Overview
overview
10Static
static
8Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Analysis
-
max time kernel
167s -
max time network
288s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
23-04-2021 11:24
Static task
static1
Behavioral task
behavioral1
Sample
f937b1b7b3593a38702f870077658a891974edda.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f2e040d2c5fea1fb5e9797f7deff0a63.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
ea67e662ba55629b40d0eddbaaafc824e5809f31c9e35222104637a67615c51d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
e430730620feec3673b9c38d87482c9294421b19.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
c4bd712a7f7185a2224806b85f3c6ac48de067e38d554608b3ee92422d902b28.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
b513cfbd101e728ec41c9d6f6515278434820466bfe8e4bc1849f2418d3f86da.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
ac94165d63c75f4adf1728aa2ecb776ac7c1c18e.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
aaf3abc4054f800aaa429c4f2e4b20af.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
9b40b0d3b228d9e958c8d45fb8cec64c6851d113.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
8879a8d1508c3297200c608f3a93da5387521767c050f17aed78dde8a0cbfe12.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
7dee29fbeb5af549cb8a68dc47adf9721eb2b726.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
75a3cf8ced873ee7bc415e27e108496b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
4d74af75deddc969fef5fd89e65fa251.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
45295780f2ba837be42ccf50710bd2b5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
352b1f3533ded8c575246d4466f68c49.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
2b10ad4890c4d6e2861533cc7260a9fdc7871ea2.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
1dd4a0983a6884dddc3edf27eb5fdfc87664ed63.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
09472e7d9209b7cfc3bbc2e815a2aa843133395b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe
-
Size
139KB
-
MD5
f65e92fae0793bc18568f743ba0df697
-
SHA1
7dee29fbeb5af549cb8a68dc47adf9721eb2b726
-
SHA256
aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad
-
SHA512
879ca2f058755079341d42d496f6c6b79469bdb537a2dbeb758d0d7bc5726e56515e889f620f8bdfdafe52a4cc1f83d1c335fa75f05ac7339acf6c3cde46cafe
Score
10/10
Malware Config
Extracted
Path
C:\$Recycle.Bin\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'ky0SRjh'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1572 dDHBCTcqQrep.exe 684 AkwupMgFslan.exe 1688 EviHVjneilan.exe -
Loads dropped DLL 6 IoCs
pid Process 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 1776 icacls.exe 1788 icacls.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\Z: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\U: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\R: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\Q: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\P: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\H: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\Y: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\W: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\V: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\T: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\J: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\F: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\X: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\O: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\N: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\M: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\K: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\G: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\S: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\L: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\I: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened (read-only) \??\E: aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationRight_SelectionSubpicture.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\de-DE\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrusash.dat aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainBackground.wmv aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\NavigationUp_ButtonGraphic.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\fa.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\lt-LT\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwruksh.dat aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyBoy\BabyBoyMainToScenesBackground_PAL.wmv aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\photoedge_videoinset.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\ku.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\fur.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ja-JP\tipresx.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\content-background.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\NavigationLeft_SelectionSubpicture.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Cave_Drawings.gif aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\pt-PT\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPC.DLL aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\Bear_Formatted_RGB6_PAL.wmv aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fi-FI\tipresx.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base_jpn.xml aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred\oskpredbase.xml aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Circle_SelectionSubpictureB.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Pets\Scenes_LOOP_BG_PAL.wmv aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\dotslightoverlay.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\osknumpad\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsesp.xml aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\nl-NL\tipresx.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\en-US\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Monet.jpg aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DissolveNoise.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\an.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ko-KR\tipresx.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\circle_glass_Thumbnail.bmp aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipscat.xml aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\OldAge\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hu-HU\tipresx.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\en-US\IPSEventLogMsg.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\base.xml aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\uk-UA\RyukReadMe.html aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\en-US\WMM2CLIP.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\mainimage-mask.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\co.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrlatinlm.dat aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msadcer.dll.mui aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe File opened for modification C:\Program Files\DVD Maker\SecretST.TTF aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1628 wrote to memory of 1572 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 29 PID 1628 wrote to memory of 1572 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 29 PID 1628 wrote to memory of 1572 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 29 PID 1628 wrote to memory of 1572 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 29 PID 1628 wrote to memory of 684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 30 PID 1628 wrote to memory of 684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 30 PID 1628 wrote to memory of 684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 30 PID 1628 wrote to memory of 684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 30 PID 1628 wrote to memory of 1688 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 31 PID 1628 wrote to memory of 1688 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 31 PID 1628 wrote to memory of 1688 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 31 PID 1628 wrote to memory of 1688 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 31 PID 1628 wrote to memory of 1788 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 32 PID 1628 wrote to memory of 1788 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 32 PID 1628 wrote to memory of 1788 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 32 PID 1628 wrote to memory of 1788 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 32 PID 1628 wrote to memory of 1776 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 33 PID 1628 wrote to memory of 1776 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 33 PID 1628 wrote to memory of 1776 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 33 PID 1628 wrote to memory of 1776 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 33 PID 1628 wrote to memory of 1396 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 37 PID 1628 wrote to memory of 1396 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 37 PID 1628 wrote to memory of 1396 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 37 PID 1628 wrote to memory of 1396 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 37 PID 1628 wrote to memory of 1684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 38 PID 1628 wrote to memory of 1684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 38 PID 1628 wrote to memory of 1684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 38 PID 1628 wrote to memory of 1684 1628 aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe"C:\Users\Admin\AppData\Local\Temp\aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1628 -
C:\Users\Admin\AppData\Local\Temp\dDHBCTcqQrep.exe"C:\Users\Admin\AppData\Local\Temp\dDHBCTcqQrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1572
-
-
C:\Users\Admin\AppData\Local\Temp\AkwupMgFslan.exe"C:\Users\Admin\AppData\Local\Temp\AkwupMgFslan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:684
-
-
C:\Users\Admin\AppData\Local\Temp\EviHVjneilan.exe"C:\Users\Admin\AppData\Local\Temp\EviHVjneilan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1688
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1788
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1776
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:1396
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2116
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵PID:1684
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:2156
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:2144
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:2128
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:2468
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1748
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:2264
-
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y1⤵PID:2388
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y1⤵PID:2380
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y1⤵PID:2788