ryuk | c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c

Analysis

max time kernel
178s
max time network
41s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 02:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
Size

204KB
MD5

51f6e5bce0bfc959c38223a2f16954c9
SHA1

9ec6f37879746de26a74346a84c9d7e235c628d1
SHA256

c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c
SHA512

620503619a2046730647d987c75569bb672843647abe6f00dde11c1715fda771fb07e70c2db750546038f69a14243e6fda544bbdc39ab730ef25978222359203

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] [email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\Sample Pictures\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Downloads\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Startup\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Searches\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\Sample Music\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Maintenance\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\SendTo\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Tablet PC\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\System Tools\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\Sample Videos\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\Accessories\Windows PowerShell\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\Sample Music\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1256	taskhost.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1256	taskhost.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
1256	taskhost.exe
1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
Token: SeBackupPrivilege	1256	taskhost.exe
Token: SeBackupPrivilege	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 1256	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	19
PID 1596 wrote to memory of 1336	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	20
PID 1596 wrote to memory of 824	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	29
PID 1596 wrote to memory of 824	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	29
PID 1596 wrote to memory of 824	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	29
PID 1596 wrote to memory of 1224	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	31
PID 1596 wrote to memory of 1224	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	31
PID 1596 wrote to memory of 1224	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	31
PID 1224 wrote to memory of 1956	1224	net.exe	34
PID 1224 wrote to memory of 1956	1224	net.exe	34
PID 1224 wrote to memory of 1956	1224	net.exe	34
PID 824 wrote to memory of 1960	824	net.exe	33
PID 824 wrote to memory of 1960	824	net.exe	33
PID 824 wrote to memory of 1960	824	net.exe	33
PID 1256 wrote to memory of 1592	1256	taskhost.exe	35
PID 1256 wrote to memory of 1592	1256	taskhost.exe	35
PID 1256 wrote to memory of 1592	1256	taskhost.exe	35
PID 1592 wrote to memory of 1680	1592	net.exe	37
PID 1592 wrote to memory of 1680	1592	net.exe	37
PID 1592 wrote to memory of 1680	1592	net.exe	37
PID 1256 wrote to memory of 1808	1256	taskhost.exe	38
PID 1256 wrote to memory of 1808	1256	taskhost.exe	38
PID 1256 wrote to memory of 1808	1256	taskhost.exe	38
PID 1808 wrote to memory of 1084	1808	net.exe	40
PID 1808 wrote to memory of 1084	1808	net.exe	40
PID 1808 wrote to memory of 1084	1808	net.exe	40
PID 1596 wrote to memory of 1308	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	41
PID 1596 wrote to memory of 1308	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	41
PID 1596 wrote to memory of 1308	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	41
PID 1308 wrote to memory of 2160	1308	net.exe	43
PID 1308 wrote to memory of 2160	1308	net.exe	43
PID 1308 wrote to memory of 2160	1308	net.exe	43
PID 1596 wrote to memory of 18604	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	44
PID 1596 wrote to memory of 18604	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	44
PID 1596 wrote to memory of 18604	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	44
PID 18604 wrote to memory of 18628	18604	net.exe	46
PID 18604 wrote to memory of 18628	18604	net.exe	46
PID 18604 wrote to memory of 18628	18604	net.exe	46
PID 1256 wrote to memory of 18756	1256	taskhost.exe	47
PID 1256 wrote to memory of 18756	1256	taskhost.exe	47
PID 1256 wrote to memory of 18756	1256	taskhost.exe	47
PID 18756 wrote to memory of 18780	18756	net.exe	49
PID 18756 wrote to memory of 18780	18756	net.exe	49
PID 18756 wrote to memory of 18780	18756	net.exe	49
PID 1596 wrote to memory of 18792	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	50
PID 1596 wrote to memory of 18792	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	50
PID 1596 wrote to memory of 18792	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	50
PID 18792 wrote to memory of 18816	18792	net.exe	52
PID 18792 wrote to memory of 18816	18792	net.exe	52
PID 18792 wrote to memory of 18816	18792	net.exe	52
PID 1596 wrote to memory of 35296	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	54
PID 1596 wrote to memory of 35296	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	54
PID 1596 wrote to memory of 35296	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	54
PID 35296 wrote to memory of 35320	35296	net.exe	56
PID 35296 wrote to memory of 35320	35296	net.exe	56
PID 35296 wrote to memory of 35320	35296	net.exe	56
PID 1256 wrote to memory of 35336	1256	taskhost.exe	57
PID 1256 wrote to memory of 35336	1256	taskhost.exe	57
PID 1256 wrote to memory of 35336	1256	taskhost.exe	57
PID 35336 wrote to memory of 35360	35336	net.exe	59
PID 35336 wrote to memory of 35360	35336	net.exe	59
PID 35336 wrote to memory of 35360	35336	net.exe	59
PID 1596 wrote to memory of 35372	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	60
PID 1596 wrote to memory of 35372	1596	c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe	60

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1592
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1680
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1808
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1084
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:18756
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:18780
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:35336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:35360

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1336

C:\Users\Admin\AppData\Local\Temp\c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe
"C:\Users\Admin\AppData\Local\Temp\c7040cdf95e51827dbe6305e9c915dbd015a4de0fbd8f292c45b24b51ef37a5c.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:824
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1960
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1956
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1308
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2160
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:18604
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:18628
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:18792
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:18816
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:35296
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:35320
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:35372
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:35396

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-57-0x000000013FBF0000-0x000000013FECB000-memory.dmp

Filesize
2.9MB

Download
memory/1256-55-0x000000013FBF0000-0x000000013FECB000-memory.dmp

Filesize
2.9MB

Download
memory/1336-58-0x000000013FBF0000-0x000000013FECB000-memory.dmp

Filesize
2.9MB

Download
memory/1596-54-0x000007FEFC451000-0x000007FEFC453000-memory.dmp

Filesize
8KB

Download