ryuk | bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9

Analysis

max time kernel
173s
max time network
48s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 02:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
Size

207KB
MD5

7899090dd1b61fc2d85b50473e500d8b
SHA1

9c972c2696d68d3d29726cdba061e31c51663c12
SHA256

bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9
SHA512

b976e2f12bcb13ff10fb70338fac775356fb40ba36d11c40c72028c723d452e49128050dc30bac9d66e205162f2994d0f07aeb74a271fd494fd39cd1718b9c6b

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] [email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 55 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\Downloads\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1128	taskhost.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1128	taskhost.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
1128	taskhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
Token: SeBackupPrivilege	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
Token: SeBackupPrivilege	1128	taskhost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 1128	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	11
PID 1792 wrote to memory of 1196	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	17
PID 1792 wrote to memory of 1528	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	28
PID 1792 wrote to memory of 1528	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	28
PID 1792 wrote to memory of 1528	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	28
PID 1792 wrote to memory of 272	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	31
PID 1792 wrote to memory of 272	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	31
PID 1792 wrote to memory of 272	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	31
PID 272 wrote to memory of 828	272	net.exe	34
PID 272 wrote to memory of 828	272	net.exe	34
PID 272 wrote to memory of 828	272	net.exe	34
PID 1528 wrote to memory of 1620	1528	net.exe	33
PID 1528 wrote to memory of 1620	1528	net.exe	33
PID 1528 wrote to memory of 1620	1528	net.exe	33
PID 1792 wrote to memory of 620	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	35
PID 1792 wrote to memory of 620	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	35
PID 1792 wrote to memory of 620	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	35
PID 1792 wrote to memory of 1476	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	37
PID 1792 wrote to memory of 1476	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	37
PID 1792 wrote to memory of 1476	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	37
PID 1476 wrote to memory of 928	1476	net.exe	39
PID 1476 wrote to memory of 928	1476	net.exe	39
PID 1476 wrote to memory of 928	1476	net.exe	39
PID 620 wrote to memory of 1964	620	net.exe	40
PID 620 wrote to memory of 1964	620	net.exe	40
PID 620 wrote to memory of 1964	620	net.exe	40
PID 1128 wrote to memory of 688	1128	taskhost.exe	41
PID 1128 wrote to memory of 688	1128	taskhost.exe	41
PID 1128 wrote to memory of 688	1128	taskhost.exe	41
PID 688 wrote to memory of 1288	688	net.exe	43
PID 688 wrote to memory of 1288	688	net.exe	43
PID 688 wrote to memory of 1288	688	net.exe	43
PID 1128 wrote to memory of 1644	1128	taskhost.exe	44
PID 1128 wrote to memory of 1644	1128	taskhost.exe	44
PID 1128 wrote to memory of 1644	1128	taskhost.exe	44
PID 1644 wrote to memory of 1708	1644	net.exe	46
PID 1644 wrote to memory of 1708	1644	net.exe	46
PID 1644 wrote to memory of 1708	1644	net.exe	46
PID 1792 wrote to memory of 16812	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	47
PID 1792 wrote to memory of 16812	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	47
PID 1792 wrote to memory of 16812	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	47
PID 16812 wrote to memory of 16836	16812	net.exe	49
PID 16812 wrote to memory of 16836	16812	net.exe	49
PID 16812 wrote to memory of 16836	16812	net.exe	49
PID 1792 wrote to memory of 16896	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	50
PID 1792 wrote to memory of 16896	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	50
PID 1792 wrote to memory of 16896	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	50
PID 16896 wrote to memory of 16920	16896	net.exe	52
PID 16896 wrote to memory of 16920	16896	net.exe	52
PID 16896 wrote to memory of 16920	16896	net.exe	52
PID 1128 wrote to memory of 16936	1128	taskhost.exe	53
PID 1128 wrote to memory of 16936	1128	taskhost.exe	53
PID 1128 wrote to memory of 16936	1128	taskhost.exe	53
PID 16936 wrote to memory of 16960	16936	net.exe	55
PID 16936 wrote to memory of 16960	16936	net.exe	55
PID 16936 wrote to memory of 16960	16936	net.exe	55
PID 1792 wrote to memory of 17028	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	56
PID 1792 wrote to memory of 17028	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	56
PID 1792 wrote to memory of 17028	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	56
PID 17028 wrote to memory of 17052	17028	net.exe	58
PID 17028 wrote to memory of 17052	17028	net.exe	58
PID 17028 wrote to memory of 17052	17028	net.exe	58
PID 1792 wrote to memory of 17064	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	59
PID 1792 wrote to memory of 17064	1792	bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe	59

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1128
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:688
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1288
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1644
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1708
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16936
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16960
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:19700
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:20296

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1196

C:\Users\Admin\AppData\Local\Temp\bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe
"C:\Users\Admin\AppData\Local\Temp\bce33065d06ee9290d73c7a470235508f605c9fef72dd0ebf480876c2ba593b9.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1620
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:272
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:828
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:620
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1964
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:928
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16812
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16836
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16896
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16920
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:17028
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17052
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:17064
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17088

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1128-54-0x000000013FEB0000-0x000000014018B000-memory.dmp

Filesize
2.9MB

Download
memory/1128-56-0x000000013FEB0000-0x000000014018B000-memory.dmp

Filesize
2.9MB

Download
memory/1196-58-0x000000013FEB0000-0x000000014018B000-memory.dmp

Filesize
2.9MB

Download
memory/1792-55-0x000007FEFB571000-0x000007FEFB573000-memory.dmp

Filesize
8KB

Download