Overview
overview
10Static
static
0323b4326b...02.exe
windows7_x64
100323b4326b...02.exe
windows10_x64
100898a80dc2...92.exe
windows7_x64
100898a80dc2...92.exe
windows10_x64
100aaecf7f77...91.exe
windows7_x64
100aaecf7f77...91.exe
windows10_x64
1016af8d85ef...38.exe
windows7_x64
816af8d85ef...38.exe
windows10_x64
4180f82bbed...43.exe
windows7_x64
10180f82bbed...43.exe
windows10_x64
1023e95ba676...7f.exe
windows7_x64
1023e95ba676...7f.exe
windows10_x64
103a6ebac4f8...ca.exe
windows7_x64
103a6ebac4f8...ca.exe
windows10_x64
1041367ad447...00.exe
windows7_x64
1041367ad447...00.exe
windows10_x64
10Analysis
-
max time kernel
145s -
max time network
105s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29-03-2021 12:47
Static task
static1
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
16af8d85ef82a5a35e0ba0a87577cbe221374c0cc55d58bc326139c6207ef338.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
16af8d85ef82a5a35e0ba0a87577cbe221374c0cc55d58bc326139c6207ef338.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
-
Size
544KB
-
MD5
526fa2ecb5f8fee6aec4b5d7713d909a
-
SHA1
51aea2a2b88fb44d5b7ec5d52b47c8b83d9d724a
-
SHA256
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700
-
SHA512
f8859f16c605622edb196f58d013058092824f3d20d207d8b0ed26d2aa4dd8d2c2d1034d5d9aa73974a605c2a41f4c569f33d43d1a6c640f2f9723c721c9e0a4
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'TyorjXA0'; $torlink = 'http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1240 KxeyqHoQsrep.exe 1356 sfIBponbalan.exe 1596 xdcuKVrqrlan.exe -
Loads dropped DLL 3 IoCs
pid Process 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2676 icacls.exe 2664 icacls.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\7-Zip\descript.ion 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_SelectionSubpicture.png 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jre7\COPYRIGHT 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Cancun 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\SendMail.api 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099175.WMF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-ImageMask.png 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\video_splitter\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MyriadPro-BoldIt.otf 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Edmonton 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tashkent 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\CET 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\rightnav.gif 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\CST6CDT 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\vlc.mo 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\JOURNAL\JOURNAL.INF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BD06102_.WMF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.transport.ecf.nl_ja_4.4.0.v20140623020002.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql_2.0.100.v20131211-1531.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\SPPlugins\ADMPlugin.apl 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLENDS\BLENDS.ELM 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\alert_obj.png 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rcp.intro.ja_5.5.0.165303.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-visual.xml 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jvm.xml 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fi\LC_MESSAGES\vlc.mo 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.ELM 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101860.BMP 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\7-Zip\Lang\mng2.txt 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\javacpl.cpl 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Srednekolymsk 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\sqlxmlx.rll 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Internet Explorer\en-US\jsprofilerui.dll.mui 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105240.WMF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\heart_glass_Thumbnail.bmp 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\demux\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\VideoLAN\VLC\COPYING.txt 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\IDTemplates\ENU\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Bishkek 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Paramaribo 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Sakhalin 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-print.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\CGMIMP32.CFG 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VSTO\vstoee100.tlb 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_ButtonGraphic.png 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\com.jrockit.mc.feature.flightrecorder_5.5.0.165303\feature.xml 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\META-INF\RyukReadMe.html 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-netbeans-core-io-ui.xml_hidden 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD00687_.WMF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\DVD Maker\en-US\OmdProject.dll.mui 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\MANIFEST.MF 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.help.base_4.0.200.v20141007-2301.jar 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Linguistics\Providers\Proximity\11.00\brt.hyp 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099190.JPG 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1684 wrote to memory of 1240 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 29 PID 1684 wrote to memory of 1240 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 29 PID 1684 wrote to memory of 1240 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 29 PID 1684 wrote to memory of 1240 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 29 PID 1684 wrote to memory of 1356 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 30 PID 1684 wrote to memory of 1356 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 30 PID 1684 wrote to memory of 1356 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 30 PID 1684 wrote to memory of 1356 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 30 PID 1684 wrote to memory of 1596 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 31 PID 1684 wrote to memory of 1596 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 31 PID 1684 wrote to memory of 1596 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 31 PID 1684 wrote to memory of 1596 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 31 PID 1684 wrote to memory of 2664 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 32 PID 1684 wrote to memory of 2664 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 32 PID 1684 wrote to memory of 2664 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 32 PID 1684 wrote to memory of 2664 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 32 PID 1684 wrote to memory of 2676 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 33 PID 1684 wrote to memory of 2676 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 33 PID 1684 wrote to memory of 2676 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 33 PID 1684 wrote to memory of 2676 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 33 PID 1684 wrote to memory of 3960 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 36 PID 1684 wrote to memory of 3960 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 36 PID 1684 wrote to memory of 3960 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 36 PID 1684 wrote to memory of 3960 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 36 PID 3960 wrote to memory of 2984 3960 net.exe 38 PID 3960 wrote to memory of 2984 3960 net.exe 38 PID 3960 wrote to memory of 2984 3960 net.exe 38 PID 3960 wrote to memory of 2984 3960 net.exe 38 PID 1684 wrote to memory of 2852 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 39 PID 1684 wrote to memory of 2852 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 39 PID 1684 wrote to memory of 2852 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 39 PID 1684 wrote to memory of 2852 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 39 PID 2852 wrote to memory of 1692 2852 net.exe 41 PID 2852 wrote to memory of 1692 2852 net.exe 41 PID 2852 wrote to memory of 1692 2852 net.exe 41 PID 2852 wrote to memory of 1692 2852 net.exe 41 PID 1684 wrote to memory of 2708 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 42 PID 1684 wrote to memory of 2708 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 42 PID 1684 wrote to memory of 2708 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 42 PID 1684 wrote to memory of 2708 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 42 PID 2708 wrote to memory of 3848 2708 net.exe 45 PID 2708 wrote to memory of 3848 2708 net.exe 45 PID 2708 wrote to memory of 3848 2708 net.exe 45 PID 2708 wrote to memory of 3848 2708 net.exe 45 PID 1684 wrote to memory of 3764 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 44 PID 1684 wrote to memory of 3764 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 44 PID 1684 wrote to memory of 3764 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 44 PID 1684 wrote to memory of 3764 1684 41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe 44 PID 3764 wrote to memory of 3932 3764 net.exe 47 PID 3764 wrote to memory of 3932 3764 net.exe 47 PID 3764 wrote to memory of 3932 3764 net.exe 47 PID 3764 wrote to memory of 3932 3764 net.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe"C:\Users\Admin\AppData\Local\Temp\41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1684 -
C:\Users\Admin\AppData\Local\Temp\KxeyqHoQsrep.exe"C:\Users\Admin\AppData\Local\Temp\KxeyqHoQsrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1240
-
-
C:\Users\Admin\AppData\Local\Temp\sfIBponbalan.exe"C:\Users\Admin\AppData\Local\Temp\sfIBponbalan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1356
-
-
C:\Users\Admin\AppData\Local\Temp\xdcuKVrqrlan.exe"C:\Users\Admin\AppData\Local\Temp\xdcuKVrqrlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1596
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2664
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2676
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3960 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2984
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1692
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3848
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3764 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3932
-
-