ryuk | 6dfef684475fcbf722f88337d630668b6fcb73864daa9a7e65f3642d3766fdfc

Analysis

max time kernel
151s
max time network
96s
platform
windows7_x64
resource
win7v20201028
submitted
29-03-2021 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
Size

635KB
MD5

a563c50c5fa0fd541248acaf72cc4e7d
SHA1

4b8c12b074e20a796071aa50dc82fe2ff755e8f6
SHA256

180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843
SHA512

d7c4c92b3eeb8cefe6d007b7b4fd79cbec388582ca0f3708d520a2c3e432d490d2f69ce365edbc1141f13e71ac473fed74a4367b7898af68d5c1e3b4e4899479

Score

10^/10

ryuk dave discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '5GqsR1ewcO'; $torlink = 'http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Dave packer 1 IoCs

Detects executable packed with a packer named 'Dave' from the community, due to a string at the end of it.

dave

resource	yara_rule
behavioral9/memory/1904-5-0x0000000000250000-0x0000000000272000-memory.dmp	dave

Executes dropped EXE 3 IoCs

pid	Process
1648	YfPyUQywUrep.exe
1472	JrbVkusBHlan.exe
1480	rTpxGXQoclan.exe

Loads dropped DLL 3 IoCs

pid	Process
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2664	icacls.exe
2676	icacls.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\PREVIEW.GIF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02075_.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\7-Zip\Lang\pt-br.txt	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Common Files\Microsoft Shared\Stationery\Shades of Blue.htm	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Tbilisi	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification.ja_5.5.0.165303.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\jfr\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Help\1040\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00623_.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Pets_image-frame-border.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\vignettemask25.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Atikokan	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\SystemV\YST9	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\ENU\VDK10.STP	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\stop_collection_data.gif	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Maputo	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Antarctica\Mawson	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\plugins\lua\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.STD	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\DEEPBLUE\PREVIEW.GIF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\7-Zip\Lang\lv.txt	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\psfontj2d.properties	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Shades of Blue.htm	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00172_.GIF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.apache.jasper.glassfish_2.2.2.v201205150955.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\Documentation.url	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\CLIP.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_ja.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Europe\Rome	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00260_.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\PREVIEW.GIF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099197.GIF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Vignette\NavigationUp_ButtonGraphic.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\fonts\LucidaBrightDemiBold.ttf	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-io.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Paramaribo	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\hy\LC_MESSAGES\vlc.mo	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\chapters-static.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Brisbane	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00444_.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0090089.WMF	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\VSTO\ActionsPane3.xsd	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\bin\RyukReadMe.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Juneau	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Kentucky\Louisville	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Havana	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\TRANSLAT\ESEN\MSB1ESEN.ITS	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\btn-back-static.png	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\db\bin\stopNetworkServer.bat	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\about.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\license.html	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-api-search.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-applemenu.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Australia\Darwin	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Marquesas	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.ui.di_1.0.0.v20140328-2112.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director.app_1.0.300.v20140228-1829.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.repository.nl_zh_4.4.0.v20140623020002.jar	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe

Suspicious use of SetWindowsHookEx 8 IoCs

pid	Process
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
1648	YfPyUQywUrep.exe
1648	YfPyUQywUrep.exe
1472	JrbVkusBHlan.exe
1472	JrbVkusBHlan.exe
1480	rTpxGXQoclan.exe
1480	rTpxGXQoclan.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1904 wrote to memory of 1648	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	29
PID 1904 wrote to memory of 1648	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	29
PID 1904 wrote to memory of 1648	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	29
PID 1904 wrote to memory of 1648	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	29
PID 1904 wrote to memory of 1472	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	30
PID 1904 wrote to memory of 1472	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	30
PID 1904 wrote to memory of 1472	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	30
PID 1904 wrote to memory of 1472	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	30
PID 1904 wrote to memory of 1480	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	31
PID 1904 wrote to memory of 1480	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	31
PID 1904 wrote to memory of 1480	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	31
PID 1904 wrote to memory of 1480	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	31
PID 1904 wrote to memory of 2664	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	32
PID 1904 wrote to memory of 2664	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	32
PID 1904 wrote to memory of 2664	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	32
PID 1904 wrote to memory of 2664	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	32
PID 1904 wrote to memory of 2676	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	33
PID 1904 wrote to memory of 2676	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	33
PID 1904 wrote to memory of 2676	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	33
PID 1904 wrote to memory of 2676	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	33
PID 1904 wrote to memory of 2984	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	37
PID 1904 wrote to memory of 2984	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	37
PID 1904 wrote to memory of 2984	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	37
PID 1904 wrote to memory of 2984	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	37
PID 2984 wrote to memory of 3400	2984	net.exe	39
PID 2984 wrote to memory of 3400	2984	net.exe	39
PID 2984 wrote to memory of 3400	2984	net.exe	39
PID 2984 wrote to memory of 3400	2984	net.exe	39
PID 1904 wrote to memory of 3260	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	40
PID 1904 wrote to memory of 3260	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	40
PID 1904 wrote to memory of 3260	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	40
PID 1904 wrote to memory of 3260	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	40
PID 3260 wrote to memory of 3444	3260	net.exe	42
PID 3260 wrote to memory of 3444	3260	net.exe	42
PID 3260 wrote to memory of 3444	3260	net.exe	42
PID 3260 wrote to memory of 3444	3260	net.exe	42
PID 1904 wrote to memory of 3720	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	43
PID 1904 wrote to memory of 3720	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	43
PID 1904 wrote to memory of 3720	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	43
PID 1904 wrote to memory of 3720	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	43
PID 3720 wrote to memory of 2832	3720	net.exe	45
PID 3720 wrote to memory of 2832	3720	net.exe	45
PID 3720 wrote to memory of 2832	3720	net.exe	45
PID 3720 wrote to memory of 2832	3720	net.exe	45
PID 1904 wrote to memory of 1064	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	46
PID 1904 wrote to memory of 1064	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	46
PID 1904 wrote to memory of 1064	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	46
PID 1904 wrote to memory of 1064	1904	180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe	46
PID 1064 wrote to memory of 3700	1064	net.exe	48
PID 1064 wrote to memory of 3700	1064	net.exe	48
PID 1064 wrote to memory of 3700	1064	net.exe	48
PID 1064 wrote to memory of 3700	1064	net.exe	48

C:\Users\Admin\AppData\Local\Temp\180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe
"C:\Users\Admin\AppData\Local\Temp\180f82bbedb03dc29328e32e054069870a1e65078b78b2120a84c96aaed7d843.exe"
1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Users\Admin\AppData\Local\Temp\YfPyUQywUrep.exe
  "C:\Users\Admin\AppData\Local\Temp\YfPyUQywUrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1648
- C:\Users\Admin\AppData\Local\Temp\JrbVkusBHlan.exe
  "C:\Users\Admin\AppData\Local\Temp\JrbVkusBHlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1472
- C:\Users\Admin\AppData\Local\Temp\rTpxGXQoclan.exe
  "C:\Users\Admin\AppData\Local\Temp\rTpxGXQoclan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetWindowsHookEx
  PID:1480
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2664
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3400
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3260
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3444
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3720
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2832
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3700

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1472-21-0x00000000003D0000-0x00000000003F4000-memory.dmp

Filesize
144KB

Download
memory/1480-30-0x0000000001E00000-0x0000000001E24000-memory.dmp

Filesize
144KB

Download
memory/1648-12-0x00000000005D0000-0x00000000005F4000-memory.dmp

Filesize
144KB

Download
memory/1904-2-0x00000000766F1000-0x00000000766F3000-memory.dmp

Filesize
8KB

Download
memory/1904-5-0x0000000000250000-0x0000000000272000-memory.dmp

Filesize
136KB

Download
memory/1904-4-0x0000000035000000-0x0000000035029000-memory.dmp

Filesize
164KB

Download
memory/1904-3-0x0000000000350000-0x0000000000374000-memory.dmp

Filesize
144KB

Download