Analysis
-
max time kernel
185s -
max time network
202s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-02-2022 01:21
Static task
static1
Behavioral task
behavioral1
Sample
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe
-
Size
118KB
-
MD5
347eeae717c9af712bef4146374ea162
-
SHA1
0b90db0136415072ade13f090dd99f8f3cb96404
-
SHA256
ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0
-
SHA512
cc66b1bccc65cf5a86d698d523a1217ec2e40d8fd005ab81891fef9d5008a044987fb9ec90e140c3dec650747c87a00aee3c7db8f332918e251eff95bc60c949
Score
10/10
Malware Config
Extracted
Path
C:\users\Public\RyukReadMe.html
Family
ryuk
Ransom Note
contact
balance of shadow universe
Ryuk
$password = 'AahZSQ5kzw'; $torlink = 'http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion';
function info(){alert("INSTRUCTION:\r\n1. Download tor browser.\r\n2. Open link through tor browser: " + $torlink + "\r\n3. Fill the form, your password: "+ $password +"\r\nWe will contact you shortly.\r\nAlways send files for test decryption.");};
URLs
http://shemngcwq3kbpigejjxj5toggdqrfqq6qagp556yxglfxe4qq4xuc4yd.onion
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 3 IoCs
pid Process 4712 IjueMhpBmrep.exe 3788 MAMiKRsaMlan.exe 4844 wfslFdKiMlan.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 2256 icacls.exe 5020 icacls.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\7-Zip\Lang\cs.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\cs-CZ\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\zh-CN\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ThirdPartyNotices.MSHWLatin.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\ja-JP\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\msado26.tlb ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipssve.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\msdaprsr.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msadcer.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\de-DE\wab32res.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\pa-in.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fi-FI\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\symbols.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ro-RO\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\tr-TR\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\en-US\rtscom.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\es-ES\msdaprsr.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ca.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ja-JP\wab32res.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\gl.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\ko.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fr-FR\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsdeu.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\lt-LT\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ja-JP\tabskb.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\es-ES\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\de-DE\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu\oskmenubase.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsptb.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\yo.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Triedit\en-US\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\lij.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\ServiceWatcherSchedule.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\et-EE\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hwrenUSlm.dat ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\de-DE\msader15.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\msado28.tlb ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\adcvbs.inc ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\mk.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\et.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\mn.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\Content.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\it-IT\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\msado20.tlb ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\sr-spl.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\osknumpad.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\7-Zip\Lang\is.txt ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\ipsfra.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\msadc\en-US\msdaprsr.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskmenu.xml ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\vstoee100.tlb ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\AddStop.cr2 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\he-IL\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\hu-HU\tipresx.dll.mui ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\sr-Latn-RS\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\System\ado\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\es-ES\RyukReadMe.html ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1308 wrote to memory of 4712 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 84 PID 1308 wrote to memory of 4712 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 84 PID 1308 wrote to memory of 4712 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 84 PID 1308 wrote to memory of 3788 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 85 PID 1308 wrote to memory of 3788 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 85 PID 1308 wrote to memory of 3788 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 85 PID 1308 wrote to memory of 4844 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 86 PID 1308 wrote to memory of 4844 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 86 PID 1308 wrote to memory of 4844 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 86 PID 1308 wrote to memory of 2256 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 87 PID 1308 wrote to memory of 2256 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 87 PID 1308 wrote to memory of 2256 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 87 PID 1308 wrote to memory of 5020 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 88 PID 1308 wrote to memory of 5020 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 88 PID 1308 wrote to memory of 5020 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 88 PID 1308 wrote to memory of 14928 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 93 PID 1308 wrote to memory of 14928 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 93 PID 1308 wrote to memory of 14928 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 93 PID 1308 wrote to memory of 14936 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 92 PID 1308 wrote to memory of 14936 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 92 PID 1308 wrote to memory of 14936 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 92 PID 1308 wrote to memory of 14992 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 96 PID 1308 wrote to memory of 14992 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 96 PID 1308 wrote to memory of 14992 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 96 PID 1308 wrote to memory of 15000 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 97 PID 1308 wrote to memory of 15000 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 97 PID 1308 wrote to memory of 15000 1308 ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe 97 PID 15000 wrote to memory of 19352 15000 net.exe 100 PID 15000 wrote to memory of 19352 15000 net.exe 100 PID 15000 wrote to memory of 19352 15000 net.exe 100 PID 14936 wrote to memory of 19344 14936 net.exe 103 PID 14936 wrote to memory of 19344 14936 net.exe 103 PID 14936 wrote to memory of 19344 14936 net.exe 103 PID 14928 wrote to memory of 19360 14928 net.exe 101 PID 14928 wrote to memory of 19360 14928 net.exe 101 PID 14928 wrote to memory of 19360 14928 net.exe 101 PID 14992 wrote to memory of 19368 14992 net.exe 102 PID 14992 wrote to memory of 19368 14992 net.exe 102 PID 14992 wrote to memory of 19368 14992 net.exe 102
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe"C:\Users\Admin\AppData\Local\Temp\ddd788ff3ce2b36c84941bee081ec22aa3ad1f43c49f417d57b975f0dd3683a0.exe"1⤵
- Checks computer location settings
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\IjueMhpBmrep.exe"C:\Users\Admin\AppData\Local\Temp\IjueMhpBmrep.exe" 9 REP2⤵
- Executes dropped EXE
PID:4712
-
-
C:\Users\Admin\AppData\Local\Temp\MAMiKRsaMlan.exe"C:\Users\Admin\AppData\Local\Temp\MAMiKRsaMlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:3788
-
-
C:\Users\Admin\AppData\Local\Temp\wfslFdKiMlan.exe"C:\Users\Admin\AppData\Local\Temp\wfslFdKiMlan.exe" 8 LAN2⤵
- Executes dropped EXE
PID:4844
-
-
C:\Windows\SysWOW64\icacls.exeicacls "C:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:2256
-
-
C:\Windows\SysWOW64\icacls.exeicacls "D:\*" /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:5020
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:14936 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:19344
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:14928 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:19360
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:14992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:19368
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:15000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:19352
-
-