Analysis
-
max time kernel
129s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
30-03-2021 09:18
Static task
static1
Behavioral task
behavioral1
Sample
a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe
-
Size
124KB
-
MD5
45e3bef94fdefd78f8e6bcedd5f43715
-
SHA1
b875676f6eaf9fd3d9105303015b6d60e7c919a8
-
SHA256
a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2
-
SHA512
15f90b3be77324ca0e7cd1d487fc5b971782facb528c88e55bb63c30d76106fd941a30bbedd07755089b6d55a2852e82c896ff0f7c0a188b59b20c4ee6543e17
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'kfXg4XYqb'; $torlink = 'http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://piesa6sapybbrz63pqmmwdzyc5fp73b3uya5cpli6pp5jpswndiu44id.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 2652 yrcCBWAPUrep.exe 3920 XFgYGlljTlan.exe 4068 VepayvqNllan.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4600 icacls.exe 4612 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\Stationery\SoftBlue.jpg a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\license.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\pl-pl\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\WordNaiveBayesCommandRanker.txt a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Resource\TypeSupport\Unicode\ICU\icudt26l.dat a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPointVL_MAK-ul-phn.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ja-jp\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\sat_logo_2x.png a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\config\Modules\org-openide-util-enumerations.xml_hidden a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\da-dk\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\PackageManifests\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\msjet.xsl a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\reduced_mode.png a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sl-sl\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\desktop-connector-files\js\nls\cs-cz\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\ko-kr\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\1033\XLINTL32.DLL a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\inline-error-1x.png a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-explorer.xml a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Smart Tag\LISTS\1033\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\ECLIPSE\ECLIPSE.INF a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\hu-hu\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-netbeans-modules-options-api.xml a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-jvm_zh_CN.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rcp.application_5.5.0.165303.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-openide-options.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\sl-si\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\CompressSelect.sql a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\jre\lib\cmm\GRAY.pf a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\NAMECONTROLPROXY.DLL a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\uk-ua\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jre1.8.0_66\lib\management\jmxremote.password.template a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ExcelR_Retail-ul-phn.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\spectrum_spinner.svg a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\en-il\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\de-de\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\ro-ro\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.core.commands_0.10.2.v20140424-2344.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Professional2019R_Retail-ul-oob.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-swing-tabcontrol.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProjectProCO365R_SubTest-pl.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\ProPlusVL_KMS_Client-ul.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000042\assets\assets\images\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000049\index.win32.bundle.map a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\System\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\locale\org-openide-explorer_zh_CN.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\SubmitInstall.xla a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\ro-ro\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\profiler\lib\locale\jfluid-server_ja.jar a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\cs-cz\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\images\themeless\accessibility_poster.jpg a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\HomeBanner_Dark.pdf a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\signatures\js\nls\zh-tw\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\PROOF\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\pl-pl\ui-strings.js a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Java\jdk1.8.0_66\THIRDPARTYLICENSEREADME.txt a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\SETLANG.EXE a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gl\LC_MESSAGES\RyukReadMe.html a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 492 wrote to memory of 2652 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 78 PID 492 wrote to memory of 2652 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 78 PID 492 wrote to memory of 2652 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 78 PID 492 wrote to memory of 3920 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 79 PID 492 wrote to memory of 3920 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 79 PID 492 wrote to memory of 3920 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 79 PID 492 wrote to memory of 4068 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 80 PID 492 wrote to memory of 4068 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 80 PID 492 wrote to memory of 4068 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 80 PID 492 wrote to memory of 4600 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 81 PID 492 wrote to memory of 4600 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 81 PID 492 wrote to memory of 4600 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 81 PID 492 wrote to memory of 4612 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 82 PID 492 wrote to memory of 4612 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 82 PID 492 wrote to memory of 4612 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 82 PID 492 wrote to memory of 4708 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 85 PID 492 wrote to memory of 4708 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 85 PID 492 wrote to memory of 4708 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 85 PID 492 wrote to memory of 4904 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 86 PID 492 wrote to memory of 4904 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 86 PID 492 wrote to memory of 4904 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 86 PID 492 wrote to memory of 2072 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 92 PID 492 wrote to memory of 2072 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 92 PID 492 wrote to memory of 2072 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 92 PID 492 wrote to memory of 2896 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 89 PID 492 wrote to memory of 2896 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 89 PID 492 wrote to memory of 2896 492 a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe 89 PID 2072 wrote to memory of 4856 2072 net.exe 93 PID 2072 wrote to memory of 4856 2072 net.exe 93 PID 2072 wrote to memory of 4856 2072 net.exe 93 PID 4708 wrote to memory of 4676 4708 net.exe 96 PID 4708 wrote to memory of 4676 4708 net.exe 96 PID 4708 wrote to memory of 4676 4708 net.exe 96 PID 2896 wrote to memory of 1056 2896 net.exe 95 PID 2896 wrote to memory of 1056 2896 net.exe 95 PID 2896 wrote to memory of 1056 2896 net.exe 95 PID 4904 wrote to memory of 5116 4904 net.exe 94 PID 4904 wrote to memory of 5116 4904 net.exe 94 PID 4904 wrote to memory of 5116 4904 net.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe"C:\Users\Admin\AppData\Local\Temp\a8a5621ce56adb13d5fdfee1709cf03ee839f98c1912ac0055329fc90de2c2a2.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:492 -
C:\Users\Admin\AppData\Local\Temp\yrcCBWAPUrep.exe"C:\Users\Admin\AppData\Local\Temp\yrcCBWAPUrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:2652
-
-
C:\Users\Admin\AppData\Local\Temp\XFgYGlljTlan.exe"C:\Users\Admin\AppData\Local\Temp\XFgYGlljTlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\VepayvqNllan.exe"C:\Users\Admin\AppData\Local\Temp\VepayvqNllan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:4068
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4600
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:4612
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:4676
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:5116
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1056
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4856
-
-