ryuk | f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

General

Target

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
Size

113KB
MD5

8c7e7e483cd51fd209709cadcb982bcb
SHA1

fcce16c3e4906feec110e93fdf75f8a12b86cad8
SHA256

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0
SHA512

32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Executes dropped EXE 2 IoCs

Processes:

pWSWMuToLlan.exeuvlNazPvglan.exe

pid process

1640 pWSWMuToLlan.exe
676 uvlNazPvglan.exe

pid	process
1640	pWSWMuToLlan.exe
676	uvlNazPvglan.exe

Loads dropped DLL 4 IoCs

Processes:

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

pid	process
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

Modifies file permissions 1 TTPs 2 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exeicacls.exe

pid process

1696 icacls.exe
1468 icacls.exe

pid	process
1696	icacls.exe
1468	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\EV = "\uffff\ufffe\ufffeC:\\Users\\Admin\\AppData\\Local\\Temp\\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1936 vssadmin.exe
Runs net.exe

pid	process
1936	vssadmin.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

pid	process
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exepWSWMuToLlan.exeuvlNazPvglan.exeWMIC.exevssvc.exe

description	pid	process
Token: SeBackupPrivilege	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
Token: SeBackupPrivilege	1640	pWSWMuToLlan.exe
Token: SeBackupPrivilege	676	uvlNazPvglan.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: SeBackupPrivilege	1580	vssvc.exe
Token: SeRestorePrivilege	1580	vssvc.exe
Token: SeAuditPrivilege	1580	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exenet.exenet.exenet.exe

description	pid	process	target process
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	pWSWMuToLlan.exe
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	pWSWMuToLlan.exe
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	pWSWMuToLlan.exe
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	pWSWMuToLlan.exe
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	uvlNazPvglan.exe
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	uvlNazPvglan.exe
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	uvlNazPvglan.exe
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	uvlNazPvglan.exe
PID 788 wrote to memory of 1252	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	taskhost.exe
PID 788 wrote to memory of 1360	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	Dwm.exe
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 1072 wrote to memory of 1664	1072	net.exe	net1.exe
PID 1072 wrote to memory of 1664	1072	net.exe	net1.exe
PID 1072 wrote to memory of 1664	1072	net.exe	net1.exe
PID 1072 wrote to memory of 1664	1072	net.exe	net1.exe
PID 1668 wrote to memory of 1044	1668	net.exe	net1.exe
PID 1668 wrote to memory of 1044	1668	net.exe	net1.exe
PID 1668 wrote to memory of 1044	1668	net.exe	net1.exe
PID 1668 wrote to memory of 1044	1668	net.exe	net1.exe
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	icacls.exe
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 1332 wrote to memory of 2008	1332	net.exe	net1.exe
PID 1332 wrote to memory of 2008	1332	net.exe	net1.exe
PID 1332 wrote to memory of 2008	1332	net.exe	net1.exe
PID 1332 wrote to memory of 2008	1332	net.exe	net1.exe
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	cmd.exe
PID 788 wrote to memory of 884	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe
PID 788 wrote to memory of 884	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	net.exe

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1252

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
"C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788

C:\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe
"C:\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe" 8 LAN
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1640

C:\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe
"C:\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe" 8 LAN
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1072

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:1664

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1668

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:1044

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "WMIC.exe shadowcopy delete"
2⤵
PID:1496

C:\Windows\SysWOW64\Wbem\WMIC.exe
WMIC.exe shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:1588

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "bootstatuspolicy ignoreallfailures"
2⤵
PID:1800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "bcdedit /set {default} recoveryenabled No & bcdedit /set {default}"
2⤵
PID:988

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c "vssadmin.exe Delete Shadows /all /quiet"
2⤵
PID:1320

C:\Windows\SysWOW64\vssadmin.exe
vssadmin.exe Delete Shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:1936

C:\Windows\SysWOW64\icacls.exe
icacls "C:\*" /grant Everyone:F /T /C /Qþþ
2⤵
- Modifies file permissions
PID:1468

C:\Windows\SysWOW64\icacls.exe
icacls "D:\*" /grant Everyone:F /T /C /Qþþ
2⤵
- Modifies file permissions
PID:1696

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
2⤵
- Suspicious use of WriteProcessMemory
PID:1332

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "audioendpointbuilder" /y
3⤵
PID:2008

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe" /f /reg:64
2⤵
PID:1620

C:\Windows\SysWOW64\reg.exe
REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe" /f /reg:64
3⤵
- Adds Run key to start application
PID:1580

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:884

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:1916

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:2812

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2836

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:2956

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:2980

C:\Windows\SysWOW64\net.exe
"C:\Windows\System32\net.exe" stop "samss" /y
2⤵
PID:59096

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop "samss" /y
3⤵
PID:59120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1

T1060

Privilege Escalation

Defense Evasion

File Deletion

2

T1107

File and Directory Permissions Modification

Modify Registry

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

2

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462a

MD5
93a5aadeec082ffc1bca5aa27af70f52

SHA1
47a92aee3ea4d1c1954ed4da9f86dd79d9277d31

SHA256
a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294

SHA512
df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45

Download Submit
C:\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
C:\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe

MD5
8c7e7e483cd51fd209709cadcb982bcb

SHA1
fcce16c3e4906feec110e93fdf75f8a12b86cad8

SHA256
f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

SHA512
32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Download Submit
memory/788-55-0x0000000076B81000-0x0000000076B83000-memory.dmp

Filesize
8KB

Download
memory/1252-62-0x0000000035000000-0x000000003515C000-memory.dmp

Filesize
1.4MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads