Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
151s -
max time network
86s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
29/03/2021, 12:12
Static task
static1
Behavioral task
behavioral1
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
-
Size
468KB
-
MD5
9296a9b81bfe119bd786a6f5a8ad43ad
-
SHA1
581cf7c453358cd94ceed70088470c32a7307c8e
-
SHA256
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591
-
SHA512
64955ec13d7e874d8aeb9490b2ff814473e02ef93eb071bab460add8b5966f660ddca1ba80cf1055f7d2c5cccaf4ad62d908356547c8c13387e622e5dfc849a1
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'J5U8YdUCr'; $torlink = 'http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1720 aoZItaTPjrep.exe 608 VkMBTjtxGlan.exe 2608 bDvTocyUGlan.exe -
Loads dropped DLL 3 IoCs
pid Process 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2664 icacls.exe 2676 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Minsk 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\PST8PDT 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XMLSDK5.CHM 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.views_3.7.0.v20140408-0703.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-modules-profiler-attach.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Martinique 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\LC_MESSAGES\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\numbers\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05710_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00231_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\NavigationUp_SelectionSubpicture.png 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ui_5.5.0.165303.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.intro_3.4.200.v20130326-1254.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01084_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\7-Zip\Lang\sa.txt 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationRight_SelectionSubpicture.png 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_INTRO_BG_PAL.wmv 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0187423.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Bibliography\Style\GostTitle.XSL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\Office14\AUTHZAX.DLL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSOXMLED.EXE 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Desert\HEADER.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZLIB.ACCDE 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolBMPs\DataViewIconImages.jpg 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\FormsPreviewTemplate.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\icons\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\FDATE.DLL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUEPRNT\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN04326_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Oriel.thmx 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\META-INF\ECLIPSE_.RSA 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00352_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0196164.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0212219.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14982_.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR24F.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\button_mid_over.gif 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\include\jdwpTransport.h 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Resolute 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\requests\playlist.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0164153.JPG 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0400004.PNG 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\EQUATION\EQNEDT32.HLP 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB00516L.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0233070.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-queries_ja.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Etc\UTC 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsrom.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG.wmv 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00197_.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Toronto 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182902.WMF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14791_.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AG00011_.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Colors\Pushpin.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14845_.GIF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1832 wrote to memory of 1720 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 29 PID 1832 wrote to memory of 1720 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 29 PID 1832 wrote to memory of 1720 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 29 PID 1832 wrote to memory of 1720 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 29 PID 1832 wrote to memory of 608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 30 PID 1832 wrote to memory of 608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 30 PID 1832 wrote to memory of 608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 30 PID 1832 wrote to memory of 608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 30 PID 1832 wrote to memory of 2608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 31 PID 1832 wrote to memory of 2608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 31 PID 1832 wrote to memory of 2608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 31 PID 1832 wrote to memory of 2608 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 31 PID 1832 wrote to memory of 2664 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 32 PID 1832 wrote to memory of 2664 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 32 PID 1832 wrote to memory of 2664 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 32 PID 1832 wrote to memory of 2664 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 32 PID 1832 wrote to memory of 2676 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 34 PID 1832 wrote to memory of 2676 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 34 PID 1832 wrote to memory of 2676 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 34 PID 1832 wrote to memory of 2676 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 34 PID 1832 wrote to memory of 3228 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 36 PID 1832 wrote to memory of 3228 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 36 PID 1832 wrote to memory of 3228 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 36 PID 1832 wrote to memory of 3228 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 36 PID 1832 wrote to memory of 3240 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 37 PID 1832 wrote to memory of 3240 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 37 PID 1832 wrote to memory of 3240 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 37 PID 1832 wrote to memory of 3240 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 37 PID 1832 wrote to memory of 3316 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 40 PID 1832 wrote to memory of 3316 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 40 PID 1832 wrote to memory of 3316 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 40 PID 1832 wrote to memory of 3316 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 40 PID 1832 wrote to memory of 3328 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 41 PID 1832 wrote to memory of 3328 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 41 PID 1832 wrote to memory of 3328 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 41 PID 1832 wrote to memory of 3328 1832 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 41 PID 3240 wrote to memory of 3548 3240 net.exe 47 PID 3240 wrote to memory of 3548 3240 net.exe 47 PID 3240 wrote to memory of 3548 3240 net.exe 47 PID 3240 wrote to memory of 3548 3240 net.exe 47 PID 3228 wrote to memory of 3580 3228 net.exe 45 PID 3228 wrote to memory of 3580 3228 net.exe 45 PID 3228 wrote to memory of 3580 3228 net.exe 45 PID 3228 wrote to memory of 3580 3228 net.exe 45 PID 3316 wrote to memory of 3572 3316 net.exe 46 PID 3316 wrote to memory of 3572 3316 net.exe 46 PID 3316 wrote to memory of 3572 3316 net.exe 46 PID 3316 wrote to memory of 3572 3316 net.exe 46 PID 3328 wrote to memory of 3540 3328 net.exe 44 PID 3328 wrote to memory of 3540 3328 net.exe 44 PID 3328 wrote to memory of 3540 3328 net.exe 44 PID 3328 wrote to memory of 3540 3328 net.exe 44
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe"C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\aoZItaTPjrep.exe"C:\Users\Admin\AppData\Local\Temp\aoZItaTPjrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1720
-
-
C:\Users\Admin\AppData\Local\Temp\VkMBTjtxGlan.exe"C:\Users\Admin\AppData\Local\Temp\VkMBTjtxGlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:608
-
-
C:\Users\Admin\AppData\Local\Temp\bDvTocyUGlan.exe"C:\Users\Admin\AppData\Local\Temp\bDvTocyUGlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2608
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2664
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2676
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3228 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3580
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3240 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3548
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3316 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3572
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3328 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3540
-
-