ryuk | fbb346ad0acdc9e1926d5326f5738be955818e4ec19217e0de357ba3930731ed

Analysis

max time kernel
133s
max time network
149s
platform
windows10_x64
resource
win10v20201028
submitted
30-03-2021 09:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
Size

322KB
MD5

d5793b66a9a31f2ebfea5f9804d77dab
SHA1

4f98055913500597daba98d6fd6321d007a4c271
SHA256

b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6
SHA512

06dd7deaee850fe4fc48bb8e1f5fd7b7f152ec922318953a4ef61b18ba1f5e60785dbb3b6d14d87b4e61613bfdee2d23a6043213411d2b788a6736286db9170a

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = 'rikzcUO'; $torlink = 'http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://lgjpuim5fe3pejmllygcffape3djui6k2a5pcbpuyvps3h4ajb7yf4id.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
3652	eMpGybHMgrep.exe
2240	HxPMAneellan.exe
1232	rSBJARVjJlan.exe

Drops startup file 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4772	icacls.exe
4756	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\jre\lib\images\cursors\win32_MoveNoDrop32x32.gif	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_OEM_Perp-ul-oob.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\Annotations\Stamps\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\nb-no\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\walk-through\js\nls\nb-no\ui-strings.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Document Themes 16\Theme Fonts\Franklin Gothic.xml	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\app-center\js\nls\fr-ma\ui-strings.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer-select\js\nls\cs-cz\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\nls\ko-kr\ui-strings.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_US\en_US.aff	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\ja-JP\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.swt_3.103.1.v20140903-1938.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\plug_ins\SendMail.api	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\core\dev\nls\de-de\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVClientIsv.man	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\license.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\file_types\hi_contrast\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\themes\dark\apple-touch-icon-144x144-precomposed.png	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\generic-rhp-app\js\nls\da-dk\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Scan_visual.svg	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\sign-services-auth\js\selector.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Adobe\HelpCfg\en_US\Reader_DC.helpcfg	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.equinox.launcher.nl_zh_4.4.0.v20140623020002.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_Retail-ul-phn.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\PowerPoint2019R_Trial-ppd.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\ProjectStd2019VL_MAK_AE-ul-oob.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioStdCO365R_SubTrial-pl.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\VisioProR_Trial-ul-oob.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogoSmall.scale-140.png	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\hu-hu\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\Download_on_the_App_Store_Badge_cs_135x40.svg	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\Ink\en-US\TipRes.dll.mui	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jre1.8.0_66\lib\javaws.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\oc\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\add-account\js\nls\de-de\ui-strings.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-computer\js\nls\ko-kr\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\uss-search\js\nls\sv-se\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\db\lib\derbytools.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeBusinessR_OEM_Perp3-pl.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\AXIS\AXIS.INF	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\ko-kr\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\eu-es\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\js\nls\tr-tr\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\PROTTPLN.XLS	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\MEDIA\CAMERA.WAV	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\EVRGREEN\THMBNAIL.PNG	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\tracked-send\js\plugins\tracked-send\js\nls\ja-jp\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\BREEZE\BREEZE.INF	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\images\themeless\chrome-ext-2x.png	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\images\themes\dark\s_thumbnailview_18.svg	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.browser.zh_CN_5.5.0.165303.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\update_tracking\org-openide-nodes.xml	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\icons\date-span-16.png	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.osgi.services.nl_ja_4.4.0.v20140623020002.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\PAGESIZE\PGLBL116.XML	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\files\dev\nls\sv-se\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\zh-cn\ui-strings.js	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.core.commands.nl_ja_4.4.0.v20140623020002.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\HomeStudentR_OEM_Perp-pl.xrm-ms	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\ODBC Drivers\Salesforce\lib\LibCurl64.DllA\OpenSSL64.DllA\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\eclipse.inf	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.eclipse.e4.ui.di.nl_ja_4.4.0.v20140623020002.jar	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app-api\RyukReadMe.html	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 3652	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	79
PID 1152 wrote to memory of 3652	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	79
PID 1152 wrote to memory of 3652	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	79
PID 1152 wrote to memory of 2240	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	80
PID 1152 wrote to memory of 2240	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	80
PID 1152 wrote to memory of 2240	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	80
PID 1152 wrote to memory of 1232	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	81
PID 1152 wrote to memory of 1232	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	81
PID 1152 wrote to memory of 1232	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	81
PID 1152 wrote to memory of 4756	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	82
PID 1152 wrote to memory of 4756	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	82
PID 1152 wrote to memory of 4756	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	82
PID 1152 wrote to memory of 4772	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	83
PID 1152 wrote to memory of 4772	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	83
PID 1152 wrote to memory of 4772	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	83
PID 1152 wrote to memory of 5040	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	86
PID 1152 wrote to memory of 5040	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	86
PID 1152 wrote to memory of 5040	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	86
PID 1152 wrote to memory of 4728	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	89
PID 1152 wrote to memory of 4728	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	89
PID 1152 wrote to memory of 4728	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	89
PID 1152 wrote to memory of 4716	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	88
PID 1152 wrote to memory of 4716	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	88
PID 1152 wrote to memory of 4716	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	88
PID 1152 wrote to memory of 4740	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	92
PID 1152 wrote to memory of 4740	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	92
PID 1152 wrote to memory of 4740	1152	b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe	92
PID 5040 wrote to memory of 5024	5040	net.exe	96
PID 5040 wrote to memory of 5024	5040	net.exe	96
PID 5040 wrote to memory of 5024	5040	net.exe	96
PID 4728 wrote to memory of 4656	4728	net.exe	94
PID 4728 wrote to memory of 4656	4728	net.exe	94
PID 4728 wrote to memory of 4656	4728	net.exe	94
PID 4716 wrote to memory of 4876	4716	net.exe	95
PID 4716 wrote to memory of 4876	4716	net.exe	95
PID 4716 wrote to memory of 4876	4716	net.exe	95
PID 4740 wrote to memory of 4736	4740	net.exe	97
PID 4740 wrote to memory of 4736	4740	net.exe	97
PID 4740 wrote to memory of 4736	4740	net.exe	97

C:\Users\Admin\AppData\Local\Temp\b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe
"C:\Users\Admin\AppData\Local\Temp\b218ea35335833ba6dab543183314754db42bace4e62cf5950447c743b0ea4f6.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Users\Admin\AppData\Local\Temp\eMpGybHMgrep.exe
  "C:\Users\Admin\AppData\Local\Temp\eMpGybHMgrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:3652
- C:\Users\Admin\AppData\Local\Temp\HxPMAneellan.exe
  "C:\Users\Admin\AppData\Local\Temp\HxPMAneellan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:2240
- C:\Users\Admin\AppData\Local\Temp\rSBJARVjJlan.exe
  "C:\Users\Admin\AppData\Local\Temp\rSBJARVjJlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1232
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4756
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:4772
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5040
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5024
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4876
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:4656
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4740
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4736

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1152-86-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-53-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-74-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-75-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-76-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-72-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-77-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-79-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-81-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-80-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-83-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-82-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-85-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-84-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-2-0x0000000000730000-0x0000000000731000-memory.dmp

Filesize
4KB

Download
memory/1152-88-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-87-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-90-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-89-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-91-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-92-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-93-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-94-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-95-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-96-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-101-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-100-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-102-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-68-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-3-0x00000000001C0000-0x00000000001DF000-memory.dmp

Filesize
124KB

Download
memory/1152-70-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-4-0x0000000035000000-0x0000000035028000-memory.dmp

Filesize
160KB

Download
memory/1152-67-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-66-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-65-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-64-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-62-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-63-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-60-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-61-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-59-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-57-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-58-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-55-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-56-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-73-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-24-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-54-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-25-0x0000000003600000-0x0000000003601000-memory.dmp

Filesize
4KB

Download
memory/1152-26-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-51-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-27-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-29-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-28-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-31-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-30-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-52-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-48-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-50-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-49-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-46-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-47-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-44-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-45-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-42-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-43-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-41-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-40-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-34-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-39-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-37-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-38-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-36-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-35-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-33-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1152-32-0x0000000002E00000-0x0000000002E01000-memory.dmp

Filesize
4KB

Download
memory/1232-20-0x00000000006F0000-0x00000000006F1000-memory.dmp

Filesize
4KB

Download
memory/2240-14-0x00000000006C0000-0x00000000006C1000-memory.dmp

Filesize
4KB

Download
memory/3652-8-0x00000000007C0000-0x00000000007C1000-memory.dmp

Filesize
4KB

Download