Analysis
-
max time kernel
149s -
max time network
78s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
22-02-2021 05:56
Static task
static1
Behavioral task
behavioral1
Sample
2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe
-
Size
314KB
-
MD5
89e60fff097ebf9b27bc8aa9b1564da0
-
SHA1
9a1755bcfb3496290333f33b1b0b738016b868bf
-
SHA256
2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79
-
SHA512
a471d4ad11bb4fdb2adcf988a133a53a7b3b536681f421e1c13047bbfeeacfef3a232689de215a8bf81e55515c5cf92081e0b41893c56712bf328aae67de8055
Score
10/10
Malware Config
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1404 OhQzGUSfQrep.exe 1624 LhxiNSQGplan.exe 2584 wKHRqRNwnlan.exe -
Loads dropped DLL 3 IoCs
pid Process 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2640 icacls.exe 2652 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\toc.xml 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-execution.xml_hidden 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0217698.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ecf.provider.filetransfer_3.2.200.v20140827-1444.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_ja_4.4.0.v20140623020002.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.osgi.nl_ja_4.4.0.v20140623020002.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0241077.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Shatter\NavigationUp_SelectionSubpicture.png 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\accessibility.properties 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-keyring-impl_ja.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pt_PT\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.commands_3.6.100.v20140528-1422.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\javax.inject_1.0.0.v20091030.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Memo.emf 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Argentina\Catamarca 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CONCRETE\PREVIEW.GIF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\en-US\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14794_.GIF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15073_.GIF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\dtplugin\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\ext\zipfs.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341447.JPG 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_Casual.gif 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_SlateBlue.gif 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\stream_out\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0222017.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\POWERPNT.DEV_F_COL.HXK 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0149407.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\cue.luac 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02094_.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Urban.eftx 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0305493.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Pacific\Galapagos 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD15072_.GIF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Solutions_Person.css 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\symbols\ja-jp-sym.xml 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\etc\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\7-Zip\Lang\th.txt 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\bin\NetworkServerControl.bat 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-core.xml 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\OUTLOOK.DEV.HXS 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.core_5.5.0.165303\feature.properties 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-sa_ja.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jre7\lib\images\cursors\win32_LinkDrop32x32.gif 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\review_same_reviewers.gif 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\eclipse.inf 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-views_ja.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Microsoft Office\RyukReadMe.html 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00130_.GIF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0088542.WMF 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sq\LC_MESSAGES\vlc.mo 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.jface.text.nl_zh_4.4.0.v20140623020002.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\macTSFrame.png 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\THMBNAIL.PNG 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.workbench.swt_0.12.100.v20140530-1436.jar 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1044 wrote to memory of 1404 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 29 PID 1044 wrote to memory of 1404 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 29 PID 1044 wrote to memory of 1404 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 29 PID 1044 wrote to memory of 1404 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 29 PID 1044 wrote to memory of 1624 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 30 PID 1044 wrote to memory of 1624 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 30 PID 1044 wrote to memory of 1624 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 30 PID 1044 wrote to memory of 1624 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 30 PID 1044 wrote to memory of 2584 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 31 PID 1044 wrote to memory of 2584 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 31 PID 1044 wrote to memory of 2584 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 31 PID 1044 wrote to memory of 2584 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 31 PID 1044 wrote to memory of 2640 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 32 PID 1044 wrote to memory of 2640 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 32 PID 1044 wrote to memory of 2640 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 32 PID 1044 wrote to memory of 2640 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 32 PID 1044 wrote to memory of 2652 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 33 PID 1044 wrote to memory of 2652 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 33 PID 1044 wrote to memory of 2652 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 33 PID 1044 wrote to memory of 2652 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 33 PID 1044 wrote to memory of 2856 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 36 PID 1044 wrote to memory of 2856 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 36 PID 1044 wrote to memory of 2856 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 36 PID 1044 wrote to memory of 2856 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 36 PID 1044 wrote to memory of 2720 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 39 PID 1044 wrote to memory of 2720 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 39 PID 1044 wrote to memory of 2720 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 39 PID 1044 wrote to memory of 2720 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 39 PID 1044 wrote to memory of 2920 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 38 PID 1044 wrote to memory of 2920 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 38 PID 1044 wrote to memory of 2920 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 38 PID 1044 wrote to memory of 2920 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 38 PID 2920 wrote to memory of 2764 2920 net.exe 43 PID 2920 wrote to memory of 2764 2920 net.exe 43 PID 2920 wrote to memory of 2764 2920 net.exe 43 PID 2920 wrote to memory of 2764 2920 net.exe 43 PID 2856 wrote to memory of 2612 2856 net.exe 44 PID 2856 wrote to memory of 2612 2856 net.exe 44 PID 2856 wrote to memory of 2612 2856 net.exe 44 PID 2856 wrote to memory of 2612 2856 net.exe 44 PID 2720 wrote to memory of 2636 2720 net.exe 42 PID 2720 wrote to memory of 2636 2720 net.exe 42 PID 2720 wrote to memory of 2636 2720 net.exe 42 PID 2720 wrote to memory of 2636 2720 net.exe 42 PID 1044 wrote to memory of 2724 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 45 PID 1044 wrote to memory of 2724 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 45 PID 1044 wrote to memory of 2724 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 45 PID 1044 wrote to memory of 2724 1044 2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe 45 PID 2724 wrote to memory of 2600 2724 net.exe 47 PID 2724 wrote to memory of 2600 2724 net.exe 47 PID 2724 wrote to memory of 2600 2724 net.exe 47 PID 2724 wrote to memory of 2600 2724 net.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe"C:\Users\Admin\AppData\Local\Temp\2ffa792d22c729a6c092b7a7cc8b7fb2de567c2d370fb6a2e6f4e7ffca74fe79.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\OhQzGUSfQrep.exe"C:\Users\Admin\AppData\Local\Temp\OhQzGUSfQrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1404
-
-
C:\Users\Admin\AppData\Local\Temp\LhxiNSQGplan.exe"C:\Users\Admin\AppData\Local\Temp\LhxiNSQGplan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1624
-
-
C:\Users\Admin\AppData\Local\Temp\wKHRqRNwnlan.exe"C:\Users\Admin\AppData\Local\Temp\wKHRqRNwnlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2584
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2640
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2652
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2612
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2764
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2636
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2600
-
-