ryuk | 58c50cebcd8465aff4672fdf8beae81678bd16409addfaa8135506ca90967822

Analysis

max time kernel
302s
max time network
296s
platform
windows7_x64
resource
win7v20210410
submitted
23-04-2021 11:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aaf3abc4054f800aaa429c4f2e4b20af.exe
Size

274KB
MD5

aaf3abc4054f800aaa429c4f2e4b20af
SHA1

16e859c1222b7f4dba2361480ce33a0564e4cabf
SHA256

de2b5aa6de6f7ff053308084217f7a9b977489027fb103729d6a7d94298c6a6b
SHA512

650e515d0ec199efa74ed4bb2e0f622da609b9559d2663c990bb5310997f44785408f0ed2c35405445962abe33ba74266bc7f3c8b5afa0b8035856364f4e2de6

Score

10^/10

ryuk discovery ransomware

Malware Config

Extracted

Path

C:\users\Public\RyukReadMe.html

Family

ryuk

Ransom Note

contact balance of shadow universe Ryuk $password = '2neBqEej6'; $torlink = 'http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion'; function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};

URLs

http://rk2zzyh63g5avvii4irkhymha3irblchdfj7prk6zwy23f6kahidkpqd.onion

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 3 IoCs

pid	Process
1428	cWbjUeAXdrep.exe
1540	ONXQmIiltlan.exe
284	sznhNVmHylan.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

description	ioc	Process
File opened for modification	C:\Users\Admin\Pictures\AddDebug.crw.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\ExitSelect.tiff.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\HideAdd.tiff.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\ProtectWrite.raw.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\ReceiveWait.tif.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\SetInstall.tiff.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Users\Admin\Pictures\ConvertFromStart.crw.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe

Loads dropped DLL 6 IoCs

pid	Process
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2648	icacls.exe
2660	icacls.exe

Drops desktop.ini file(s) 1 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI	aaf3abc4054f800aaa429c4f2e4b20af.exe

Enumerates connected drives 3 TTPs 23 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\E:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\R:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\Q:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\L:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\J:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\H:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\I:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\G:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\Y:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\W:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\V:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\U:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\K:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\O:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\M:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\B:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\N:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\Z:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\X:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\T:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\S:	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened (read-only)	\??\P:	aaf3abc4054f800aaa429c4f2e4b20af.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL_COL.HXC.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\MSORES.DLL	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105390.WMF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\Rio_Branco.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\drvDX8.x3d.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Guatemala	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\lv\RyukReadMe.html	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\meta\art\00_musicbrainz.luac	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SPRING\SPRING.INF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Templates\1033\FiveRules.potx.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.httpclient4.ssl.feature_1.0.0.v20140827-1444\META-INF\ECLIPSE_.SF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\America\El_Salvador	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\Source Engine\RyukReadMe.html	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jre7\lib\zi\Etc\GMT-9.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\STS2\HEADER.GIF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\images\winXPBluHandle.png.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\HST	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RADIAL\RADIAL.INF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.e4.rcp_1.3.100.v20141007-2033\META-INF\MANIFEST.MF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_bullets.gif	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL065.XML.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado26.tlb	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099165.JPG.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02022_.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\STRTEDGE\STRTEDGE.ELM.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0211981.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGMN022.XML.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\DVD Maker\Shared\DvdStyles\SpecialOccasion\whitemask1047.png	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.event_1.3.100.v20140115-1647.jar	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\OPTINPS.DLL	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-api-annotations-common.jar	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA01361_.WMF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0195384.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE02262_.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Winnipeg	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\org-openide-execution.xml_hidden	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0196358.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\WATER\WATER.INF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT-12.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SONORA\SONORA.ELM.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\MET	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\http\view.html.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\SOCIALPROVIDER.DLL.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jre7\lib\resources.jar.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME24.CSS	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME36.CSS	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18220_.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187839.WMF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0186364.WMF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18241_.WMF	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Europe\Bucharest.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR31B.GIF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_hyperlink.gif.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.rcp_4.4.0.v20141007-2301\feature.properties	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-execution_zh_CN.jar	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Slipstream.xml	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\AUTOSHAP\BD18185_.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-sampler.jar.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OSETUP.DLL.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00183_.WMF.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382970.JPG.RYK	aaf3abc4054f800aaa429c4f2e4b20af.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

pid	Process
7188	SCHTASKS.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe
1096	aaf3abc4054f800aaa429c4f2e4b20af.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1428	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	29
PID 1096 wrote to memory of 1428	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	29
PID 1096 wrote to memory of 1428	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	29
PID 1096 wrote to memory of 1428	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	29
PID 1096 wrote to memory of 1540	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	30
PID 1096 wrote to memory of 1540	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	30
PID 1096 wrote to memory of 1540	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	30
PID 1096 wrote to memory of 1540	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	30
PID 1096 wrote to memory of 284	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	31
PID 1096 wrote to memory of 284	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	31
PID 1096 wrote to memory of 284	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	31
PID 1096 wrote to memory of 284	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	31
PID 1096 wrote to memory of 2648	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	32
PID 1096 wrote to memory of 2648	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	32
PID 1096 wrote to memory of 2648	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	32
PID 1096 wrote to memory of 2648	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	32
PID 1096 wrote to memory of 2660	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	35
PID 1096 wrote to memory of 2660	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	35
PID 1096 wrote to memory of 2660	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	35
PID 1096 wrote to memory of 2660	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	35
PID 1096 wrote to memory of 3456	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	36
PID 1096 wrote to memory of 3456	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	36
PID 1096 wrote to memory of 3456	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	36
PID 1096 wrote to memory of 3456	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	36
PID 3456 wrote to memory of 3656	3456	net.exe	38
PID 3456 wrote to memory of 3656	3456	net.exe	38
PID 3456 wrote to memory of 3656	3456	net.exe	38
PID 3456 wrote to memory of 3656	3456	net.exe	38
PID 1096 wrote to memory of 3748	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	39
PID 1096 wrote to memory of 3748	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	39
PID 1096 wrote to memory of 3748	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	39
PID 1096 wrote to memory of 3748	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	39
PID 3748 wrote to memory of 3780	3748	net.exe	41
PID 3748 wrote to memory of 3780	3748	net.exe	41
PID 3748 wrote to memory of 3780	3748	net.exe	41
PID 3748 wrote to memory of 3780	3748	net.exe	41
PID 1096 wrote to memory of 3932	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	42
PID 1096 wrote to memory of 3932	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	42
PID 1096 wrote to memory of 3932	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	42
PID 1096 wrote to memory of 3932	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	42
PID 3932 wrote to memory of 3960	3932	net.exe	44
PID 3932 wrote to memory of 3960	3932	net.exe	44
PID 3932 wrote to memory of 3960	3932	net.exe	44
PID 3932 wrote to memory of 3960	3932	net.exe	44
PID 1096 wrote to memory of 3988	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	45
PID 1096 wrote to memory of 3988	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	45
PID 1096 wrote to memory of 3988	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	45
PID 1096 wrote to memory of 3988	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	45
PID 3988 wrote to memory of 4016	3988	net.exe	47
PID 3988 wrote to memory of 4016	3988	net.exe	47
PID 3988 wrote to memory of 4016	3988	net.exe	47
PID 3988 wrote to memory of 4016	3988	net.exe	47
PID 1096 wrote to memory of 7336	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	50
PID 1096 wrote to memory of 7336	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	50
PID 1096 wrote to memory of 7336	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	50
PID 1096 wrote to memory of 7336	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	50
PID 1096 wrote to memory of 7644	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	51
PID 1096 wrote to memory of 7644	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	51
PID 1096 wrote to memory of 7644	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	51
PID 1096 wrote to memory of 7644	1096	aaf3abc4054f800aaa429c4f2e4b20af.exe	51
PID 7644 wrote to memory of 7900	7644	net.exe	55
PID 7644 wrote to memory of 7900	7644	net.exe	55
PID 7644 wrote to memory of 7900	7644	net.exe	55
PID 7644 wrote to memory of 7900	7644	net.exe	55

C:\Users\Admin\AppData\Local\Temp\aaf3abc4054f800aaa429c4f2e4b20af.exe
"C:\Users\Admin\AppData\Local\Temp\aaf3abc4054f800aaa429c4f2e4b20af.exe"
1⤵
- Modifies extensions of user files
- Loads dropped DLL
- Drops desktop.ini file(s)
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\cWbjUeAXdrep.exe
  "C:\Users\Admin\AppData\Local\Temp\cWbjUeAXdrep.exe" 9 REP
  2⤵
  - Executes dropped EXE
  PID:1428
- C:\Users\Admin\AppData\Local\Temp\ONXQmIiltlan.exe
  "C:\Users\Admin\AppData\Local\Temp\ONXQmIiltlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:1540
- C:\Users\Admin\AppData\Local\Temp\sznhNVmHylan.exe
  "C:\Users\Admin\AppData\Local\Temp\sznhNVmHylan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  PID:284
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2648
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:2660
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3456
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3656
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3748
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:3780
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3960
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3988
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4016
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:7336
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:6772
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:7644
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:7900
- C:\Windows\SysWOW64\SCHTASKS.exe
  SCHTASKS /CREATE /NP /SC DAILY /TN "PrintM0" /TR "C:\Windows\System32\cmd.exe /c for /l %x in (1,1,50) do start wordpad.exe /p C:\users\Public\g1qE9.dll" /ST 10:25 /SD 04/24/2021 /ED 05/01/2021
  2⤵
  - Creates scheduled task(s)
  PID:7188
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:8788
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:8860
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:8804
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:8848

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

File and Directory Permissions Modification

T1222

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/284-81-0x0000000035000000-0x00000000376DF000-memory.dmp

Filesize
38.9MB

Download
memory/1096-60-0x00000000002A0000-0x00000000002BF000-memory.dmp

Filesize
124KB

Download
memory/1096-61-0x0000000035000000-0x00000000376DF000-memory.dmp

Filesize
38.9MB

Download
memory/1096-62-0x0000000075281000-0x0000000075283000-memory.dmp

Filesize
8KB

Download
memory/1428-68-0x0000000035000000-0x00000000376DF000-memory.dmp

Filesize
38.9MB

Download
memory/1540-74-0x0000000035000000-0x00000000376DF000-memory.dmp

Filesize
38.9MB

Download