9718cc27d68fe51a74561ecbbdf61686213e239ae6e79a22a12011306511c651

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
15/03/2024, 09:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Size

1.7MB
MD5

ed1d2f93d5c2dd803b3868d924ca7047
SHA1

ab6d397d804ae90afcbfc70b1c3379938936c52e
SHA256

9718cc27d68fe51a74561ecbbdf61686213e239ae6e79a22a12011306511c651
SHA512

978905fd6491406a34e8bed4efd7601ac2fca94e31d88b310d6a7bf8d08cc1f50abd2ea8a0a342ac1c73a99ea8a9e21b5c40b1526b58795b2d83397581755217
SSDEEP

24576:9iBEkWqwXeAVmYg/TwSfVcYG3K/cJHlnFR+IGNe8j3Iz:xz5Xe6XgLNiXicJFFRGNzj3

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4760	alg.exe

Registers COM server for autorun 1 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe\""	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\alg.exe	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe

Modifies registry class 52 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR\ = "C:\\Users\\Admin\\AppData\\Local\\Temp"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LocalService = "cphs"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\Programmable	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\ = "CphsSession Class"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\IntelCpHeciSvc.EXE\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\ = "CphsSession Class"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CurVer\ = "IntelCpHeciSvc.CphsSession.1"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ = "CphsSession Class"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\LaunchPermission = 010014809c000000ac000000140000003000000002001c0001000000110014000400000001010000000000100010000002006c0003000000000014000b000000010100000000000100000000000018000b000000010200000000000f0200000001000000000038000b000000010a00000000000f0300000000040000ce4a9359b9cf0b7575c0f29bb2b4c298d446ddf9027a87ec14651177d6e996550102000000000005200000002002000001020000000000052000000020020000	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\TypeLib	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\FLAGS\ = "0"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0\win64	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID\ = "{C41B1461-3F8C-4666-B512-6DF24DE566D1}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\AppID\{11AC3232-E7D7-49CD-ABFE-501700100B3A}\ = "IntelCpHeciSvc"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\AppID = "{11AC3232-E7D7-49CD-ABFE-501700100B3A}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\ = "IntelCpHeciSvcLib"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\0	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0\HELPDIR	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\ = "{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\ProgID\ = "IntelCpHeciSvc.CphsSession.1"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\VersionIndependentProgID\ = "IntelCpHeciSvc.CphsSession"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{C41B1461-3F8C-4666-B512-6DF24DE566D1}\LocalServer32\ = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe\""	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ = "ICphsSession"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\TypeLib\Version = "1.0"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession.1\CLSID	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\IntelCpHeciSvc.CphsSession\CLSID	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{66DBA565-0D3D-4D8A-9391-A2A4CF16DF40}\1.0	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{A91E0BDD-79B0-42C5-A3A0-5BE434329577}\ProxyStubClsid32\ = "{00020424-0000-0000-C000-000000000046}"	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4452	2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe

C:\Users\Admin\AppData\Local\Temp\2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-15_ed1d2f93d5c2dd803b3868d924ca7047_ryuk.exe"
1⤵
- Registers COM server for autorun
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4452

C:\Windows\System32\alg.exe
C:\Windows\System32\alg.exe
1⤵
- Executes dropped EXE
PID:4760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System32\alg.exe

Filesize
1.3MB

MD5
aa5cc1fd78403b20d132c14f6d451402

SHA1
9bfaa85da3bb3ecc3c95ff334b9da68df42bca3d

SHA256
9dd91b21ac6399f7dde639dc6fd07835d47393b4c20cb3badbed38ae1f78722c

SHA512
0d2927ff8ac79161d6debb2bde6a4747f0f92a110fbf8ce60782f36330198be40a33b93885641c75dbadf4af0d7a4cfd484254dee311c6190a68cdcc18989b9b

Download Submit
memory/4452-0-0x00000000020B0000-0x0000000002110000-memory.dmp

Filesize
384KB

Download
memory/4452-1-0x0000000140000000-0x0000000140263000-memory.dmp

Filesize
2.4MB

Download
memory/4452-8-0x00000000020B0000-0x0000000002110000-memory.dmp

Filesize
384KB

Download
memory/4452-12-0x00000000020B0000-0x0000000002110000-memory.dmp

Filesize
384KB

Download
memory/4452-14-0x0000000140000000-0x0000000140263000-memory.dmp

Filesize
2.4MB

Download
memory/4760-16-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download
memory/4760-17-0x0000000140000000-0x0000000140201000-memory.dmp

Filesize
2.0MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads