\2024-03-12_f1a9847484806401ae1bcb5849f94607_ryuk.exe"1⤵
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\alg.exeC:\Windows\System32\alg.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exeC:\Windows\system32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p -s TapiSrv1⤵
-
C:\Windows\system32\fxssvc.exeC:\Windows\system32\fxssvc.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\elevation_service.exe"1⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe"1⤵
- Executes dropped EXE
- Drops file in Program Files directory
-
C:\Windows\System32\msdtc.exeC:\Windows\System32\msdtc.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
-
\??\c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"c:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE"1⤵
- Executes dropped EXE
-
C:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exeC:\Windows\system32\PerceptionSimulation\PerceptionSimulationService.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWow64\perfhost.exeC:\Windows\SysWow64\perfhost.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\locator.exeC:\Windows\system32\locator.exe1⤵
- Executes dropped EXE
-
C:\Windows\System32\SensorDataService.exeC:\Windows\System32\SensorDataService.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\snmptrap.exeC:\Windows\System32\snmptrap.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\spectrum.exeC:\Windows\system32\spectrum.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Windows\System32\OpenSSH\ssh-agent.exeC:\Windows\System32\OpenSSH\ssh-agent.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s SharedRealitySvc1⤵
-
C:\Windows\system32\TieringEngineService.exeC:\Windows\system32\TieringEngineService.exe1⤵
- Executes dropped EXE
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\AgentService.exeC:\Windows\system32\AgentService.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\SearchIndexer.exeC:\Windows\system32\SearchIndexer.exe /Embedding1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\SearchProtocolHost.exe"C:\Windows\system32\SearchProtocolHost.exe" Global\UsGthrFltPipeMssGthrPipe1_ Global\UsGthrCtrlFltPipeMssGthrPipe1 1 -2147483646 "Software\Microsoft\Windows Search" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT; MS Search 4.0 Robot)" "C:\ProgramData\Microsoft\Search\Data\Temp\usgthrsvc" "DownLevelDaemon"2⤵
- Modifies data under HKEY_USERS
-
-
C:\Windows\system32\SearchFilterHost.exe"C:\Windows\system32\SearchFilterHost.exe" 0 912 916 924 8192 920 9002⤵
- Modifies data under HKEY_USERS
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.1MB
MD53f08cf219e38d0e6e99658a21fc97eeb
SHA156ce1d1f3c965fbcdd2d902f1d3165c39bf0d389
SHA2565c9f013a7956f51e980e2304f996787e24c02a7a54c5d768bf1f8ece0d0fad3b
SHA51218882453b9b3928585592b7a537122ae249fcfe6a260f340e637b64579f88706b1482116ae8b4989922a71817ee5b25218a679947b29f873dce3fdcd98cab9f6
-
Filesize
781KB
MD53fe6c58fc673b66118fa78b4217b72f5
SHA1edf3ad9fc4764fb8b610d15398594581a6c8991d
SHA256e802cf9e201567c6ff6769364cb76f897ce05b13b7e04ed7c055c3271d9e26bf
SHA51224cc4085f78af012ff18178aecc52ffad1e7a14eeba84134391fbf77a9d099931329a9170aad48d4008908e8045299925d25c4af8edb4df6f5e5691864aa66db
-
Filesize
805KB
MD5a38846279468cff3f066801cffd35a58
SHA1fa9fe8fe345930802d8690fae56ccbfb086cecdc
SHA2568e858da4a8924ffb59dbde9f485b6bdcf1822b4cda3f3db93700aa091afd5a6b
SHA512ed399382693cfe739aec20eaa7f58a4f2fef549bece56826dc7dbd677daede45cd157f059f828c76121c1fa480fbd8db374d1857e0e9d3921a9970b160e3d2ae
-
Filesize
2.1MB
MD53bcf9fb1b7e8d329bb91ec1b712d0cfc
SHA14cd4e51d92850ffec226eb94315aa9913b745f67
SHA256752a36a49983b0b7645194876bb7ad99fc6c2d59a607603c0ddbb816b7ba743a
SHA512a1abf63750e0fc01c687b2428893f8f1dd388d310f1b4f320d42faf18cd08565a7906425685778bff5ebbe2f635eb8b778e4d85fd279d6952f37469e72cafd3d
-
Filesize
588KB
MD5a7ac6dbe143ec7e5b2038b93ba0e4aae
SHA1b30a6091c340b99471a742874e044d5f88dbad42
SHA256b0af6dbf937089a50155bddb600d59fe45808d462638a7603ce9528509c018e1
SHA512124e075991a4857b5002e3d6824620ed1bbe6104fe7492138c47e577dd83228f7bc660b843633e794363e1f71e3e13d175012ace7149c6d3668f1cee12602559
-
Filesize
883KB
MD567222f9795fdcc07b6561351d7abdcaf
SHA1171ae284b7718da2c3bd56a1df6d1e4ee5e85b57
SHA2560d51788a1bfb54069c43c98f84a7ad1720595284d619a1519624378121cd4d02
SHA512960e16e3cef42547459b01a1a83ba36370d0d4aa81a0282d80a3d9daff9c98f64e205ea4420b21167bb0d774fc0bf59b5b5b2fbb4b5edb8fcc678108ed7ba107
-
Filesize
659KB
MD5768e8cb39b55892e3cb1dbd607a0796c
SHA1e604c7bb209df016f162752046b174ef6b14e572
SHA256d372177f098ddd932ad8080feb711b41a13773405432ecf7d9d3ca2cb1a11bf1
SHA512381a7d89d6c9df102fc6a6fed12c0ebff649952e79c967fb186d5b0e3925fe1cd32ed67b9078556f548d49427f01cac08da2bef7d08c401ce4e8f0e82d7c30b5
-
Filesize
1.2MB
MD50ca499b36b7d15f5b0965b13b83339df
SHA111f3df6e6d2d48ea7bf80f0d878b2b94c34489ec
SHA2567f268470d0ca5f02eb03126008f57e927fe5af84e9d98f25a30f77e1d406753d
SHA5128341d735a6bf017704ac21c903e207e6712ddc06e2ae6e15f063c179bd9ebed51c268740d28adcb016bbee893d8a0dec183856e80da516079608f1dbc24f62ea
-
Filesize
578KB
MD515a1f9f302cbb32c72e2de135f5b026f
SHA18e6928c047b4865ca1654c437f58884d8c191122
SHA2560fea02284660b2188650c914c421964124321914c9299bc16bfc36007065e32a
SHA512dd1fccdb74034f04c8bb05f76f5e6baf07acf4f24d469ea3933a649d6476d714006339379452899b67727533477c8f72b829a95a1fe61b33d7de47c2de50aa3e
-
Filesize
940KB
MD58e0b7bdfb1887876aada19d87ba368d3
SHA1e8dfe002ebb29eb468d71aa6424e123eab3b3957
SHA256babeb83c4dad0264b36086ded6d49f122334477c9fdae726c10a9d29ba9dfdec
SHA5125e394d2d5d6a9817a18c8cabd45d020652101851d56492f7d872fd228c051c79b7f5a6225788caef8b550d70b8f5285bd5b5fab8ba1b2636f25f1d89345a8b26
-
Filesize
671KB
MD5e1ed9048da0e72a31dbc20c377e49b34
SHA123e2495635d72be00b398a511ec004c833b76211
SHA256d8d514e52417c5bd22b1772b4606d4a9e7d2c0591a84af58a848c4fb970a9104
SHA512e1405d1dc535574014a93020cc478f6d242facd52aad5898bb23be5eec2ab8e7cc4c51e23e602dc25f3dc902d6a7775440d07d2fef19cb5d3364b22bdb267f08
-
Filesize
1.4MB
MD583b7d11435e10351e96ee9c2414f074e
SHA17a33f3788f222d91f315165f0bc4780dcddf3a3a
SHA256a209828835255de1f3f0a21d2729a84f7e822f3197053af9bcc17afa68d0d035
SHA5127eca2921e5ceddc315c400689b63d5df2b4f1d6fbed814cb632236dfddd3e8ba561f31aa28b5dbcdab8307e65e46367ab10c0054fe9f2852b6fe48a01d801c9a
-
Filesize
1.8MB
MD534d5e4e74013d9ebb816450eb67c37c9
SHA1ad81b4ebd6206a2aa89e3cb6ee75485c81278d7e
SHA2564b912e980bd49f66067826c81560d5ae7f36e93f147c7d92c110a325266d1266
SHA51293a289c1bf4aefabf304bdd5317c69feb5a144d8fd402d92fef013722ed1007865102300b0760c760f77cac60b0a263025487aacad96f29a3682812762775ffd
-
Filesize
1.4MB
MD5a716332020c17e1d326c70a556aec022
SHA1e188f22483e00527736ca2447e0c9cbece8a4233
SHA256b6502d7bad8b94d6cf6f384dc86d20ecd83b99a98db1fc196ca2556d3c11e5cf
SHA5124c406fc48df114a324a4550563eebb74b4810b56e0bfcd4e55d4fc22c04a1dd1fecb8dfd997e626dd9dad1ae4cc2992a9d74ddcba03bf921a9c190f829d17f3d
-
Filesize
885KB
MD5c62ba79c8815a0d5d0feb5d350da7c2e
SHA1d1780e58e585fcf26e9f9cac2f6bccc080cd50e7
SHA256397f0d856d2ae2e19e4319f935e8b94feec154398ffc67761a3fb08a7c17dd85
SHA5121d784ae8250052b48346cd7deacb7208cc52f294c36f2129d9c3787ad93cb8859a6e99e9327e0055dbfd9b595d3fed7b59043f580cdb085deac504ec752f408c
-
Filesize
2.0MB
MD56d77b327f1a588cec662df68bcfbd618
SHA13c7180e1df43e9c2f022a4c19b9574154bd5c714
SHA25647201b87bc99b6112298dff7e60326e055090bf69a6217b4a79ef000cf297238
SHA512236b9e7388273a6edd435d5d7e93a5f4831ec2a4d7443c5cbf48afe311c2a0345ab170090229a18a0801957dbde86b5abfe35b3e2fc2209c41193a7207f14a35
-
Filesize
661KB
MD5a5fc694b44ebc0d10b76301eaab99ae5
SHA13142d5b3f2eabcea5de625367ff5e9e68a15eaae
SHA2560e9e44bb23744f7e987ef80de5ba3bb6466333b9d2d0ad1f743c74c99697c110
SHA5120fb780885645f2b3bc9f6383244c16fe484ddb1f66cedfc75b64c2082989a58d4dc4403b69de564b4f04730db7e7df1fd4375ad360ffc09749c4f3fe43cfc7f8
-
Filesize
712KB
MD500a3cc25487c33f1348059b69c7a3f4c
SHA1b27eb2fa01cac36c9b14cb914c5ab7b4ae0adea1
SHA25669979289e797ff4464882b926b8079a90e643ebbf9f17c88a6656d7822593c2c
SHA5127bfccf3d2d2779c4dbe2ee2926da7dee4fd08565e8561dc40217f798fde34e68a5ffcda837c54bd1b74400894bc78e5d48cf6b9c7f6cbd0af89f38793b45297b
-
Filesize
584KB
MD5e1ddfc559cc2a0df2f2de94f53a6756c
SHA1d1da515043f886cd1c846bff91c4daf2f10d06b5
SHA25685682affcd5ca9d7bb044ebcc966ed4a75ab8b36eb5c94950f314713477cc6c2
SHA51233dcd26c16fde7b28558ae1d203c15f2aaab32100572dbd65afa4f8084d5518876cb37731b4daac8c42be5a002825fd39e09d960b9a14cfaf9dcb2cb622ba2ee
-
Filesize
1.3MB
MD580cd8255eaf36dc0fff938670bb486cb
SHA157090dad1c6e1e9261b7f6c2294d54c8bad9ce39
SHA2567939d3e877eb937824b6193d1d57276efc7918b55db61950b477ed48790dc94d
SHA5120746913437451e753d16fe0427042168d867f392e261d4ccd7be8120f4fa47c607f1bd74af73ac23df276576e1f28303e5e2372486f456139a4d7d74cb40fc10
-
Filesize
772KB
MD5fee82bb9881583313c2bdb383c24b6e2
SHA146dbea09838352ae9c61d6b1ff406c899627800a
SHA256c02caf8a97aaf55fa4b18e071e67a3498d8c788dc39601fc8070b5ca583ea237
SHA512787896e6f48645264406d3c25d74cdac9c9bff7ca584945f69197b2bc9ceed6292a53c96d11dabd5cca9af5ab15f1a31b4c26c45d016e519867db1029d560433
-
Filesize
2.1MB
MD5a9b2f1d1dd72f59df8471e229a21f008
SHA12c73d321ff82f13ec98d75f6fce45400b0c90713
SHA256561e3349cbf6f1ce30d844caa9273358e2ac8861ad33dac9af56b8d9b741cf44
SHA512621b5e8373d398a5f884c37b4d495b403bfed57ef70fe00ab7093a2f8d4d0e4383d239d345bbeecf88728e02e3c895b314e86bf1b6b9f56d289a40bf61e8a4fd
-
Filesize
384KB
-
Filesize
716KB
-
Filesize
716KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
604KB
-
Filesize
604KB
-
Filesize
384KB
-
Filesize
792KB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.0MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
1.8MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
680KB
-
Filesize
596KB
-
Filesize
596KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
684KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
904KB
-
Filesize
904KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
740KB
-
Filesize
740KB
-
Filesize
828KB
-
Filesize
828KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
2.2MB
-
Filesize
2.2MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
600KB
-
Filesize
600KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.2MB
-
Filesize
1.2MB
-
Filesize
384KB
-
Filesize
2.1MB
-
Filesize
384KB
-
Filesize
676KB
-
Filesize
676KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
384KB
-
Filesize
1.4MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
384KB
-
Filesize
808KB
-
Filesize
1.0MB
-
Filesize
384KB
-
Filesize
1.0MB