Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
28-01-2022 10:29
Static task
static1
Behavioral task
behavioral1
Sample
860e50.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
860e50.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
-
Target
860e50.exe
-
Size
196KB
-
MD5
484a2bcb1335ac97ee91194f4c0964bc
-
SHA1
ad11ed52ab33ad05eb9b1e9ade134ca1348acc81
-
SHA256
40b865d1c3ab1b8544bcf57c88edd30679870d40b27d62feb237a19f0c5f9cd1
-
SHA512
6e61612bd29425c5ab9b648fa83bc2d8616071247f8659aa316ab9d4adde0a9ceb9301737bb4216db223dfdd371106da75463f6d7e3a88e1c4cdd6c821f3935f
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
Family
ryuk
Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������
Emails
Extracted
Path
C:\Users\RyukReadMe.html
Family
ryuk
Ransom Note
[email protected]
balance of shadow universe
Ryuk
Emails
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 1 IoCs
pid Process 652 vcBafeT.exe -
Loads dropped DLL 2 IoCs
pid Process 1632 860e50.exe 1632 860e50.exe -
Modifies file permissions 1 TTPs 4 IoCs
pid Process 988 icacls.exe 1032 icacls.exe 1772 icacls.exe 552 icacls.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\860e50.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\vcBafeT.exe" reg.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\OneNote.en-us\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\DD01186_.WMF 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0106572.WMF 860e50.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Triedit\fr-FR\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\VideoLAN Website.url 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Proof.en\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\PreviousMenuButtonIcon.png 860e50.exe File opened for modification C:\Program Files\Windows Portable Devices\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00247_.WMF 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\VBA\VBA7\1033\FM20.CHM 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105266.WMF 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\LC_MESSAGES\vlc.mo 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\settings_box_top.png 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\REFINED\PREVIEW.GIF 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\images\next_rest.png 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\BLUECALM\THMBNAIL.PNG 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD02071_.WMF 860e50.exe File opened for modification C:\Program Files\Microsoft Games\FreeCell\es-ES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\button_right_mousedown.png 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\MediaCenter.Gadget\images\Gadget_Main_Background_QuickLaunch.png 860e50.exe File opened for modification C:\Program Files (x86)\Internet Explorer\SIGNUP\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00202_.WMF 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00084_.WMF 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\cgg\LC_MESSAGES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ky\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\favicon.ico 860e50.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\NavigationUp_ButtonGraphic.png 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\Images\settings_box_top.png 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0099174.WMF 860e50.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt 860e50.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Stationery\Orange Circles.htm 860e50.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskpred.xml 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\de-DE\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\EN00902_.WMF 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\base-docked.png 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\RSSFeeds.Gadget\fr-FR\js\settings.js 860e50.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\title_stripe.png 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\skins\skin.catalog 860e50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\VDKHome\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\Smart Tag\LISTS\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\System\ado\msado25.tlb 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\da\LC_MESSAGES\vlc.mo 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\fr-FR\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Rectangles\1047x576black.png 860e50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Tracker\br.gif 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\GRPHFLT\MS.CGM 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0101859.BMP 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\drag.png 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\SlideShow.Gadget\es-ES\settings.html 860e50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-V 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\tet\LC_MESSAGES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\OFFICE14\Office Setup Controller\Office.en-us\SETUP.CHM 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BS00438_.WMF 860e50.exe File opened for modification C:\Program Files\RepairExport.jpg 860e50.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\fr-FR\css\weather.css 860e50.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\MinionPro-BoldIt.otf 860e50.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\bs\LC_MESSAGES\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\AN00790_.WMF 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\ink\ja-JP\RyukReadMe.html 860e50.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SKY\THMBNAIL.PNG 860e50.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\BL00248_.WMF 860e50.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 2 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 1544 vssadmin.exe 2024 vssadmin.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
pid Process 1632 860e50.exe 1632 860e50.exe 652 vcBafeT.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 652 vcBafeT.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 1632 860e50.exe 652 vcBafeT.exe 1632 860e50.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1632 860e50.exe Token: SeBackupPrivilege 652 vcBafeT.exe Token: SeBackupPrivilege 1632 860e50.exe Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe Token: SeSecurityPrivilege 1724 WMIC.exe Token: SeTakeOwnershipPrivilege 1724 WMIC.exe Token: SeLoadDriverPrivilege 1724 WMIC.exe Token: SeSystemProfilePrivilege 1724 WMIC.exe Token: SeSystemtimePrivilege 1724 WMIC.exe Token: SeProfSingleProcessPrivilege 1724 WMIC.exe Token: SeIncBasePriorityPrivilege 1724 WMIC.exe Token: SeCreatePagefilePrivilege 1724 WMIC.exe Token: SeBackupPrivilege 1724 WMIC.exe Token: SeRestorePrivilege 1724 WMIC.exe Token: SeShutdownPrivilege 1724 WMIC.exe Token: SeDebugPrivilege 1724 WMIC.exe Token: SeSystemEnvironmentPrivilege 1724 WMIC.exe Token: SeRemoteShutdownPrivilege 1724 WMIC.exe Token: SeUndockPrivilege 1724 WMIC.exe Token: SeManageVolumePrivilege 1724 WMIC.exe Token: 33 1724 WMIC.exe Token: 34 1724 WMIC.exe Token: 35 1724 WMIC.exe Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe Token: SeIncreaseQuotaPrivilege 1884 WMIC.exe Token: SeSecurityPrivilege 1884 WMIC.exe Token: SeTakeOwnershipPrivilege 1884 WMIC.exe Token: SeLoadDriverPrivilege 1884 WMIC.exe Token: SeSystemProfilePrivilege 1884 WMIC.exe Token: SeSystemtimePrivilege 1884 WMIC.exe Token: SeProfSingleProcessPrivilege 1884 WMIC.exe Token: SeIncBasePriorityPrivilege 1884 WMIC.exe Token: SeCreatePagefilePrivilege 1884 WMIC.exe Token: SeBackupPrivilege 1884 WMIC.exe Token: SeRestorePrivilege 1884 WMIC.exe Token: SeShutdownPrivilege 1884 WMIC.exe Token: SeDebugPrivilege 1884 WMIC.exe Token: SeSystemEnvironmentPrivilege 1884 WMIC.exe Token: SeRemoteShutdownPrivilege 1884 WMIC.exe Token: SeUndockPrivilege 1884 WMIC.exe Token: SeManageVolumePrivilege 1884 WMIC.exe Token: 33 1884 WMIC.exe Token: 34 1884 WMIC.exe Token: 35 1884 WMIC.exe Token: SeIncreaseQuotaPrivilege 1724 WMIC.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1632 wrote to memory of 652 1632 860e50.exe 27 PID 1632 wrote to memory of 652 1632 860e50.exe 27 PID 1632 wrote to memory of 652 1632 860e50.exe 27 PID 1632 wrote to memory of 652 1632 860e50.exe 27 PID 1632 wrote to memory of 1220 1632 860e50.exe 15 PID 1632 wrote to memory of 856 1632 860e50.exe 28 PID 1632 wrote to memory of 856 1632 860e50.exe 28 PID 1632 wrote to memory of 856 1632 860e50.exe 28 PID 1632 wrote to memory of 856 1632 860e50.exe 28 PID 1632 wrote to memory of 1468 1632 860e50.exe 30 PID 1632 wrote to memory of 1468 1632 860e50.exe 30 PID 1632 wrote to memory of 1468 1632 860e50.exe 30 PID 1632 wrote to memory of 1468 1632 860e50.exe 30 PID 856 wrote to memory of 1400 856 net.exe 32 PID 856 wrote to memory of 1400 856 net.exe 32 PID 856 wrote to memory of 1400 856 net.exe 32 PID 856 wrote to memory of 1400 856 net.exe 32 PID 1468 wrote to memory of 816 1468 net.exe 33 PID 1468 wrote to memory of 816 1468 net.exe 33 PID 1468 wrote to memory of 816 1468 net.exe 33 PID 1468 wrote to memory of 816 1468 net.exe 33 PID 1632 wrote to memory of 1312 1632 860e50.exe 14 PID 652 wrote to memory of 988 652 vcBafeT.exe 34 PID 652 wrote to memory of 988 652 vcBafeT.exe 34 PID 652 wrote to memory of 988 652 vcBafeT.exe 34 PID 652 wrote to memory of 988 652 vcBafeT.exe 34 PID 652 wrote to memory of 1032 652 vcBafeT.exe 35 PID 652 wrote to memory of 1032 652 vcBafeT.exe 35 PID 652 wrote to memory of 1032 652 vcBafeT.exe 35 PID 652 wrote to memory of 1032 652 vcBafeT.exe 35 PID 652 wrote to memory of 1680 652 vcBafeT.exe 38 PID 652 wrote to memory of 1680 652 vcBafeT.exe 38 PID 652 wrote to memory of 1680 652 vcBafeT.exe 38 PID 652 wrote to memory of 1680 652 vcBafeT.exe 38 PID 652 wrote to memory of 1544 652 vcBafeT.exe 40 PID 652 wrote to memory of 1544 652 vcBafeT.exe 40 PID 652 wrote to memory of 1544 652 vcBafeT.exe 40 PID 652 wrote to memory of 1544 652 vcBafeT.exe 40 PID 652 wrote to memory of 852 652 vcBafeT.exe 42 PID 652 wrote to memory of 852 652 vcBafeT.exe 42 PID 652 wrote to memory of 852 652 vcBafeT.exe 42 PID 652 wrote to memory of 852 652 vcBafeT.exe 42 PID 852 wrote to memory of 1912 852 net.exe 44 PID 852 wrote to memory of 1912 852 net.exe 44 PID 852 wrote to memory of 1912 852 net.exe 44 PID 852 wrote to memory of 1912 852 net.exe 44 PID 1680 wrote to memory of 1884 1680 cmd.exe 45 PID 1680 wrote to memory of 1884 1680 cmd.exe 45 PID 1680 wrote to memory of 1884 1680 cmd.exe 45 PID 1680 wrote to memory of 1884 1680 cmd.exe 45 PID 1632 wrote to memory of 1772 1632 860e50.exe 46 PID 1632 wrote to memory of 1772 1632 860e50.exe 46 PID 1632 wrote to memory of 1772 1632 860e50.exe 46 PID 1632 wrote to memory of 1772 1632 860e50.exe 46 PID 1632 wrote to memory of 552 1632 860e50.exe 47 PID 1632 wrote to memory of 552 1632 860e50.exe 47 PID 1632 wrote to memory of 552 1632 860e50.exe 47 PID 1632 wrote to memory of 552 1632 860e50.exe 47 PID 1632 wrote to memory of 2016 1632 860e50.exe 49 PID 1632 wrote to memory of 2016 1632 860e50.exe 49 PID 1632 wrote to memory of 2016 1632 860e50.exe 49 PID 1632 wrote to memory of 2016 1632 860e50.exe 49 PID 1632 wrote to memory of 2024 1632 860e50.exe 52 PID 1632 wrote to memory of 2024 1632 860e50.exe 52
Processes
-
C:\Users\Admin\AppData\Local\Temp\860e50.exe"C:\Users\Admin\AppData\Local\Temp\860e50.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1632 -
C:\Users\Admin\AppData\Local\Temp\vcBafeT.exe"C:\Users\Admin\AppData\Local\Temp\vcBafeT.exe" 8 LAN2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:988
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q3⤵
- Modifies file permissions
PID:1032
-
-
C:\Windows\SysWOW64\cmd.execmd /c "WMIC.exe shadowcopy delet"3⤵
- Suspicious use of WriteProcessMemory
PID:1680 -
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC.exe shadowcopy delet4⤵
- Suspicious use of AdjustPrivilegeToken
PID:1884
-
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /all /quiet3⤵
- Interacts with shadow copies
PID:1544
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:852 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\vcBafeT.exe" /f /reg:643⤵PID:17420
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\vcBafeT.exe" /f /reg:644⤵
- Adds Run key to start application
PID:17444
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵PID:63008
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:63040
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1400
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:816
-
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1772
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:552
-
-
C:\Windows\SysWOW64\cmd.execmd /c "WMIC.exe shadowcopy delet"2⤵PID:2016
-
C:\Windows\SysWOW64\Wbem\WMIC.exeWMIC.exe shadowcopy delet3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1724
-
-
-
C:\Windows\SysWOW64\vssadmin.exevssadmin.exe Delete Shadows /all /quiet2⤵
- Interacts with shadow copies
PID:2024
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:1100
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:760
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\860e50.exe" /f /reg:642⤵PID:1592
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\860e50.exe" /f /reg:643⤵
- Adds Run key to start application
PID:1676
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:37724
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:37828
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:50884
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:50568
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:60860
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:60900
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵PID:63420
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:63444
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1312
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1220
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵PID:588