Analysis
-
max time kernel
169s -
max time network
191s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20/02/2022, 01:21
Static task
static1
Behavioral task
behavioral1
Sample
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
-
Size
118KB
-
MD5
347eeae717c9af712bef4146374ea162
-
SHA1
0b90db0136415072ade13f090dd99f8f3cb96404
-
SHA256
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
-
SHA512
cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'AahZSQ5kzw'; $torlink = 'http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 1848 LluwOTNrVrep.exe 540 xQAeFnquvlan.exe 13876 pWCTHgwSBlan.exe -
Loads dropped DLL 6 IoCs
pid Process 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 38500 icacls.exe 38508 icacls.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\ar.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\History.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\be.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\he.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\af.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\bn.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\sk.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\tr.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\es.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\pt-br.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\Filters\VISFILT.DLL ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\Alphabet.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\bg-BG\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\lv.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\vi.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ga.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\kaa.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\sv.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ne.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ta.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\fr.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\eo.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\lt.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\gu.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\it.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\zh-cn.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\ar-SA\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\descript.ion ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\7zCon.sfx ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ky.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\si.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\tt.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\sq.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\cy.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\nb.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\eu.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ms.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\az.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\uk.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\kk.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\da.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ku-ckb.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\pt.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ka.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\hy.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\io.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ps.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spc.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ro.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\hu.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ja.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Suspicious use of WriteProcessMemory 52 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1848 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 27 PID 1668 wrote to memory of 1848 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 27 PID 1668 wrote to memory of 1848 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 27 PID 1668 wrote to memory of 1848 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 27 PID 1668 wrote to memory of 540 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 28 PID 1668 wrote to memory of 540 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 28 PID 1668 wrote to memory of 540 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 28 PID 1668 wrote to memory of 540 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 28 PID 1668 wrote to memory of 13876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 31 PID 1668 wrote to memory of 13876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 31 PID 1668 wrote to memory of 13876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 31 PID 1668 wrote to memory of 13876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 31 PID 1668 wrote to memory of 38500 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 32 PID 1668 wrote to memory of 38500 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 32 PID 1668 wrote to memory of 38500 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 32 PID 1668 wrote to memory of 38500 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 32 PID 1668 wrote to memory of 38508 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 33 PID 1668 wrote to memory of 38508 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 33 PID 1668 wrote to memory of 38508 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 33 PID 1668 wrote to memory of 38508 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 33 PID 1668 wrote to memory of 97876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 36 PID 1668 wrote to memory of 97876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 36 PID 1668 wrote to memory of 97876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 36 PID 1668 wrote to memory of 97876 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 36 PID 1668 wrote to memory of 98064 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 37 PID 1668 wrote to memory of 98064 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 37 PID 1668 wrote to memory of 98064 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 37 PID 1668 wrote to memory of 98064 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 37 PID 1668 wrote to memory of 108804 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 40 PID 1668 wrote to memory of 108804 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 40 PID 1668 wrote to memory of 108804 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 40 PID 1668 wrote to memory of 108804 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 40 PID 1668 wrote to memory of 112932 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 42 PID 1668 wrote to memory of 112932 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 42 PID 1668 wrote to memory of 112932 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 42 PID 1668 wrote to memory of 112932 1668 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 42 PID 97876 wrote to memory of 137364 97876 net.exe 45 PID 97876 wrote to memory of 137364 97876 net.exe 45 PID 97876 wrote to memory of 137364 97876 net.exe 45 PID 97876 wrote to memory of 137364 97876 net.exe 45 PID 112932 wrote to memory of 137372 112932 net.exe 46 PID 112932 wrote to memory of 137372 112932 net.exe 46 PID 112932 wrote to memory of 137372 112932 net.exe 46 PID 112932 wrote to memory of 137372 112932 net.exe 46 PID 108804 wrote to memory of 137380 108804 net.exe 44 PID 108804 wrote to memory of 137380 108804 net.exe 44 PID 108804 wrote to memory of 137380 108804 net.exe 44 PID 108804 wrote to memory of 137380 108804 net.exe 44 PID 98064 wrote to memory of 137388 98064 net.exe 47 PID 98064 wrote to memory of 137388 98064 net.exe 47 PID 98064 wrote to memory of 137388 98064 net.exe 47 PID 98064 wrote to memory of 137388 98064 net.exe 47
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe"C:\Users\Admin\AppData\Local\Temp\ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\LluwOTNrVrep.exe"C:\Users\Admin\AppData\Local\Temp\LluwOTNrVrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:1848
-
-
C:\Users\Admin\AppData\Local\Temp\xQAeFnquvlan.exe"C:\Users\Admin\AppData\Local\Temp\xQAeFnquvlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\pWCTHgwSBlan.exe"C:\Users\Admin\AppData\Local\Temp\pWCTHgwSBlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:13876
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:38500
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:38508
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:97876 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:137364
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:98064 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:137388
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:108804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:137380
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:112932 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:137372
-
-