ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
134s
max time network
147s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Size

208KB
MD5

aa5abadf25aa3f30c1c83c5d43a7ee8f
SHA1

ff50650068de776d2c0a8962cbccd7ffc431327a
SHA256

0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702
SHA512

033139017097fc0b5f296f9a861ee0ebc2faacb0a9ce172898a5765906010cce4bb30d7436afaeafe131b25ff2c51362825e25c60b2ab9d858672a555b28d7fb

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'JZwuk732'; $torlink = 'http://ylohxrulsdb4ex6hmartra3g63khdb4ku7qkh4qcal2n3nm33vokiiyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://ylohxrulsdb4ex6hmartra3g63khdb4ku7qkh4qcal2n3nm33vokiiyd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
940	slvRDsKiCrep.exe
1328	LpTPwaETJlan.exe
3564	JTihZkUgrlan.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4576	icacls.exe
4588	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\hwrlatinlm.dat	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-modules-profiler-selector-api_zh_CN.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\LICENSE	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_KMS_Client_AE-ul.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp4-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\sv-se\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\ClearUnlock.m1v	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_preferencestyle.css	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_closereview_18.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\jawt.lib	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.director_2.3.100.v20140224-1921.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-application-views.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Calibri.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019VL_MAK_AE-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp2-ppd.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\zh-tw\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\de-de\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\locale\org-openide-filesystems_ja.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\no\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Localized_images\cs-cz\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_KMS_Client-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Trial-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Library\SOLVER\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\PAPYRUS\THMBNAIL.PNG	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_anonymoususer_24.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\en-il\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pl-pl\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\rhp\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\css\main.css	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\it-it\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Blue Warm.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\ECHO.ELM	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\nb-no\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\pt-br\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\unified-share\js\nls\fr-fr\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\license.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_ellipses-hover.svg	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-heapdump.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusR_Subscription4-ul-oob.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\cs-cz\ui-strings.js	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derby.jar	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-swing-outline.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_MAK_AE-ul-phn.xrm-ms	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\cmm\sRGB.pf	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\es\msipc.dll.mui	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\ja-jp\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\home\js\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\dcf.x-none.msi.16.x-none.tree.dat	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\es-es\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\send-for-sign\images\themes\dark\sfs_icons.png	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-applemenu.xml	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.tree.dat	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
File opened for modification	C:\Program Files\Common Files\System\RyukReadMe.html	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5852	schtasks.exe
5156	schtasks.exe
6108	schtasks.exe
5336	schtasks.exe
5224	schtasks.exe
5888	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 1064 wrote to memory of 940	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 1064 wrote to memory of 940	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 1064 wrote to memory of 940	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	79
PID 1064 wrote to memory of 1328	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 1064 wrote to memory of 1328	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 1064 wrote to memory of 1328	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	80
PID 1064 wrote to memory of 3564	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 1064 wrote to memory of 3564	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 1064 wrote to memory of 3564	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	81
PID 1064 wrote to memory of 4576	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	82
PID 1064 wrote to memory of 4576	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	82
PID 1064 wrote to memory of 4576	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	82
PID 1064 wrote to memory of 4588	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 1064 wrote to memory of 4588	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 1064 wrote to memory of 4588	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	83
PID 1064 wrote to memory of 4836	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 1064 wrote to memory of 4836	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 1064 wrote to memory of 4836	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	87
PID 1064 wrote to memory of 3944	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	86
PID 1064 wrote to memory of 3944	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	86
PID 1064 wrote to memory of 3944	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	86
PID 1064 wrote to memory of 4828	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 1064 wrote to memory of 4828	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 1064 wrote to memory of 4828	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	91
PID 1064 wrote to memory of 5060	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	90
PID 1064 wrote to memory of 5060	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	90
PID 1064 wrote to memory of 5060	1064	0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe	90
PID 3944 wrote to memory of 4928	3944	net.exe	95
PID 3944 wrote to memory of 4928	3944	net.exe	95
PID 3944 wrote to memory of 4928	3944	net.exe	95
PID 4836 wrote to memory of 1700	4836	net.exe	94
PID 4836 wrote to memory of 1700	4836	net.exe	94
PID 4836 wrote to memory of 1700	4836	net.exe	94
PID 4828 wrote to memory of 4972	4828	net.exe	97
PID 4828 wrote to memory of 4972	4828	net.exe	97
PID 4828 wrote to memory of 4972	4828	net.exe	97
PID 5060 wrote to memory of 4888	5060	net.exe	96
PID 5060 wrote to memory of 4888	5060	net.exe	96
PID 5060 wrote to memory of 4888	5060	net.exe	96
PID 940 wrote to memory of 5852	940	slvRDsKiCrep.exe	98
PID 940 wrote to memory of 5852	940	slvRDsKiCrep.exe	98
PID 940 wrote to memory of 5852	940	slvRDsKiCrep.exe	98
PID 940 wrote to memory of 5156	940	slvRDsKiCrep.exe	100
PID 940 wrote to memory of 5156	940	slvRDsKiCrep.exe	100
PID 940 wrote to memory of 5156	940	slvRDsKiCrep.exe	100
PID 940 wrote to memory of 6108	940	slvRDsKiCrep.exe	103
PID 940 wrote to memory of 6108	940	slvRDsKiCrep.exe	103
PID 940 wrote to memory of 6108	940	slvRDsKiCrep.exe	103
PID 940 wrote to memory of 5336	940	slvRDsKiCrep.exe	105
PID 940 wrote to memory of 5336	940	slvRDsKiCrep.exe	105
PID 940 wrote to memory of 5336	940	slvRDsKiCrep.exe	105
PID 940 wrote to memory of 5224	940	slvRDsKiCrep.exe	107
PID 940 wrote to memory of 5224	940	slvRDsKiCrep.exe	107
PID 940 wrote to memory of 5224	940	slvRDsKiCrep.exe	107
PID 940 wrote to memory of 5888	940	slvRDsKiCrep.exe	109
PID 940 wrote to memory of 5888	940	slvRDsKiCrep.exe	109
PID 940 wrote to memory of 5888	940	slvRDsKiCrep.exe	109

C:\Users\Admin\AppData\Local\Temp\0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
"C:\Users\Admin\AppData\Local\Temp\0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1064
- C:\Users\Admin\AppData\Local\Temp\slvRDsKiCrep.exe
  "C:\Users\Admin\AppData\Local\Temp\slvRDsKiCrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:940
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.40 /TN h0lHuzV /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5852
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.38 /TN HrqptfY /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5156
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.23 /TN b4FXC4L /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:6108
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.27 /TN MKv0cx1 /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5336
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.34 /TN uGSrY1s /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5224
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.15 /TN 8iYiCFw /TR "C:\Users\Public\slvRDsKiCrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5888
- C:\Users\Admin\AppData\Local\Temp\LpTPwaETJlan.exe
  "C:\Users\Admin\AppData\Local\Temp\LpTPwaETJlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1328
- C:\Users\Admin\AppData\Local\Temp\JTihZkUgrlan.exe
  "C:\Users\Admin\AppData\Local\Temp\JTihZkUgrlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3564
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4576
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4588
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3944
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4928
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4836
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1700
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5060
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4888
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4828
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4972

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/940-8-0x00000000022B0000-0x00000000022B1000-memory.dmp

Filesize
4KB

Download
memory/1064-3-0x0000000000450000-0x0000000000470000-memory.dmp

Filesize
128KB

Download
memory/1064-2-0x0000000002290000-0x0000000002291000-memory.dmp

Filesize
4KB

Download
memory/1064-25-0x0000000003620000-0x0000000003621000-memory.dmp

Filesize
4KB

Download
memory/1064-4-0x0000000035000000-0x0000000035029000-memory.dmp

Filesize
164KB

Download
memory/1064-24-0x0000000002E20000-0x0000000002E21000-memory.dmp

Filesize
4KB

Download
memory/1328-14-0x00000000021B0000-0x00000000021B1000-memory.dmp

Filesize
4KB

Download
memory/3564-20-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download