ryuk | 6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc

Analysis

max time kernel
126s
max time network
153s
platform
windows10_x64
resource
win10v20201028
submitted
29/03/2021, 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Size

208KB
MD5

aa5abadf25aa3f30c1c83c5d43a7ee8f
SHA1

ff50650068de776d2c0a8962cbccd7ffc431327a
SHA256

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702
SHA512

033139017097fc0b5f296f9a861ee0ebc2faacb0a9ce172898a5765906010cce4bb30d7436afaeafe131b25ff2c51362825e25c60b2ab9d858672a555b28d7fb

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'JZwuk732'; $torlink = 'http://ylohxrulsdb4ex6hmartra3g63khdb4ku7qkh4qcal2n3nm33vokiiyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://ylohxrulsdb4ex6hmartra3g63khdb4ku7qkh4qcal2n3nm33vokiiyd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3548	RegMmSkEKrep.exe
2556	rChahhASZlan.exe
3860	esnhJBQuelan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4484	icacls.exe
4496	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\cs-cz\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ru-ru\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\Bears.htm	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_Grace-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_SubTrial-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\sendforsignature.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\ko-kr\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_ja_4.4.0.v20140623020002.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\pl\LC_MESSAGES\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\nl-nl\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\COPYRIGHT	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\requests\status.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\core_icons_highcontrast.png	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\tr\msipc.dll.mui	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\sl-si\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\ja-jp\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipssrl.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.commons.logging_1.1.1.v201101211721.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_Retail-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CHART.DLL	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\jce.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_MAK-pl.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\pt-br\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\System\Ole DB\sqlxmlx.rll	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeServiceBypassR_PrepidBypass-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019VL_KMS_Client_AE-ul.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\br\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\cs-cz\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_zh_cn_135x40.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jface.nl_ja_4.4.0.v20140623020002.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Gill Sans MT.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalPipcR_Grace-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\STSLIST.DLL	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\de-de\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\en-ae\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\zh-tw\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipshe.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalPipcR_OEM_Perp-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\vlc.mo	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\example_icons.png	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\ja-jp\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LivePersonaCard\lpc.win32.bundle	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\PAPYRUS.ELM	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\images\themes\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_cs.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbyLocale_it.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\pl-pl\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEES.DLL	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_duplicate_18.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\da-dk\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPTSFrame.png	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_nextarrow_default.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-keyring.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_18.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\images\digsig_icons.png	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\he-il\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\sk-sk\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\root\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\hu-hu\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 648 wrote to memory of 3548	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	78
PID 648 wrote to memory of 3548	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	78
PID 648 wrote to memory of 3548	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	78
PID 648 wrote to memory of 2556	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 648 wrote to memory of 2556	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 648 wrote to memory of 2556	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 648 wrote to memory of 3860	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 648 wrote to memory of 3860	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 648 wrote to memory of 3860	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 648 wrote to memory of 4484	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 648 wrote to memory of 4484	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 648 wrote to memory of 4484	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 648 wrote to memory of 4496	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 648 wrote to memory of 4496	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 648 wrote to memory of 4496	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 648 wrote to memory of 5080	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	85
PID 648 wrote to memory of 5080	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	85
PID 648 wrote to memory of 5080	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	85
PID 648 wrote to memory of 2336	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	88
PID 648 wrote to memory of 2336	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	88
PID 648 wrote to memory of 2336	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	88
PID 648 wrote to memory of 4788	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 648 wrote to memory of 4788	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 648 wrote to memory of 4788	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 648 wrote to memory of 4944	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 648 wrote to memory of 4944	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 648 wrote to memory of 4944	648	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 2336 wrote to memory of 5096	2336	net.exe	96
PID 2336 wrote to memory of 5096	2336	net.exe	96
PID 2336 wrote to memory of 5096	2336	net.exe	96
PID 4788 wrote to memory of 4588	4788	net.exe	95
PID 4788 wrote to memory of 4588	4788	net.exe	95
PID 4788 wrote to memory of 4588	4788	net.exe	95
PID 5080 wrote to memory of 4456	5080	net.exe	94
PID 5080 wrote to memory of 4456	5080	net.exe	94
PID 5080 wrote to memory of 4456	5080	net.exe	94
PID 4944 wrote to memory of 4864	4944	net.exe	93
PID 4944 wrote to memory of 4864	4944	net.exe	93
PID 4944 wrote to memory of 4864	4944	net.exe	93

C:\Users\Admin\AppData\Local\Temp\0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
"C:\Users\Admin\AppData\Local\Temp\0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:648
- C:\Users\Admin\AppData\Local\Temp\RegMmSkEKrep.exe
  "C:\Users\Admin\AppData\Local\Temp\RegMmSkEKrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:3548
- C:\Users\Admin\AppData\Local\Temp\rChahhASZlan.exe
  "C:\Users\Admin\AppData\Local\Temp\rChahhASZlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2556
- C:\Users\Admin\AppData\Local\Temp\esnhJBQuelan.exe
  "C:\Users\Admin\AppData\Local\Temp\esnhJBQuelan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3860
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4484
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4496
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5080
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4456
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4588
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5096
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/648-4-0x0000000035000000-0x0000000035029000-memory.dmp

Filesize
164KB

Download
memory/648-2-0x0000000002090000-0x0000000002091000-memory.dmp

Filesize
4KB

Download
memory/648-26-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/648-27-0x0000000003610000-0x0000000003611000-memory.dmp

Filesize
4KB

Download
memory/648-3-0x0000000000550000-0x0000000000570000-memory.dmp

Filesize
128KB

Download
memory/2556-15-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/3548-9-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/3860-21-0x0000000002080000-0x0000000002081000-memory.dmp

Filesize
4KB

Download