Analysis
-
max time kernel
273s -
max time network
66s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
27-04-2021 14:41
Static task
static1
Behavioral task
behavioral1
Sample
rabid-explanation.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
-
Target
rabid-explanation.exe
-
Size
205KB
-
MD5
7971b1a36647406d5d150a12087744f5
-
SHA1
2fb4a5b516d6a41688245d28a8030af24a2e250c
-
SHA256
c3ccfd4dd4b5d6bcde6ce0c5eed8ee12f8a2b4a5bec4bd6d06805689f412f23f
-
SHA512
527ea88e6c948c809eb5940c53b9f47715fdcf0f88466270e99ea35b2757a8cbde8d9a0fb4ae52c43393c1b1a3248077e14e7aefd3ebbb6103091cf18bde977d
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.html
Family
ryuk
Ransom Note
[email protected]
[email protected]
balance of shadow universe
Ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops file in Drivers directory 18 IoCs
description ioc Process File opened for modification C:\Windows\System32\drivers\etc\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\drivers\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\drivers\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\drivers\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\en-US\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\drivers\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\drivers\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\drivers\UMDF\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\drivers\UMDF\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\drivers\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\drivers\etc\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\drivers\en-US\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\drivers\UMDF\en-US\RyukReadMe.html rabid-explanation.exe -
Modifies extensions of user files 26 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File opened for modification C:\Users\Admin\Pictures\DisableSuspend.tif.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\UseFind.raw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\EnterRevoke.crw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\CompleteRemove.tif.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\AssertPush.png.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\DisableSuspend.tif.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\AssertPush.png.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\ExpandSuspend.crw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\CheckpointRestart.crw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\FindDebug.crw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\InstallStop.crw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\UseFind.raw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\BackupEdit.tiff.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\StartUse.tif.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\BackupEdit.tiff.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\InstallStop.crw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\CompleteRemove.tif.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\CloseUnblock.raw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\CheckpointRestart.crw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\StartUse.tif.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\ExpandSuspend.crw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\SubmitSuspend.tiff.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\FindDebug.crw.RYK rabid-explanation.exe File opened for modification C:\Users\Admin\Pictures\CloseUnblock.raw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\EnterRevoke.crw.RYK taskhost.exe File opened for modification C:\Users\Admin\Pictures\SubmitSuspend.tiff.RYK taskhost.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html taskhost.exe -
Drops desktop.ini file(s) 64 IoCs
description ioc Process File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Default\Start Menu\Programs\Maintenance\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Public\Recorded TV\Sample Media\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H18KNA1T\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H18KNA1T\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\Sample Videos\desktop.ini taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VNYR844D\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Games\desktop.ini rabid-explanation.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\DataServices\DESKTOP.INI taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NU1L7O13\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Public\Recorded TV\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Default\SendTo\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\HNHPAZTY\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\Sample Music\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Default\Start Menu\Programs\Accessories\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H18KNA1T\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VNYR844D\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\VFDYFLB4\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Public\Recorded TV\desktop.ini taskhost.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini taskhost.exe File opened for modification C:\Program Files (x86)\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E9RC2MV6\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Public\Libraries\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Administrative Tools\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\P8HHGB03\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Startup\desktop.ini rabid-explanation.exe File opened for modification C:\Documents and Settings\Public\Downloads\desktop.ini taskhost.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini rabid-explanation.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmbsb.inf_amd64_neutral_56a9f6bceeec7f72\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Schemas\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\DriverStore\en-US\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\wbem\AutoRecover\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmaus.inf_amd64_neutral_5fa4270b9924b918\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnep00a.inf_amd64_neutral_92a4c727cdf4c2f7\Amd64\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\en-US\Licenses\_Default\StarterE\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Host\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\XOMTMZ8J\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmgl003.inf_amd64_neutral_4c78da9e48068043\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnts003.inf_amd64_neutral_33a68664c7e7ae4b\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Examples\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\SessionConfig\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\v1.0\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\net1kx64.inf_amd64_neutral_1f62482fbb9e52a5\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\migwiz\dlmanifests\Microsoft-Windows-Sxs\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\nulhpopr.inf_amd64_neutral_e078ec466987bb3b\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnky007.inf_amd64_neutral_e637699044f367f3\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wpdmtp.inf_amd64_neutral_28f06ca2e38e8979\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\ws3cap.inf_amd64_neutral_eeaccb8f1560f5fb\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\WindowsPowerShell\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\de-DE\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\LogFiles\Fax\Incoming\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\SessionConfig\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\wdi\perftrack\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\netr28x.inf_amd64_neutral_c86d6d5c3810fc04\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wiaca00e.inf_amd64_neutral_5a376e6a7cb007d5\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\migwiz\dlmanifests\Microsoft-Windows-RasConnectionManager\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\Wininet\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\Configuration\Schema\MSFT_FileDirectoryConfiguration\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmmc288.inf_amd64_neutral_c4a901dab689ad79\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnca00d.inf_amd64_neutral_0600b2ba575729f4\Amd64\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\Printing_Admin_Scripts\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\spool\drivers\x64\3\en-US\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\IME\IMESC5\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\fr-FR\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prngt002.inf_amd64_neutral_df2060d80de9ff13\Amd64\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\Tcpip\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\IME\imekr8\dicts\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\Microsoft.PowerShell.Security\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\WindowsPowerShell\v1.0\Modules\PSDesiredStateConfiguration\DSCResources\MSFT_ServiceResource\en-US\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\iirsp.inf_amd64_neutral_25c14d33af7f54f1\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnxx002.inf_amd64_neutral_560fdd891b24f384\Amd64\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wialx005.inf_amd64_neutral_5304c93e2193f237\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\Microsoft\Protect\S-1-5-18\User\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\Msdtc\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\Tasks\Microsoft\Windows\WDI\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\fi-FI\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\SysWOW64\IME\imekr8\applets\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\History\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmdcm5.inf_amd64_neutral_0bb09f3e5a59f3a8\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prngt003.inf_amd64_neutral_8c9aae54a5673a35\Amd64\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\prnrc006.inf_amd64_neutral_7e12a60cc98d3f89\Amd64\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\sisraid4.inf_amd64_neutral_65ab84e9830f6f4b\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\en-US\Licenses\OEM\UltimateN\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\InstallShield\setupdir\0005\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SysWOW64\pt-BR\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\mdmwhql0.inf_amd64_neutral_23613e3dd9401f10\RyukReadMe.html rabid-explanation.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\db\lib\derbyLocale_pl.jar taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Cayman rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.extensionlocation.nl_ja_4.4.0.v20140623020002.jar rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\en-US\js\currency.js rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00136_.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\square.png rabid-explanation.exe File opened for modification C:\Program Files\7-Zip\Lang\kab.txt rabid-explanation.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\hi\LC_MESSAGES\vlc.mo rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\OutlookAutoDiscover\YAHOO.NO.XML taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\EST5EDT taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.core_2.3.0.v20131211-1531.jar rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Clarity.eftx.RYK rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\FieldTypePreview\CONTACT.JPG rabid-explanation.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Calendar.Gadget\images\bg-desk.png taskhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\CPU.Gadget\images\glass.png rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-core-startup.xml taskhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\undocked_black_moon-last-quarter.png taskhost.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins3d\prcr.x3d.RYK rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Origin.thmx.RYK rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02749U.BMP rabid-explanation.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ipsptg.xml taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\lib\org-openide-modules.jar rabid-explanation.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\br\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Analysis Services\AS OLEDB\10\Cartridges\sql90.xsl taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105338.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0185780.WMF rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02845G.GIF rabid-explanation.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Garden.htm rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Asia\Hovd taskhost.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\config\Modules\org-netbeans-modules-autoupdate-ui.xml rabid-explanation.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sk\LC_MESSAGES\vlc.mo taskhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_corner_top_right.png rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR30B.GIF taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGZIP.DPV taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\main\zh-dayi.xml taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107344.WMF rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms5\utilityfunctions.js taskhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\docked_gray_rainy.png taskhost.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0287641.JPG taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Templates\1033\EssentialLetter.dotx rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Blanc-Sablon taskhost.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_right.png rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD21343_.GIF rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBFTSCM\SCHEME05.CSS.RYK rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\RES98.POC rabid-explanation.exe File opened for modification C:\Program Files\GroupWait.mp3 taskhost.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Chihuahua taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0198712.WMF rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ACCWIZ\ACWZTOOL.ACCDE taskhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\RyukReadMe.html taskhost.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Notebook.jpg rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.alert.ja_5.5.0.165303.jar rabid-explanation.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\CANYON\RyukReadMe.html taskhost.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\CommonData\AlertImage_AutoMask.bmp taskhost.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\5.png rabid-explanation.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\ZPDIR3F.GIF taskhost.exe File opened for modification C:\Program Files\Common Files\SpeechEngines\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Full\NavigationRight_ButtonGraphic.png rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Africa\Khartoum rabid-explanation.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.ecf.filetransfer.ssl.feature_1.0.0.v20140827-1444\feature.xml taskhost.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\assembly\GAC_32\Policy.1.7.Microsoft.Ink\6.1.0.0__31bf3856ad364e35\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-eventviewer.resources_31bf3856ad364e35_6.1.7600.16385_en-us_809afd26837a22dc\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-help-desk.resources_31bf3856ad364e35_6.1.7600.16385_en-us_d635d9649c89994d\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..rovider-grouppolicy_31bf3856ad364e35_6.1.7600.16385_none_b66f27da44d832be\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_devicepairingproxy_31bf3856ad364e35_6.1.7600.16385_none_3044683777265932\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-i..tocolimplementation_31bf3856ad364e35_8.0.7601.17514_none_1eaaa4a07717236e\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-n..ecenforcementclient_31bf3856ad364e35_6.1.7600.16385_none_99876efdaff63d60\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..erver-adm.resources_31bf3856ad364e35_6.1.7601.17514_en-us_fa18d6953ed8537e\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-w..d-line-utility-base_31bf3856ad364e35_6.1.7600.16385_none_69c0c0c8dd122d42\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_networking-mpssvc-netsh.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4285fd252bd260cf\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-snmp-evntcmd.resources_31bf3856ad364e35_6.1.7600.16385_en-us_307fdc0a15eccc8a\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Tools.Office.Excel.AddInProxy.v9.0\9.0.0.0__b03f5f7f11d50a3a\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehRecObj\6e35ba22c9762646d5294dd919175c69\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\inf\ASP.NET_4.0.30319\0005\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..rtingcore.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5f087cbd507d8e79\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lsa-msprivs.resources_31bf3856ad364e35_6.1.7600.16385_sv-se_a86f224d5acff0f9\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-p..ntservice.resources_31bf3856ad364e35_6.1.7600.16385_en-us_6c56ddd15407ddc4\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_server-help-chm.iscsi_init.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0f9d2e30caa9dc15\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\msil_microsoft.data.odata.powershell_31bf3856ad364e35_7.2.7601.23317_none_c4679d126b510abe\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\GAC_MSIL\EventViewer\6.1.0.0__31bf3856ad364e35\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Datab086ae17#\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-d..fontcache.resources_31bf3856ad364e35_7.1.7601.16492_zh-tw_839e734a1796c923\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-main_31bf3856ad364e35_6.1.7601.17514_none_062284e03286a56a\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-r..onmanager.resources_31bf3856ad364e35_6.1.7600.16385_en-us_8a11d6161cd73573\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sharedaccess.resources_31bf3856ad364e35_6.1.7600.16385_en-us_0af98f1835676d1b\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\temp\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Dynamic\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-directwrite.resources_31bf3856ad364e35_7.1.7601.16492_el-gr_e065b5e1703ceaf2\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mlang.resources_31bf3856ad364e35_6.1.7600.16385_lv-lv_590a53ebcddc8988\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-vssapi.resources_31bf3856ad364e35_6.1.7600.16385_en-us_41850747ece57d4a\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_prnlx00w.inf_31bf3856ad364e35_6.1.7600.16385_none_6c94f42f8b3d174b\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-sort.resources_31bf3856ad364e35_6.1.7600.16385_en-us_419ec3a3e1271d4c\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-gadgets-cpu.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4d6aa30008b38d10\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-a..mecontrol.resources_31bf3856ad364e35_6.1.7600.16385_en-us_392ce9a7ba4fe7e8\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-pcw_31bf3856ad364e35_6.1.7600.16385_none_0c06880570316dc3\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\mcepg\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\inf\SMSvcHost 4.0.0.0\000C\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_netfx-mscorjit_dll_b03f5f7f11d50a3a_6.1.7601.17514_none_4c0bcee0d9569e7d\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..fications.resources_31bf3856ad364e35_6.1.7600.16385_en-us_5c96576a9068f18b\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..nts-mdac-rds-ce-jvs_31bf3856ad364e35_6.1.7600.16385_none_618fce9aa33b1d9a\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_th-th_02d82a69a4c2340c\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-mp3dmod_31bf3856ad364e35_6.1.7600.16385_none_49101b8df35d67af\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-eventcreate_31bf3856ad364e35_6.1.7600.16385_none_d53926c7a0e7716d\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-m..-odbc-administrator_31bf3856ad364e35_6.1.7600.16385_none_44263d819f0aa19e\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Policy.11.0.Microsoft.Office.Interop.Excel\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-e..rding-adm.resources_31bf3856ad364e35_6.1.7600.16385_en-us_2828f39a6ecfd138\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..recognition-gesture_31bf3856ad364e35_6.1.7600.16385_none_1053a150ee4d2f9f\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_netefe3e.inf.resources_31bf3856ad364e35_6.1.7600.16385_en-us_a966a241c5eb5467\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\amd64_prnnr002.inf_31bf3856ad364e35_6.1.7600.16385_none_b91afcc7c666b4b2\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\System.AddIn.Contra#\78ce3fd89c50ab2d8d0ffc42ad838644\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-dns-client.resources_31bf3856ad364e35_6.1.7600.16385_en-us_234809c32cf5e8cc\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..-credentialprovider_31bf3856ad364e35_6.1.7600.16385_none_e2ed533e1c868930\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-s..ineclient.resources_31bf3856ad364e35_6.1.7600.16385_en-us_4c9102273e6d925e\RyukReadMe.html rabid-explanation.exe File opened for modification C:\Windows\winsxs\x86_microsoft.windows.c..-controls.resources_6595b64144ccf1df_6.0.7600.16385_hu-hu_421025ea2f7eb50c\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\SoftwareDistribution\Download\d881ecfb1357f383d18f1e4fd0554eb0\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-iis-ftpsvc_31bf3856ad364e35_6.1.7601.17514_none_a8911c01ac406d53\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-lmhsvc_31bf3856ad364e35_6.1.7601.17514_none_b0e6edd606f5c524\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-m..river-rll.resources_31bf3856ad364e35_6.1.7600.16385_en-us_b6efab6cbc3c4985\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\amd64_microsoft-windows-t..-disconnecteddriver_31bf3856ad364e35_6.1.7600.16385_none_54c8c4896f2c3f21\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\wow64_microsoft-windows-s..ing-shell-extension_31bf3856ad364e35_6.1.7600.16385_none_70cb731d72554e78\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-comctl32-v5.resources_31bf3856ad364e35_6.1.7600.16385_lv-lv_d972d95f98936d9a\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\winsxs\x86_microsoft-windows-font-fms.resources_31bf3856ad364e35_6.1.7600.16385_ro-ro_37c08f610a91a0a2\RyukReadMe.html taskhost.exe File opened for modification C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Serialization.Xml\RyukReadMe.html rabid-explanation.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 1268 rabid-explanation.exe 1268 rabid-explanation.exe 1120 taskhost.exe 1268 rabid-explanation.exe 1268 rabid-explanation.exe 1120 taskhost.exe 1268 rabid-explanation.exe 1268 rabid-explanation.exe 1120 taskhost.exe 1268 rabid-explanation.exe 1268 rabid-explanation.exe 1120 taskhost.exe 1268 rabid-explanation.exe 1268 rabid-explanation.exe 1120 taskhost.exe 1268 rabid-explanation.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1268 rabid-explanation.exe Token: SeBackupPrivilege 1120 taskhost.exe Token: SeBackupPrivilege 1268 rabid-explanation.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1268 wrote to memory of 1120 1268 rabid-explanation.exe 17 PID 1268 wrote to memory of 1172 1268 rabid-explanation.exe 16 PID 1268 wrote to memory of 1864 1268 rabid-explanation.exe 26 PID 1268 wrote to memory of 1864 1268 rabid-explanation.exe 26 PID 1268 wrote to memory of 1864 1268 rabid-explanation.exe 26 PID 1268 wrote to memory of 1768 1268 rabid-explanation.exe 28 PID 1268 wrote to memory of 1768 1268 rabid-explanation.exe 28 PID 1268 wrote to memory of 1768 1268 rabid-explanation.exe 28 PID 1864 wrote to memory of 608 1864 net.exe 30 PID 1864 wrote to memory of 608 1864 net.exe 30 PID 1864 wrote to memory of 608 1864 net.exe 30 PID 1768 wrote to memory of 1692 1768 net.exe 31 PID 1768 wrote to memory of 1692 1768 net.exe 31 PID 1768 wrote to memory of 1692 1768 net.exe 31 PID 1120 wrote to memory of 752 1120 taskhost.exe 32 PID 1120 wrote to memory of 752 1120 taskhost.exe 32 PID 1120 wrote to memory of 752 1120 taskhost.exe 32 PID 752 wrote to memory of 108 752 net.exe 34 PID 752 wrote to memory of 108 752 net.exe 34 PID 752 wrote to memory of 108 752 net.exe 34 PID 1120 wrote to memory of 1092 1120 taskhost.exe 35 PID 1120 wrote to memory of 1092 1120 taskhost.exe 35 PID 1120 wrote to memory of 1092 1120 taskhost.exe 35 PID 1092 wrote to memory of 820 1092 net.exe 37 PID 1092 wrote to memory of 820 1092 net.exe 37 PID 1092 wrote to memory of 820 1092 net.exe 37 PID 1268 wrote to memory of 2332 1268 rabid-explanation.exe 38 PID 1268 wrote to memory of 2332 1268 rabid-explanation.exe 38 PID 1268 wrote to memory of 2332 1268 rabid-explanation.exe 38 PID 2332 wrote to memory of 2600 2332 net.exe 40 PID 2332 wrote to memory of 2600 2332 net.exe 40 PID 2332 wrote to memory of 2600 2332 net.exe 40 PID 1268 wrote to memory of 57024 1268 rabid-explanation.exe 46 PID 1268 wrote to memory of 57024 1268 rabid-explanation.exe 46 PID 1268 wrote to memory of 57024 1268 rabid-explanation.exe 46 PID 57024 wrote to memory of 57052 57024 net.exe 48 PID 57024 wrote to memory of 57052 57024 net.exe 48 PID 57024 wrote to memory of 57052 57024 net.exe 48 PID 1120 wrote to memory of 58128 1120 taskhost.exe 49 PID 1120 wrote to memory of 58128 1120 taskhost.exe 49 PID 1120 wrote to memory of 58128 1120 taskhost.exe 49 PID 58128 wrote to memory of 58156 58128 net.exe 51 PID 58128 wrote to memory of 58156 58128 net.exe 51 PID 58128 wrote to memory of 58156 58128 net.exe 51 PID 1268 wrote to memory of 58364 1268 rabid-explanation.exe 52 PID 1268 wrote to memory of 58364 1268 rabid-explanation.exe 52 PID 1268 wrote to memory of 58364 1268 rabid-explanation.exe 52 PID 58364 wrote to memory of 58148 58364 net.exe 54 PID 58364 wrote to memory of 58148 58364 net.exe 54 PID 58364 wrote to memory of 58148 58364 net.exe 54 PID 1268 wrote to memory of 77544 1268 rabid-explanation.exe 55 PID 1268 wrote to memory of 77544 1268 rabid-explanation.exe 55 PID 1268 wrote to memory of 77544 1268 rabid-explanation.exe 55 PID 77544 wrote to memory of 77604 77544 net.exe 57 PID 77544 wrote to memory of 77604 77544 net.exe 57 PID 77544 wrote to memory of 77604 77544 net.exe 57 PID 1120 wrote to memory of 81864 1120 taskhost.exe 58 PID 1120 wrote to memory of 81864 1120 taskhost.exe 58 PID 1120 wrote to memory of 81864 1120 taskhost.exe 58 PID 81864 wrote to memory of 81964 81864 net.exe 60 PID 81864 wrote to memory of 81964 81864 net.exe 60 PID 81864 wrote to memory of 81964 81864 net.exe 60 PID 1268 wrote to memory of 86336 1268 rabid-explanation.exe 61 PID 1268 wrote to memory of 86336 1268 rabid-explanation.exe 61
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:108
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:820
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:58128 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:58156
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:81864 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:81964
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:121872
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:122472
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:216920
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:216948
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:330612
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:333300
-
-
-
C:\Users\Admin\AppData\Local\Temp\rabid-explanation.exe"C:\Users\Admin\AppData\Local\Temp\rabid-explanation.exe"1⤵
- Drops file in Drivers directory
- Modifies extensions of user files
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1864 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:608
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1692
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2332 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2600
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:57024 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:57052
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:58364 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:58148
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:77544 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:77604
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:86336
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:86620
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:117636
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:117800
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:123068
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:123096
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:216876
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:216904
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:216964
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:216992
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:309256
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:309980
-
-
-
C:\Windows\System32\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:339188
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:339772
-
-