ryuk | 6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc

Analysis

max time kernel
131s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
29/03/2021, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Size

635KB
MD5

a563c50c5fa0fd541248acaf72cc4e7d
SHA1

4b8c12b074e20a796071aa50dc82fe2ff755e8f6
SHA256

180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
SHA512

d7c4c92b3eeb8cefe6d007b7b4fd79cbec388582ca0f3708d520a2c3e432d490d2f69ce365edbc1141f13e71ac473fed74a4367b7898af68d5c1e3b4e4899479

Score

10^/10

ryuk dave discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '5GqsR1ewcO'; $torlink = 'http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Dave packer 1 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

dave

resource	yara_rule
behavioral10/memory/644-4-0x00000000007A0000-0x00000000007C2000-memory.dmp	dave

Executes dropped EXE 3 IoCs

pid	Process
2984	PtBdYJUfVrep.exe
640	pfDGGqfcilan.exe
4496	osAbBDmxUlan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4616	icacls.exe
4628	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft SQL Server\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\pl-pl\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\sl-sl\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\insert.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\topnav.gif	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-compat.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdVL_KMS_Client-ul-oob.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\css\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProO365R_SubTrial-ul-oob.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\wordvisi.ttf	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\eu-es\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ExcelVL_MAK-pl.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\activity-badge\js\nls\nb-no\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\sl-si\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\aic_file_icons_retina_thumb.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation_1.2.100.v20131119-0908.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-netbeans-modules-options-keymap.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSHY7ES.LEX	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_move_18.svg	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected]	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-bg_highlight-soft_100_eeeeee_1x100.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\s_agreement_filetype.svg	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.alert.zh_CN_5.5.0.165303.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-explorer.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\sv-se\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Playstore\ko_get.svg	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\images\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_sv.properties	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN048.XML	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\sl-sl\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\es-es\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\Mappings\win\CP1257.TXT	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\bin\server\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Grace-ul-oob.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProXC2RVL_MAKC2R-ul-oob.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fi-fi\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\sr-Cyrl-BA\msipc.dll.mui	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\ja-jp\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\Ole DB\oledbjvs.inc	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.net.nl_zh_4.4.0.v20140623020002.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\faf-main.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_Retail-ppd.xrm-ms	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFSYML.TTF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\libs\require\2.1.15\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\hu-hu\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\catalog.json	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\ko-kr\ui-strings.js	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf_1.1.0.v20140408-1354.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\PackageManifests\AppXManifest.90160000-001F-0C0A-1000-0000000FF1CE.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ar\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\en-US\sqloledb.rll.mui	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hr\msipc.dll.mui	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\submission_history.gif	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\sk-sk\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vreg\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
2984	PtBdYJUfVrep.exe
2984	PtBdYJUfVrep.exe
640	pfDGGqfcilan.exe
640	pfDGGqfcilan.exe
4496	osAbBDmxUlan.exe
4496	osAbBDmxUlan.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2984	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	78
PID 644 wrote to memory of 2984	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	78
PID 644 wrote to memory of 2984	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	78
PID 644 wrote to memory of 640	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	79
PID 644 wrote to memory of 640	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	79
PID 644 wrote to memory of 640	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	79
PID 644 wrote to memory of 4496	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	80
PID 644 wrote to memory of 4496	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	80
PID 644 wrote to memory of 4496	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	80
PID 644 wrote to memory of 4616	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	81
PID 644 wrote to memory of 4616	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	81
PID 644 wrote to memory of 4616	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	81
PID 644 wrote to memory of 4628	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	82
PID 644 wrote to memory of 4628	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	82
PID 644 wrote to memory of 4628	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	82
PID 644 wrote to memory of 1620	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	85
PID 644 wrote to memory of 1620	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	85
PID 644 wrote to memory of 1620	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	85
PID 644 wrote to memory of 4876	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	87
PID 644 wrote to memory of 4876	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	87
PID 644 wrote to memory of 4876	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	87
PID 644 wrote to memory of 4804	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	89
PID 644 wrote to memory of 4804	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	89
PID 644 wrote to memory of 4804	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	89
PID 644 wrote to memory of 1192	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	90
PID 644 wrote to memory of 1192	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	90
PID 644 wrote to memory of 1192	644	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	90
PID 1620 wrote to memory of 5072	1620	net.exe	93
PID 1620 wrote to memory of 5072	1620	net.exe	93
PID 1620 wrote to memory of 5072	1620	net.exe	93
PID 4876 wrote to memory of 4700	4876	net.exe	94
PID 4876 wrote to memory of 4700	4876	net.exe	94
PID 4876 wrote to memory of 4700	4876	net.exe	94
PID 1192 wrote to memory of 4672	1192	net.exe	96
PID 1192 wrote to memory of 4672	1192	net.exe	96
PID 1192 wrote to memory of 4672	1192	net.exe	96
PID 4804 wrote to memory of 3996	4804	net.exe	95
PID 4804 wrote to memory of 3996	4804	net.exe	95
PID 4804 wrote to memory of 3996	4804	net.exe	95

C:\Users\Admin\AppData\Local\Temp\180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
"C:\Users\Admin\AppData\Local\Temp\180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:644
- C:\Users\Admin\AppData\Local\Temp\PtBdYJUfVrep.exe
  "C:\Users\Admin\AppData\Local\Temp\PtBdYJUfVrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:2984
- C:\Users\Admin\AppData\Local\Temp\pfDGGqfcilan.exe
  "C:\Users\Admin\AppData\Local\Temp\pfDGGqfcilan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:640
- C:\Users\Admin\AppData\Local\Temp\osAbBDmxUlan.exe
  "C:\Users\Admin\AppData\Local\Temp\osAbBDmxUlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:4496
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4616
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4628
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1620
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5072
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4876
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4700
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3996
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1192
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4672

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/640-16-0x0000000002190000-0x00000000021B4000-memory.dmp

Filesize
144KB

Download
memory/644-4-0x00000000007A0000-0x00000000007C2000-memory.dmp

Filesize
136KB

Download
memory/644-3-0x0000000035000000-0x0000000035029000-memory.dmp

Filesize
164KB

Download
memory/644-2-0x00000000007D0000-0x00000000007F4000-memory.dmp

Filesize
144KB

Download
memory/644-27-0x00000000031F0000-0x00000000031F1000-memory.dmp

Filesize
4KB

Download
memory/644-28-0x00000000039F0000-0x00000000039F1000-memory.dmp

Filesize
4KB

Download
memory/2984-9-0x0000000002110000-0x0000000002134000-memory.dmp

Filesize
144KB

Download
memory/4496-23-0x00000000020B0000-0x00000000020D4000-memory.dmp

Filesize
144KB

Download