Malware Analysis Report

2024-09-22 21:59

Sample ID 240510-aszynabb92
Target 2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk
SHA256 bc28a9c3ab8c1e7e13f6634c1eff7bed34d3dec2f5979f25101270303e69d06e
Tags
pyinstaller bitrat execution persistence trojan upx
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK Matrix

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

bc28a9c3ab8c1e7e13f6634c1eff7bed34d3dec2f5979f25101270303e69d06e

Threat Level: Known bad

The file 2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk was found to be: Known bad.

Malicious Activity Summary

pyinstaller bitrat execution persistence trojan upx

BitRAT

UPX dump on OEP (original entry point)

Command and Scripting Interpreter: PowerShell

Executes dropped EXE

Loads dropped DLL

UPX packed file

Checks computer location settings

Adds Run key to start application

Suspicious use of NtSetInformationThreadHideFromDebugger

Detects Pyinstaller

Unsigned PE

Enumerates physical storage devices

Suspicious use of SetWindowsHookEx

Suspicious behavior: EnumeratesProcesses

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Suspicious behavior: CmdExeWriteProcessMemorySpam

MITRE ATT&CK Matrix V13

Analysis: static1

Detonation Overview

Reported

2024-05-10 00:29

Signatures

Detects Pyinstaller

pyinstaller
Description Indicator Process Target
N/A N/A N/A N/A

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-05-10 00:29

Reported

2024-05-10 00:31

Platform

win7-20240221-en

Max time kernel

146s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

Signatures

BitRAT

trojan bitrat

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Windows\CurrentVersion\Run\GoogleFeedback = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe" C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe N/A

Enumerates physical storage devices

Suspicious behavior: CmdExeWriteProcessMemorySpam

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 1440 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe
PID 1440 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe
PID 1440 wrote to memory of 2624 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2680 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2624 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2624 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2624 wrote to memory of 2604 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2604 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe
PID 2604 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe
PID 2604 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe
PID 2604 wrote to memory of 2236 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\Feedback71379'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start /b ChromeFeedback.exe"

C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe

ChromeFeedback.exe

Network

Country Destination Domain Proto
US 23.105.131.220:4898 tcp
US 23.105.131.220:4898 tcp
US 23.105.131.220:4898 tcp
US 23.105.131.220:4898 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI14402\stub.exe.manifest

MD5 70866f37887816cd3fc40eefbceee02d
SHA1 f87d16fe31656f361afab5a9e005fc37189b53d8
SHA256 3a81c3f88bc70a0c97ea2955d5267c6529ac054cd48e2587d3b835428a4725a8
SHA512 a5c9c99bed00d89ea430534e186ca32eef33dbd84da4be30e396917b0821b3fc4d5fb0616944e4f1a31ba5ec26e5a813c1826ba5eb5a3391a8da58e77fa16692

C:\Users\Admin\AppData\Local\Temp\_MEI14402\python27.dll

MD5 4fc438493188550ea7dfb0cc153b4983
SHA1 2e7e79cee5ca14a584c49d7222cecd4a53beac41
SHA256 2ae1f70a99a8f760d3883258f0f69ae759b48270b07036e41b1e887add0c3cfc
SHA512 5f91ddf65fa94129c2e483400327d564a8ce3e3b9dea3a5294fdb6bbd5ee599f89003da8922d1f3904dbab7bd0d4b23fc355f1854e6b34a7f012c1065e88053e

C:\Users\Admin\AppData\Local\Temp\_MEI14402\MSVCR90.dll

MD5 552cf56353af11ce8e0d10ee12fdcd85
SHA1 6ab062b709f851a9576685fe0410ff9f1a4af670
SHA256 e88299ea1a140ff758163dfff179fff3bc5e90e7cfbbd178d0c886dbad184012
SHA512 122f389e7047b728b27f3c964d34b9c8bcae7c36177122e6aa997a6edadad20b14552879f60667a084d34727cb2c85dd5534b6fa7a451f0ab33555b315335457

\Users\Admin\AppData\Local\Temp\_MEI14~1\_ctypes.pyd

MD5 28e5d05ab42adb1e7ada35f1eef1b32b
SHA1 0792867716c8a933305455a2c7f39d30807dad65
SHA256 a93e3bfe62afa5062c6257a7f347d715af346ac3aec7999b8d86a9f2580ec176
SHA512 0cb08ec46068e20a2df3fc0e69bceba5b8a807aeb580002e846d9272fea7a6ee24b8f2c571571677b61dd8c58eb998c26a656193798de5075c6943f6d701c569

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\bz2.pyd

MD5 51fdb7790e680a394e9936498d3a73fa
SHA1 fab9f97feee68fbd9225de051349ac3258920fa2
SHA256 985902e0813564981059c2f57282614f5a907dc3df0273ba7bef2ad64123c921
SHA512 594153dd913a3369d310980b0e53bc6a10174e18b0b416dc1b86b2401b4bd94546bee9fbde7421e102490ccba4c8a8d7b91b3df5e3c0506cc98b51bc63e15c50

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_hashlib.pyd

MD5 6f784c403e2097d11331f8778f6d9d2c
SHA1 64ecd6ee875f89a88204e673acae9547992fd085
SHA256 cda9a6478417629cb40809aad57bd5a884f183333506d00008d16e47368fd633
SHA512 c1fbd548f03a46ee19cd003831bcb53df204cd1c71ab672955a2ff19267c523a17970f8fb9586e712665c09b54c19338037a38a425dacb857aae5b6162fa282c

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\win32api.pyd

MD5 3f889f9a8a4f8cc29b517eaeb9053cca
SHA1 778a65edd208e6dcccc27b33a8b09a298f59d42d
SHA256 eb1d362015f2a200377f9e8efdc42b72d9f70a71f98e96bc6b990920e817af32
SHA512 775b9fb7217fa050adc80c6c279eb2180411b4c6fa018619306ff580492083f0e9420378cba2d7cc825dc1184d9b06e9cf8fc29342dc9164b37fbb1823cd63cb

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\pywintypes27.dll

MD5 9db2c540bcad7b91a6bc09d3d5e71204
SHA1 a9213bec75751f3fc6ea7993f0c3432286e732a7
SHA256 cdf44ce54415aba1fad74eecbbee716372ce8e8d75b9ea9559103f2794a4b325
SHA512 9185bc4c66e067909303c17564a634769faca4247e9124792cee9670c585aa788c007576b529131f66e96fa798a3f2b78b7b91e9c0ac0631ba0e6686673fcc7a

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\pythoncom27.dll

MD5 175b37a400e879e09006d3687c741a98
SHA1 4db47da99d839487920e4a5c93433e6fd6345a70
SHA256 2aecf1ab948d3de9e213cd3248593c7d486d0939302b1a87aaeafd70d2d1ff50
SHA512 d5772bf9d7276f0cd29eccb0437f1d0e9a924ef65078ac2c68458bfca40a5e59d68e7b9b6c3df2115440afc031fefb4dcc90eb4a4e6ea23904d85dae3c643b3c

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\cryptography.hazmat.bindings._padding.pyd

MD5 7f61f37bd763aa32dc7770281333bc5b
SHA1 df119f5ef64122b6e8378ffb1c513ac1a2d4325a
SHA256 72cfea68038945bcb4069453fa5072bc0cb0c78a1a57b95013925711fa0280da
SHA512 f500382c669f06367e50cce5c95a1afe28fdc50c1d9da2986ec9f33911419448e8f18e5a1a07cff7e506baf1d7e4e5ca34e8e6e180078d675b6022a699e55082

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_cffi_backend.pyd

MD5 acd2c9a776a26eed771c3070d16bfb22
SHA1 e2e43e88bcb90a07f0bfce239f55f50144354c87
SHA256 b50fb7daf92337d0ca2a73fe4b438dc623e29ccea9a480893735bf9d9956f945
SHA512 e1f18f773f62ddda8d9f93b67f8df4b07d7008dc67f39350392994bdc5f19a1cd8bbd2701273be5e492065567a64b5445948b97d6b79b689f5e89d8ec7de01ea

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_socket.pyd

MD5 f28dc3a4451c29fea272d7ae063425c5
SHA1 ece376146a7115cd5b1ad141a59fff25b6da6a5d
SHA256 a75aa54781de3c97f5b4c2e0389d5ad39602cda6fcd5a3810667a4cf24f4286a
SHA512 746b1b608c457cdf8aa784683533e1220c60dd689f7f5266013f1194e9fd091123eb11d697119b9de65686019176062eb9aba04d2845930369829182a399b5e5

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\_ssl.pyd

MD5 9c6d526768f8395aecff0af0d27f0063
SHA1 a580e2782c31ffb9365ea31dce8b337aae9eee07
SHA256 2c4cb4459c37a2152698e19f27350a7dbf56c51509689b1d7a65c60fb5a75751
SHA512 52bc14aa9f6bb6822740b7be98187fba1adf86f484e130ac6df3fad6e456b41288cbb9c8abf9d7af8730e9c0f7438ed362582ee7f39a5cab9cf471bb5b84b9eb

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\win32com.shell.shell.pyd

MD5 f6d8cbe92d6718c9b82dc430d9f2dc2c
SHA1 17799d60eb0f7fa0d6b62e4675d6c0804a741f06
SHA256 1eee192f89b464cbe549880ac996b682f1f08b0ef0da3e121de56c39b274c2b9
SHA512 44c36a53a22a2f5b439603fd3a1f2b97b9bb19ce0e50d5694a181322e37926ccaee3691aee92620efcc84ceaee5e892a28e5ef7751f351e47f164b6a2cf3869a

memory/2680-72-0x000007FEF52EE000-0x000007FEF52EF000-memory.dmp

memory/2680-75-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

memory/2680-74-0x0000000002410000-0x0000000002418000-memory.dmp

memory/2680-76-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

memory/2680-73-0x000000001B230000-0x000000001B512000-memory.dmp

memory/2680-77-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

memory/2680-78-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

memory/2680-79-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

memory/2680-80-0x000007FEF5030000-0x000007FEF59CD000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI14~1\cryptography.hazmat.bindings._openssl.pyd

MD5 66bf25813d69a9b4bb06981c10668297
SHA1 023292b47bef8b79baec632c0781d238229d57a0
SHA256 4988832e7ca44409dbd14be25e975999d57a9e3a0d1ec85a3b981db0895c8443
SHA512 cba9a18838a985ff7146b8e063bd7f76c544d95fb96d91f888307393f809d98a4f5d72cd600d957f69301f8263554691b4df25f4c63b9203ff4c1f0199ea69ca

C:\Users\Admin\AppData\Local\Temp\Feedback71379\ChromeFeedback.exe

MD5 dd8a1809e34323c3077c1535e1665773
SHA1 7e0a2425222bfa964bae67e190025a78439ed3b0
SHA256 3286282e3001adaef2f975c176a7f4b998707cfc0a813caeb54fe0bd01ab15db
SHA512 72d3f4802b59efb0f273d6e7054ef5ba97e58e0674278af0c5a522a463f02ad3fa29cae30e9876629565f84fbafdf799b97da0b20618b5e5d8097b132b3b0dba

memory/2236-86-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2236-111-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2236-113-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2236-117-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2236-120-0x0000000000400000-0x00000000007E4000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-05-10 00:29

Reported

2024-05-10 00:31

Platform

win10v2004-20240426-en

Max time kernel

144s

Max time network

151s

Command Line

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

Signatures

BitRAT

trojan bitrat

UPX dump on OEP (original entry point)

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Command and Scripting Interpreter: PowerShell

execution
Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Checks computer location settings

Description Indicator Process Target
Key value queried \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\Control Panel\International\Geo\Nation C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe N/A

UPX packed file

upx
Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\GoogleFeedback = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe" C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe N/A

Enumerates physical storage devices

Suspicious behavior: EnumeratesProcesses

Description Indicator Process Target
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
N/A N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe N/A
Token: SeShutdownPrivilege N/A C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe N/A

Suspicious use of SetWindowsHookEx

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 784 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe
PID 784 wrote to memory of 2092 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe
PID 2092 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 3148 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
PID 2092 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\system32\cmd.exe
PID 2092 wrote to memory of 224 N/A C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe C:\Windows\system32\cmd.exe
PID 224 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe
PID 224 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe
PID 224 wrote to memory of 2436 N/A C:\Windows\system32\cmd.exe C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe

Processes

C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe

"C:\Users\Admin\AppData\Local\Temp\2024-05-10_3d70017a2b6d0c6859d7004b651a5d7a_ryuk.exe"

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe

"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" /c Add-MpPreference -ExclusionPath 'c:\users\admin\appdata\local\temp\Feedback406701'

C:\Windows\system32\cmd.exe

C:\Windows\system32\cmd.exe /c "start /b ChromeFeedback.exe"

C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe

ChromeFeedback.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 232.168.11.51.in-addr.arpa udp
US 8.8.8.8:53 0.204.248.87.in-addr.arpa udp
US 8.8.8.8:53 g.bing.com udp
US 204.79.197.237:443 g.bing.com tcp
BE 88.221.83.227:443 www.bing.com tcp
US 8.8.8.8:53 69.31.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
US 8.8.8.8:53 237.197.79.204.in-addr.arpa udp
US 8.8.8.8:53 227.83.221.88.in-addr.arpa udp
BE 88.221.83.227:443 www.bing.com tcp
US 8.8.8.8:53 241.150.49.20.in-addr.arpa udp
US 8.8.8.8:53 26.165.165.52.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
US 8.8.8.8:53 101.58.20.217.in-addr.arpa udp
US 23.105.131.220:4898 tcp
US 8.8.8.8:53 240.221.184.93.in-addr.arpa udp
US 23.105.131.220:4898 tcp
US 8.8.8.8:53 88.156.103.20.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 tse1.mm.bing.net udp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 204.79.197.200:443 tse1.mm.bing.net tcp
US 8.8.8.8:53 200.197.79.204.in-addr.arpa udp
US 23.105.131.220:4898 tcp
US 23.105.131.220:4898 tcp

Files

C:\Users\Admin\AppData\Local\Temp\_MEI7842\stub.exe.manifest

MD5 70866f37887816cd3fc40eefbceee02d
SHA1 f87d16fe31656f361afab5a9e005fc37189b53d8
SHA256 3a81c3f88bc70a0c97ea2955d5267c6529ac054cd48e2587d3b835428a4725a8
SHA512 a5c9c99bed00d89ea430534e186ca32eef33dbd84da4be30e396917b0821b3fc4d5fb0616944e4f1a31ba5ec26e5a813c1826ba5eb5a3391a8da58e77fa16692

C:\Users\Admin\AppData\Local\Temp\_MEI7842\python27.dll

MD5 4fc438493188550ea7dfb0cc153b4983
SHA1 2e7e79cee5ca14a584c49d7222cecd4a53beac41
SHA256 2ae1f70a99a8f760d3883258f0f69ae759b48270b07036e41b1e887add0c3cfc
SHA512 5f91ddf65fa94129c2e483400327d564a8ce3e3b9dea3a5294fdb6bbd5ee599f89003da8922d1f3904dbab7bd0d4b23fc355f1854e6b34a7f012c1065e88053e

C:\Users\Admin\AppData\Local\Temp\_MEI7842\_ctypes.pyd

MD5 28e5d05ab42adb1e7ada35f1eef1b32b
SHA1 0792867716c8a933305455a2c7f39d30807dad65
SHA256 a93e3bfe62afa5062c6257a7f347d715af346ac3aec7999b8d86a9f2580ec176
SHA512 0cb08ec46068e20a2df3fc0e69bceba5b8a807aeb580002e846d9272fea7a6ee24b8f2c571571677b61dd8c58eb998c26a656193798de5075c6943f6d701c569

C:\Users\Admin\AppData\Local\Temp\_MEI7842\bz2.pyd

MD5 51fdb7790e680a394e9936498d3a73fa
SHA1 fab9f97feee68fbd9225de051349ac3258920fa2
SHA256 985902e0813564981059c2f57282614f5a907dc3df0273ba7bef2ad64123c921
SHA512 594153dd913a3369d310980b0e53bc6a10174e18b0b416dc1b86b2401b4bd94546bee9fbde7421e102490ccba4c8a8d7b91b3df5e3c0506cc98b51bc63e15c50

C:\Users\Admin\AppData\Local\Temp\_MEI7842\_hashlib.pyd

MD5 6f784c403e2097d11331f8778f6d9d2c
SHA1 64ecd6ee875f89a88204e673acae9547992fd085
SHA256 cda9a6478417629cb40809aad57bd5a884f183333506d00008d16e47368fd633
SHA512 c1fbd548f03a46ee19cd003831bcb53df204cd1c71ab672955a2ff19267c523a17970f8fb9586e712665c09b54c19338037a38a425dacb857aae5b6162fa282c

C:\Users\Admin\AppData\Local\Temp\_MEI7842\win32api.pyd

MD5 3f889f9a8a4f8cc29b517eaeb9053cca
SHA1 778a65edd208e6dcccc27b33a8b09a298f59d42d
SHA256 eb1d362015f2a200377f9e8efdc42b72d9f70a71f98e96bc6b990920e817af32
SHA512 775b9fb7217fa050adc80c6c279eb2180411b4c6fa018619306ff580492083f0e9420378cba2d7cc825dc1184d9b06e9cf8fc29342dc9164b37fbb1823cd63cb

C:\Users\Admin\AppData\Local\Temp\_MEI7842\pywintypes27.dll

MD5 9db2c540bcad7b91a6bc09d3d5e71204
SHA1 a9213bec75751f3fc6ea7993f0c3432286e732a7
SHA256 cdf44ce54415aba1fad74eecbbee716372ce8e8d75b9ea9559103f2794a4b325
SHA512 9185bc4c66e067909303c17564a634769faca4247e9124792cee9670c585aa788c007576b529131f66e96fa798a3f2b78b7b91e9c0ac0631ba0e6686673fcc7a

C:\Users\Admin\AppData\Local\Temp\_MEI7842\pythoncom27.dll

MD5 175b37a400e879e09006d3687c741a98
SHA1 4db47da99d839487920e4a5c93433e6fd6345a70
SHA256 2aecf1ab948d3de9e213cd3248593c7d486d0939302b1a87aaeafd70d2d1ff50
SHA512 d5772bf9d7276f0cd29eccb0437f1d0e9a924ef65078ac2c68458bfca40a5e59d68e7b9b6c3df2115440afc031fefb4dcc90eb4a4e6ea23904d85dae3c643b3c

C:\Users\Admin\AppData\Local\Temp\_MEI7842\cryptography.hazmat.bindings._padding.pyd

MD5 7f61f37bd763aa32dc7770281333bc5b
SHA1 df119f5ef64122b6e8378ffb1c513ac1a2d4325a
SHA256 72cfea68038945bcb4069453fa5072bc0cb0c78a1a57b95013925711fa0280da
SHA512 f500382c669f06367e50cce5c95a1afe28fdc50c1d9da2986ec9f33911419448e8f18e5a1a07cff7e506baf1d7e4e5ca34e8e6e180078d675b6022a699e55082

C:\Users\Admin\AppData\Local\Temp\_MEI7842\_cffi_backend.pyd

MD5 acd2c9a776a26eed771c3070d16bfb22
SHA1 e2e43e88bcb90a07f0bfce239f55f50144354c87
SHA256 b50fb7daf92337d0ca2a73fe4b438dc623e29ccea9a480893735bf9d9956f945
SHA512 e1f18f773f62ddda8d9f93b67f8df4b07d7008dc67f39350392994bdc5f19a1cd8bbd2701273be5e492065567a64b5445948b97d6b79b689f5e89d8ec7de01ea

C:\Users\Admin\AppData\Local\Temp\_MEI7842\_socket.pyd

MD5 f28dc3a4451c29fea272d7ae063425c5
SHA1 ece376146a7115cd5b1ad141a59fff25b6da6a5d
SHA256 a75aa54781de3c97f5b4c2e0389d5ad39602cda6fcd5a3810667a4cf24f4286a
SHA512 746b1b608c457cdf8aa784683533e1220c60dd689f7f5266013f1194e9fd091123eb11d697119b9de65686019176062eb9aba04d2845930369829182a399b5e5

C:\Users\Admin\AppData\Local\Temp\_MEI7842\_ssl.pyd

MD5 9c6d526768f8395aecff0af0d27f0063
SHA1 a580e2782c31ffb9365ea31dce8b337aae9eee07
SHA256 2c4cb4459c37a2152698e19f27350a7dbf56c51509689b1d7a65c60fb5a75751
SHA512 52bc14aa9f6bb6822740b7be98187fba1adf86f484e130ac6df3fad6e456b41288cbb9c8abf9d7af8730e9c0f7438ed362582ee7f39a5cab9cf471bb5b84b9eb

C:\Users\Admin\AppData\Local\Temp\_MEI7842\win32com.shell.shell.pyd

MD5 f6d8cbe92d6718c9b82dc430d9f2dc2c
SHA1 17799d60eb0f7fa0d6b62e4675d6c0804a741f06
SHA256 1eee192f89b464cbe549880ac996b682f1f08b0ef0da3e121de56c39b274c2b9
SHA512 44c36a53a22a2f5b439603fd3a1f2b97b9bb19ce0e50d5694a181322e37926ccaee3691aee92620efcc84ceaee5e892a28e5ef7751f351e47f164b6a2cf3869a

memory/3148-66-0x00007FFFD2C03000-0x00007FFFD2C05000-memory.dmp

memory/3148-67-0x0000026CEF2D0000-0x0000026CEF2F2000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_xbx5hrcv.rcj.ps1

MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

memory/3148-77-0x00007FFFD2C00000-0x00007FFFD36C1000-memory.dmp

memory/3148-78-0x00007FFFD2C00000-0x00007FFFD36C1000-memory.dmp

memory/3148-81-0x00007FFFD2C00000-0x00007FFFD36C1000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\_MEI7842\cryptography.hazmat.bindings._openssl.pyd

MD5 66bf25813d69a9b4bb06981c10668297
SHA1 023292b47bef8b79baec632c0781d238229d57a0
SHA256 4988832e7ca44409dbd14be25e975999d57a9e3a0d1ec85a3b981db0895c8443
SHA512 cba9a18838a985ff7146b8e063bd7f76c544d95fb96d91f888307393f809d98a4f5d72cd600d957f69301f8263554691b4df25f4c63b9203ff4c1f0199ea69ca

memory/2436-88-0x0000000000400000-0x00000000007E4000-memory.dmp

C:\Users\Admin\AppData\Local\Temp\Feedback406701\ChromeFeedback.exe

MD5 dd8a1809e34323c3077c1535e1665773
SHA1 7e0a2425222bfa964bae67e190025a78439ed3b0
SHA256 3286282e3001adaef2f975c176a7f4b998707cfc0a813caeb54fe0bd01ab15db
SHA512 72d3f4802b59efb0f273d6e7054ef5ba97e58e0674278af0c5a522a463f02ad3fa29cae30e9876629565f84fbafdf799b97da0b20618b5e5d8097b132b3b0dba

memory/2436-114-0x0000000074F20000-0x0000000074F59000-memory.dmp

memory/2436-115-0x00000000752A0000-0x00000000752D9000-memory.dmp

memory/2436-116-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2436-118-0x00000000752A0000-0x00000000752D9000-memory.dmp

memory/2436-119-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2436-123-0x00000000752A0000-0x00000000752D9000-memory.dmp

memory/2436-124-0x0000000000400000-0x00000000007E4000-memory.dmp

memory/2436-127-0x00000000752A0000-0x00000000752D9000-memory.dmp

memory/2436-128-0x0000000000400000-0x00000000007E4000-memory.dmp