Analysis
-
max time kernel
150s -
max time network
85s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
30-03-2021 09:19
Static task
static1
Behavioral task
behavioral1
Sample
b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
-
Size
322KB
-
MD5
d5793b66a9a31f2ebfea5f9804d77dab
-
SHA1
4f98055913500597daba98d6fd6321d007a4c271
-
SHA256
b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6
-
SHA512
06dd7deaee850fe4fc48bb8e1f5fd7b7f152ec922318953a4ef61b18ba1f5e60785dbb3b6d14d87b4e61613bfdee2d23a6043213411d2b788a6736286db9170a
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'rikzcUO'; $torlink = 'http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 824 faDghoHJSrep.exe 1400 bnXrcsOumlan.exe 2576 kHGemHxSXlan.exe -
Loads dropped DLL 6 IoCs
pid Process 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2660 icacls.exe 2672 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\PROFILE\THMBNAIL.PNG b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382947.JPG b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\playlist\koreus.luac b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\PowerPoint.en-us\PowerPointMUI.XML b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD14800_.GIF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\mobile_view.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\AUTOSHAP.DLL b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Microsoft Office\Office14\MSOHEV.DLL b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fy\LC_MESSAGES\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS01639_.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Amman b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-core-io-ui_ja.jar b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01657_.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\SystemV\PST8PDT b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Pangnirtung b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\VDK10.SYX b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14831_.GIF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\button-highlight.png b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\META-INF\MANIFEST.MF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\profiler\modules\org-netbeans-lib-profiler-common.jar b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Indiana\Vincennes b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00462_.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\nav_rightarrow.png b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152704.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\btn-next-static.png b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105490.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Common Files\System\Ole DB\en-US\sqloledb.rll.mui b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUB6INTL.REST.IDX_DLL b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Africa\Abidjan b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Miquelon b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Indian\Cocos b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Adobe\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0315447.JPG b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipshrv.xml b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPOlive.png b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSACCESS.HXS b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-favorites.xml b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hr\LC_MESSAGES\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115876.GIF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host-remote_zh_CN.jar b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0238333.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ECLIPSE\ECLIPSE.ELM b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bn\LC_MESSAGES\vlc.mo b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02398U.BMP b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Karachi b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ast\RyukReadMe.html b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01221K.JPG b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\WB02201_.GIF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21295_.GIF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Earthy.css b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00390_.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0237336.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00439_.WMF b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-loaders_ja.jar b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-sa.xml b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.htm b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Notes_INTRO_BG.wmv b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 324 wrote to memory of 824 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 29 PID 324 wrote to memory of 824 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 29 PID 324 wrote to memory of 824 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 29 PID 324 wrote to memory of 824 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 29 PID 324 wrote to memory of 1400 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 30 PID 324 wrote to memory of 1400 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 30 PID 324 wrote to memory of 1400 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 30 PID 324 wrote to memory of 1400 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 30 PID 324 wrote to memory of 2576 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 31 PID 324 wrote to memory of 2576 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 31 PID 324 wrote to memory of 2576 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 31 PID 324 wrote to memory of 2576 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 31 PID 324 wrote to memory of 2660 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 32 PID 324 wrote to memory of 2660 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 32 PID 324 wrote to memory of 2660 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 32 PID 324 wrote to memory of 2660 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 32 PID 324 wrote to memory of 2672 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 33 PID 324 wrote to memory of 2672 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 33 PID 324 wrote to memory of 2672 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 33 PID 324 wrote to memory of 2672 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 33 PID 324 wrote to memory of 3412 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 37 PID 324 wrote to memory of 3412 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 37 PID 324 wrote to memory of 3412 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 37 PID 324 wrote to memory of 3412 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 37 PID 324 wrote to memory of 3444 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 38 PID 324 wrote to memory of 3444 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 38 PID 324 wrote to memory of 3444 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 38 PID 324 wrote to memory of 3444 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 38 PID 3444 wrote to memory of 3492 3444 net.exe 40 PID 3444 wrote to memory of 3492 3444 net.exe 40 PID 3444 wrote to memory of 3492 3444 net.exe 40 PID 3444 wrote to memory of 3492 3444 net.exe 40 PID 3412 wrote to memory of 3500 3412 net.exe 41 PID 3412 wrote to memory of 3500 3412 net.exe 41 PID 3412 wrote to memory of 3500 3412 net.exe 41 PID 3412 wrote to memory of 3500 3412 net.exe 41 PID 324 wrote to memory of 3520 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 42 PID 324 wrote to memory of 3520 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 42 PID 324 wrote to memory of 3520 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 42 PID 324 wrote to memory of 3520 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 42 PID 3520 wrote to memory of 3560 3520 net.exe 44 PID 3520 wrote to memory of 3560 3520 net.exe 44 PID 3520 wrote to memory of 3560 3520 net.exe 44 PID 3520 wrote to memory of 3560 3520 net.exe 44 PID 324 wrote to memory of 3592 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 45 PID 324 wrote to memory of 3592 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 45 PID 324 wrote to memory of 3592 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 45 PID 324 wrote to memory of 3592 324 b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe 45 PID 3592 wrote to memory of 3632 3592 net.exe 47 PID 3592 wrote to memory of 3632 3592 net.exe 47 PID 3592 wrote to memory of 3632 3592 net.exe 47 PID 3592 wrote to memory of 3632 3592 net.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe"C:\Users\Admin\AppData\Local\Temp\b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Users\Admin\AppData\Local\Temp\faDghoHJSrep.exe"C:\Users\Admin\AppData\Local\Temp\faDghoHJSrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:824
-
-
C:\Users\Admin\AppData\Local\Temp\bnXrcsOumlan.exe"C:\Users\Admin\AppData\Local\Temp\bnXrcsOumlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1400
-
-
C:\Users\Admin\AppData\Local\Temp\kHGemHxSXlan.exe"C:\Users\Admin\AppData\Local\Temp\kHGemHxSXlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2576
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2660
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2672
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3500
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3444 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3492
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3560
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3632
-
-