ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
126s
max time network
152s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Size

116KB
MD5

be0626010b7f7f47f7416dcac841edb5
SHA1

d377e8211ae7a5249758402a170362164f1d8498
SHA256

499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282
SHA512

fe9091bc9fbe089ca541213ce6f33167832d4c18aa5713da8ff77266245ad3741d4cd3341b87156949f2b2e9c344090eb6f5ea36149a23ed4989467766c0b50a

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'NJ5BUX47E'; $torlink = 'http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
1028	EhMeeJTczrep.exe
2632	WEhNxTAsOlan.exe
3616	rkJQduFhDlan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4680	icacls.exe
4696	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office15\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ADDINS\Power Map Excel Add-in\VISUALIZATIONCHARTCOMMON.DLL	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\reviews_joined.gif	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\gu\LC_MESSAGES\vlc.mo	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\te\LC_MESSAGES\vlc.mo	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\A12_Spinner.gif	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_Grace-ppd.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-masterfs-nio2.xml	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\plugin.js	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL001.XML	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAME.DLL	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\fa\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\images\rhp_world_icon_hover.png	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\css\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-loaders_zh_CN.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_Grace-ppd.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogo.contrast-black_scale-100.png	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\WordNet_license.txt	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\af\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\WordVL_KMS_Client-ppd.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ast\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\uk-ua\ui-strings.js	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_GB\hyph_en_GB.dic	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.garbagecollector.nl_zh_4.4.0.v20140623020002.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.console_1.0.300.v20131113-1212.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-phn.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGMN108.XML	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\ccloud_retina.png	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\org-netbeans-lib-profiler-ui_zh_CN.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-ul-oob.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PublisherVL_MAK-ppd.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\IRIS\IRIS.INF	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\OFFICE16\en-us\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_da_135x40.svg	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTrial2-ppd.xrm-ms	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Analysis Services\AS OLEDB\140\Cartridges\trdtv2r41.xsl	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\images\illustrations_retina.png	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.feature_1.1.0.v20140827-1444\META-INF\MANIFEST.MF	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-print_ja.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages_es.properties	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ru\LC_MESSAGES\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\root\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\sl-si\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\zh-tw\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-cn\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.apache.httpcomponents.httpcore_4.2.5.v201311072007.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\osmdp64.msi	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\Updates\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\da-dk\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\ModuleAutoDeps\org-openide-modules.xml	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PROOF\msgr8fr.dub	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\IA32.api	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\Fonts\private\GARABD.TTF	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\1033\README.HTM	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\DataModel\Cartridges\msjet.xsl	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.text_3.5.300.v20130515-1451.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ms\RyukReadMe.html	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Templates\1033\ChronologicalResume.dotx	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.console_1.1.0.v20140131-1639.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-awt.jar	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
5036	schtasks.exe
4752	schtasks.exe
3060	schtasks.exe
5012	schtasks.exe
3640	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 1028	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	79
PID 1196 wrote to memory of 1028	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	79
PID 1196 wrote to memory of 1028	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	79
PID 1196 wrote to memory of 2632	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	80
PID 1196 wrote to memory of 2632	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	80
PID 1196 wrote to memory of 2632	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	80
PID 1196 wrote to memory of 3616	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	81
PID 1196 wrote to memory of 3616	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	81
PID 1196 wrote to memory of 3616	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	81
PID 1196 wrote to memory of 4680	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	82
PID 1196 wrote to memory of 4680	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	82
PID 1196 wrote to memory of 4680	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	82
PID 1196 wrote to memory of 4696	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	83
PID 1196 wrote to memory of 4696	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	83
PID 1196 wrote to memory of 4696	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	83
PID 1196 wrote to memory of 4572	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	86
PID 1196 wrote to memory of 4572	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	86
PID 1196 wrote to memory of 4572	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	86
PID 1196 wrote to memory of 4652	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	88
PID 1196 wrote to memory of 4652	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	88
PID 1196 wrote to memory of 4652	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	88
PID 1196 wrote to memory of 4708	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	90
PID 1196 wrote to memory of 4708	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	90
PID 1196 wrote to memory of 4708	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	90
PID 1196 wrote to memory of 4740	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	91
PID 1196 wrote to memory of 4740	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	91
PID 1196 wrote to memory of 4740	1196	499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe	91
PID 4740 wrote to memory of 4564	4740	net.exe	94
PID 4740 wrote to memory of 4564	4740	net.exe	94
PID 4740 wrote to memory of 4564	4740	net.exe	94
PID 4652 wrote to memory of 1960	4652	net.exe	97
PID 4652 wrote to memory of 1960	4652	net.exe	97
PID 4652 wrote to memory of 1960	4652	net.exe	97
PID 4572 wrote to memory of 5068	4572	net.exe	95
PID 4572 wrote to memory of 5068	4572	net.exe	95
PID 4572 wrote to memory of 5068	4572	net.exe	95
PID 4708 wrote to memory of 1796	4708	net.exe	96
PID 4708 wrote to memory of 1796	4708	net.exe	96
PID 4708 wrote to memory of 1796	4708	net.exe	96
PID 1028 wrote to memory of 5036	1028	EhMeeJTczrep.exe	98
PID 1028 wrote to memory of 5036	1028	EhMeeJTczrep.exe	98
PID 1028 wrote to memory of 5036	1028	EhMeeJTczrep.exe	98
PID 1028 wrote to memory of 4752	1028	EhMeeJTczrep.exe	100
PID 1028 wrote to memory of 4752	1028	EhMeeJTczrep.exe	100
PID 1028 wrote to memory of 4752	1028	EhMeeJTczrep.exe	100
PID 1028 wrote to memory of 3060	1028	EhMeeJTczrep.exe	102
PID 1028 wrote to memory of 3060	1028	EhMeeJTczrep.exe	102
PID 1028 wrote to memory of 3060	1028	EhMeeJTczrep.exe	102
PID 1028 wrote to memory of 5012	1028	EhMeeJTczrep.exe	104
PID 1028 wrote to memory of 5012	1028	EhMeeJTczrep.exe	104
PID 1028 wrote to memory of 5012	1028	EhMeeJTczrep.exe	104
PID 1028 wrote to memory of 3640	1028	EhMeeJTczrep.exe	106
PID 1028 wrote to memory of 3640	1028	EhMeeJTczrep.exe	106
PID 1028 wrote to memory of 3640	1028	EhMeeJTczrep.exe	106

C:\Users\Admin\AppData\Local\Temp\499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
"C:\Users\Admin\AppData\Local\Temp\499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\EhMeeJTczrep.exe
  "C:\Users\Admin\AppData\Local\Temp\EhMeeJTczrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:1028
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN sMKTu5p /TR "C:\Users\Public\EhMeeJTczrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5036
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.87 /TN XzAtymf /TR "C:\Users\Public\EhMeeJTczrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4752
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.76 /TN xtsW7lH /TR "C:\Users\Public\EhMeeJTczrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3060
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.84 /TN a565Qmj /TR "C:\Users\Public\EhMeeJTczrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5012
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.68 /TN YYTMh9g /TR "C:\Users\Public\EhMeeJTczrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:3640
- C:\Users\Admin\AppData\Local\Temp\WEhNxTAsOlan.exe
  "C:\Users\Admin\AppData\Local\Temp\WEhNxTAsOlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2632
- C:\Users\Admin\AppData\Local\Temp\rkJQduFhDlan.exe
  "C:\Users\Admin\AppData\Local\Temp\rkJQduFhDlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3616
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4680
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4696
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5068
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4652
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4708
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1796
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1196-30-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-90-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-70-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-69-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-28-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-72-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-74-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-63-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-45-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-47-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-46-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-26-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-61-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-77-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-84-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-43-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-44-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-60-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-85-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-87-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-86-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-88-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-89-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-25-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-91-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-92-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-93-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-94-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-95-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-39-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-41-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-42-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-40-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-37-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-38-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-35-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-36-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-33-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-34-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-31-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-32-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-29-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-62-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-27-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-71-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-66-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-73-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-23-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-24-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-21-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-22-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-17-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-20-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-19-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-18-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-13-0x00000000035D0000-0x00000000035D1000-memory.dmp

Filesize
4KB

Download
memory/1196-16-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-15-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-14-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-12-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-68-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-59-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-57-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-49-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-58-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-55-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-48-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-56-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-64-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-51-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-65-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-54-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download
memory/1196-53-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

Filesize
4KB

Download