Overview
overview
10Static
static
8Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Ryuk
windows7_x64
10Analysis
-
max time kernel
302s -
max time network
295s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-04-2021 11:24
Static task
static1
Behavioral task
behavioral1
Sample
f937b1b7b3593a38702f870077658a891974edda.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f2e040d2c5fea1fb5e9797f7deff0a63.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
ea67e662ba55629b40d0eddbaaafc824e5809f31c9e35222104637a67615c51d.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral4
Sample
e430730620feec3673b9c38d87482c9294421b19.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral5
Sample
de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral6
Sample
c4bd712a7f7185a2224806b85f3c6ac48de067e38d554608b3ee92422d902b28.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral7
Sample
b513cfbd101e728ec41c9d6f6515278434820466bfe8e4bc1849f2418d3f86da.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral8
Sample
ac94165d63c75f4adf1728aa2ecb776ac7c1c18e.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral9
Sample
aaf3abc4054f800aaa429c4f2e4b20af.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral10
Sample
aaec6ae400b38b95ae414481d8d45f0281cf26f59f8592567dfe2223f66024ad.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral11
Sample
9b40b0d3b228d9e958c8d45fb8cec64c6851d113.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral12
Sample
8879a8d1508c3297200c608f3a93da5387521767c050f17aed78dde8a0cbfe12.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral13
Sample
7dee29fbeb5af549cb8a68dc47adf9721eb2b726.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral14
Sample
75a3cf8ced873ee7bc415e27e108496b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral15
Sample
60c16e45c5cbe88a38911f1e3176d90444e4884261d8481d4d719acec1bc5025.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral16
Sample
4d74af75deddc969fef5fd89e65fa251.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral17
Sample
45295780f2ba837be42ccf50710bd2b5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral18
Sample
352b1f3533ded8c575246d4466f68c49.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral19
Sample
2b10ad4890c4d6e2861533cc7260a9fdc7871ea2.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral20
Sample
1dd4a0983a6884dddc3edf27eb5fdfc87664ed63.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral21
Sample
09472e7d9209b7cfc3bbc2e815a2aa843133395b.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
-
Target
de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe
-
Size
274KB
-
MD5
aaf3abc4054f800aaa429c4f2e4b20af
-
SHA1
16e859c1222b7f4dba2361480ce33a0564e4cabf
-
SHA256
de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b
-
SHA512
650e515d0ec199efa74ed4bb2e0f622da609b9559d2663c990bb5310997f44785408f0ed2c35405445962abe33ba74266bc7f3c8b5afa0b8035856364f4e2de6
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = '2neBqEej6'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1628 vRZSIYUWerep.exe 1476 LMHyZYTwZlan.exe 1584 XIrYqECZKlan.exe -
Modifies extensions of user files 7 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\GroupClose.raw.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\MeasureUpdate.tif.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\UnprotectConvert.png.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\InstallLimit.raw.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\MergeInitialize.tif.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\MountTrace.crw.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Users\Admin\Pictures\PushProtect.tiff.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Loads dropped DLL 6 IoCs
pid Process 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2700 icacls.exe 2712 icacls.exe -
Drops desktop.ini file(s) 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\W: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\T: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\F: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\B: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\Z: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\X: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\H: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\G: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\E: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\Y: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\P: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\L: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\K: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\I: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\V: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\U: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\Q: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\O: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\N: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\M: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\J: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\S: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened (read-only) \??\R: de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jre7\lib\cmm\LINEAR_RGB.pf de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\es\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\STS2\background.gif de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0301050.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\rtf_increaseindent.gif.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.launcher_1.3.0.v20140415-2008.jar de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Garden.htm de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\FormsHomePageStyle.css de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.console.ui.notification_5.5.0.165303\html\dcommon\gifs\doclib.gif de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Riyadh89 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\uz\LC_MESSAGES\vlc.mo de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00487_.WMF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\LAUNCH.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297727.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Outlook.en-us\SETUP.XML de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00453_.WMF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200163.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00095_.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14582_.GIF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD00814_.WMF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21328_.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.core.ssl.feature_1.0.0.v20140827-1444\about.html.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE06450_.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-visual.jar de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.common_2.10.1.v20140901-1043\META-INF\ECLIPSE_.RSA.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02223U.BMP.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR42F.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH01875_.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0216724.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\AFTRNOON\AFTRNOON.INF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Pacific\Efate.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\el-GR\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.core.feature_1.3.0.v20140523-0116\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\af\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE00013_.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\Publisher\Backgrounds\J0143749.GIF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Pretty_Peacock.jpg de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Common Files\System\ado\en-US\RyukReadMe.html de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\DOCL.ICO.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\SpecialNavigationLeft_ButtonGraphic.png de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH01213K.JPG de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Tripoli.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Riga de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Module.xml de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR25F.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ.DLL de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Abidjan.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Maceio.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\LABELHM.POC de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_partstyle.css.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02757U.BMP.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\XLSLICER.DLL.IDX_DLL.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\SoftBlue\TAB_ON.GIF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\PREVIEW.GIF de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\Invite or Link.one de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-modules-autoupdate-ui.xml.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\PNG32.FLT.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195248.WMF.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\SENDTO.DLL.RYK de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4868 SCHTASKS.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1108 wrote to memory of 1628 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 29 PID 1108 wrote to memory of 1628 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 29 PID 1108 wrote to memory of 1628 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 29 PID 1108 wrote to memory of 1628 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 29 PID 1108 wrote to memory of 1476 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 30 PID 1108 wrote to memory of 1476 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 30 PID 1108 wrote to memory of 1476 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 30 PID 1108 wrote to memory of 1476 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 30 PID 1108 wrote to memory of 1584 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 31 PID 1108 wrote to memory of 1584 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 31 PID 1108 wrote to memory of 1584 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 31 PID 1108 wrote to memory of 1584 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 31 PID 1108 wrote to memory of 2700 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 32 PID 1108 wrote to memory of 2700 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 32 PID 1108 wrote to memory of 2700 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 32 PID 1108 wrote to memory of 2700 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 32 PID 1108 wrote to memory of 2712 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 33 PID 1108 wrote to memory of 2712 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 33 PID 1108 wrote to memory of 2712 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 33 PID 1108 wrote to memory of 2712 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 33 PID 1108 wrote to memory of 3136 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 36 PID 1108 wrote to memory of 3136 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 36 PID 1108 wrote to memory of 3136 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 36 PID 1108 wrote to memory of 3136 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 36 PID 3136 wrote to memory of 3292 3136 net.exe 38 PID 3136 wrote to memory of 3292 3136 net.exe 38 PID 3136 wrote to memory of 3292 3136 net.exe 38 PID 3136 wrote to memory of 3292 3136 net.exe 38 PID 1108 wrote to memory of 3300 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 39 PID 1108 wrote to memory of 3300 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 39 PID 1108 wrote to memory of 3300 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 39 PID 1108 wrote to memory of 3300 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 39 PID 3300 wrote to memory of 3340 3300 net.exe 41 PID 3300 wrote to memory of 3340 3300 net.exe 41 PID 3300 wrote to memory of 3340 3300 net.exe 41 PID 3300 wrote to memory of 3340 3300 net.exe 41 PID 1108 wrote to memory of 3364 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 42 PID 1108 wrote to memory of 3364 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 42 PID 1108 wrote to memory of 3364 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 42 PID 1108 wrote to memory of 3364 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 42 PID 1108 wrote to memory of 3504 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 44 PID 1108 wrote to memory of 3504 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 44 PID 1108 wrote to memory of 3504 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 44 PID 1108 wrote to memory of 3504 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 44 PID 3364 wrote to memory of 3604 3364 net.exe 46 PID 3364 wrote to memory of 3604 3364 net.exe 46 PID 3364 wrote to memory of 3604 3364 net.exe 46 PID 3364 wrote to memory of 3604 3364 net.exe 46 PID 3504 wrote to memory of 4080 3504 net.exe 47 PID 3504 wrote to memory of 4080 3504 net.exe 47 PID 3504 wrote to memory of 4080 3504 net.exe 47 PID 3504 wrote to memory of 4080 3504 net.exe 47 PID 1108 wrote to memory of 4912 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 52 PID 1108 wrote to memory of 4912 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 52 PID 1108 wrote to memory of 4912 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 52 PID 1108 wrote to memory of 4912 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 52 PID 1108 wrote to memory of 564 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 51 PID 1108 wrote to memory of 564 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 51 PID 1108 wrote to memory of 564 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 51 PID 1108 wrote to memory of 564 1108 de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe 51 PID 564 wrote to memory of 1012 564 net.exe 55 PID 564 wrote to memory of 1012 564 net.exe 55 PID 564 wrote to memory of 1012 564 net.exe 55 PID 564 wrote to memory of 1012 564 net.exe 55
Processes
-
C:\Users\Admin\AppData\Local\Temp\de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe"C:\Users\Admin\AppData\Local\Temp\de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b.exe"1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Users\Admin\AppData\Local\Temp\vRZSIYUWerep.exe"C:\Users\Admin\AppData\Local\Temp\vRZSIYUWerep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\LMHyZYTwZlan.exe"C:\Users\Admin\AppData\Local\Temp\LMHyZYTwZlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1476
-
-
C:\Users\Admin\AppData\Local\Temp\XIrYqECZKlan.exe"C:\Users\Admin\AppData\Local\Temp\XIrYqECZKlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1584
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2700
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2712
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3292
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3340
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3364 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3604
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4080
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:564 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1012
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:4912
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3808
-
-
-
C:\Windows\SysWOW64\SCHTASKS.exeSCHTASKS /CREATE /NP /SC DAILY /TN "PrintN8" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\KYNDS.dll" /ST 10:25 /SD 04/24/2021 /ED 05/01/20212⤵
- Creates scheduled task(s)
PID:4868
-