Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10/07/2021, 10:35
Static task
static1
Behavioral task
behavioral1
Sample
703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe
-
Size
117KB
-
MD5
31db87c5d3b970b42cb577611f851c7a
-
SHA1
8cc6a1f94514033ad8b15c3c4c720fb0eac249f1
-
SHA256
703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f
-
SHA512
d00d566f7385accd173669c9f8f6868626287e0ed4a6a08b174af9f6d054b70aed3babfa91450caa085134a2e75db42802a9cc11790c923ece3a4042d161be4a
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'PrWUilDMFi'; $torlink = 'http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://rdmnobnbtxh5sm3iiczazaregkpyyub3gktwneeehx62tyot5bc4qhad.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 2016 bwUAskFLyrep.exe 1248 XCBkacnNxlan.exe 2624 rdpbIeHjQlan.exe -
Loads dropped DLL 6 IoCs
pid Process 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2672 icacls.exe 2684 icacls.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-openide-windows_zh_CN.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ug\LC_MESSAGES\vlc.mo 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0187895.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341634.JPG 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Microsoft Office\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Annotations\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099170.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107496.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.ui.sdk.scheduler_1.2.0.v20140422-1847.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107158.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jre7\lib\fonts\LucidaTypewriterRegular.ttf 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\Bahia 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099179.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0297757.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE03466_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02040U.BMP 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\lv\LC_MESSAGES\vlc.mo 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Stationery\Roses.jpg 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01074_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HM00172_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-openide-modules.xml 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BOATINST.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PE05930_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02617_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ro-RO\tipresx.dll.mui 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_ja.properties 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.e4.core.commands.nl_ja_4.4.0.v20140623020002.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.jarprocessor.nl_zh_4.4.0.v20140623020002.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02466U.BMP 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\7-Zip\Lang\hr.txt 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-charts_zh_CN.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00612_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.XML 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LEVEL\LEVEL.INF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\deploy\messages_sv.properties 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.ui.ja_5.5.0.165303.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\St_Johns 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\BabyGirl\16_9-frame-highlight.png 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\Passport.wmv 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-autoupdate-ui_zh_CN.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\update_tracking\org-netbeans-api-annotations-common.xml 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0175428.JPG 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA00454_.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Atlantic\Stanley 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.RSA 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.equinox.p2.rcp.feature_1.2.0.v20140523-0116\META-INF\ECLIPSE_.SF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx.ja_5.5.0.165303.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\LAYERS\LAYERS.INF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-heapdump_ja.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\sv\LC_MESSAGES\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ARCTIC\THMBNAIL.PNG 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\as_IN\LC_MESSAGES\vlc.mo 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\VideoLAN\VLC\plugins\audio_filter\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\1.7\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099200.GIF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\security\RyukReadMe.html 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT+4 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\Etc\GMT 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.core.filesystem_1.4.100.v20140514-1614.jar 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0103402.WMF 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0341455.JPG 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1688 wrote to memory of 2016 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 29 PID 1688 wrote to memory of 2016 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 29 PID 1688 wrote to memory of 2016 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 29 PID 1688 wrote to memory of 2016 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 29 PID 1688 wrote to memory of 1248 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 30 PID 1688 wrote to memory of 1248 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 30 PID 1688 wrote to memory of 1248 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 30 PID 1688 wrote to memory of 1248 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 30 PID 1688 wrote to memory of 2624 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 31 PID 1688 wrote to memory of 2624 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 31 PID 1688 wrote to memory of 2624 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 31 PID 1688 wrote to memory of 2624 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 31 PID 1688 wrote to memory of 2672 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 32 PID 1688 wrote to memory of 2672 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 32 PID 1688 wrote to memory of 2672 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 32 PID 1688 wrote to memory of 2672 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 32 PID 1688 wrote to memory of 2684 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 33 PID 1688 wrote to memory of 2684 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 33 PID 1688 wrote to memory of 2684 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 33 PID 1688 wrote to memory of 2684 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 33 PID 1688 wrote to memory of 2716 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 38 PID 1688 wrote to memory of 2716 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 38 PID 1688 wrote to memory of 2716 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 38 PID 1688 wrote to memory of 2716 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 38 PID 1688 wrote to memory of 2776 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 37 PID 1688 wrote to memory of 2776 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 37 PID 1688 wrote to memory of 2776 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 37 PID 1688 wrote to memory of 2776 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 37 PID 2776 wrote to memory of 3552 2776 net.exe 42 PID 2776 wrote to memory of 3552 2776 net.exe 42 PID 2776 wrote to memory of 3552 2776 net.exe 42 PID 2776 wrote to memory of 3552 2776 net.exe 42 PID 2716 wrote to memory of 3536 2716 net.exe 41 PID 2716 wrote to memory of 3536 2716 net.exe 41 PID 2716 wrote to memory of 3536 2716 net.exe 41 PID 2716 wrote to memory of 3536 2716 net.exe 41 PID 1688 wrote to memory of 3476 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 44 PID 1688 wrote to memory of 3476 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 44 PID 1688 wrote to memory of 3476 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 44 PID 1688 wrote to memory of 3476 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 44 PID 1688 wrote to memory of 3304 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 43 PID 1688 wrote to memory of 3304 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 43 PID 1688 wrote to memory of 3304 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 43 PID 1688 wrote to memory of 3304 1688 703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe 43 PID 3476 wrote to memory of 3224 3476 net.exe 47 PID 3476 wrote to memory of 3224 3476 net.exe 47 PID 3476 wrote to memory of 3224 3476 net.exe 47 PID 3476 wrote to memory of 3224 3476 net.exe 47 PID 3304 wrote to memory of 2864 3304 net.exe 48 PID 3304 wrote to memory of 2864 3304 net.exe 48 PID 3304 wrote to memory of 2864 3304 net.exe 48 PID 3304 wrote to memory of 2864 3304 net.exe 48
Processes
-
C:\Users\Admin\AppData\Local\Temp\703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe"C:\Users\Admin\AppData\Local\Temp\703ee3222eccd0e355b9ef414be9153fa3a2ad8efb8176fee887d7744a9f632f.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Local\Temp\bwUAskFLyrep.exe"C:\Users\Admin\AppData\Local\Temp\bwUAskFLyrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:2016
-
-
C:\Users\Admin\AppData\Local\Temp\XCBkacnNxlan.exe"C:\Users\Admin\AppData\Local\Temp\XCBkacnNxlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:1248
-
-
C:\Users\Admin\AppData\Local\Temp\rdpbIeHjQlan.exe"C:\Users\Admin\AppData\Local\Temp\rdpbIeHjQlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:2624
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2672
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2684
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2776 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3552
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2716 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:3536
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3304 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2864
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3476 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:3224
-
-