ryuk | b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2

Analysis

max time kernel
160s
max time network
83s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 02:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
Size

196KB
MD5

35fb90e465df48871ee78df492fe22de
SHA1

ddfba2e525968f6aedf050613f32b124b13f776a
SHA256

b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2
SHA512

60511d000df87164627fb6053049e82be0833e60a8b8a7ae30e93084e4293e250f1a7b2a4eaf3d875408a304e845ae548ff2cd68d6f604090cdc5be3d168d5f7

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
1120	jrDvYvp.exe

Loads dropped DLL 2 IoCs

pid	Process
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1540	icacls.exe
864	icacls.exe
1720	icacls.exe
2008	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\jrDvYvp.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1356	vssadmin.exe
1000	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 31 IoCs

pid	Process
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1120	jrDvYvp.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1120	jrDvYvp.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
1120	jrDvYvp.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
Token: SeBackupPrivilege	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
Token: SeBackupPrivilege	1120	jrDvYvp.exe
Token: SeIncreaseQuotaPrivilege	588	WMIC.exe
Token: SeSecurityPrivilege	588	WMIC.exe
Token: SeTakeOwnershipPrivilege	588	WMIC.exe
Token: SeLoadDriverPrivilege	588	WMIC.exe
Token: SeSystemProfilePrivilege	588	WMIC.exe
Token: SeSystemtimePrivilege	588	WMIC.exe
Token: SeProfSingleProcessPrivilege	588	WMIC.exe
Token: SeIncBasePriorityPrivilege	588	WMIC.exe
Token: SeCreatePagefilePrivilege	588	WMIC.exe
Token: SeBackupPrivilege	588	WMIC.exe
Token: SeRestorePrivilege	588	WMIC.exe
Token: SeShutdownPrivilege	588	WMIC.exe
Token: SeDebugPrivilege	588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	588	WMIC.exe
Token: SeRemoteShutdownPrivilege	588	WMIC.exe
Token: SeUndockPrivilege	588	WMIC.exe
Token: SeManageVolumePrivilege	588	WMIC.exe
Token: 33	588	WMIC.exe
Token: 34	588	WMIC.exe
Token: 35	588	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1136	WMIC.exe
Token: SeSecurityPrivilege	1136	WMIC.exe
Token: SeTakeOwnershipPrivilege	1136	WMIC.exe
Token: SeLoadDriverPrivilege	1136	WMIC.exe
Token: SeSystemProfilePrivilege	1136	WMIC.exe
Token: SeSystemtimePrivilege	1136	WMIC.exe
Token: SeProfSingleProcessPrivilege	1136	WMIC.exe
Token: SeIncBasePriorityPrivilege	1136	WMIC.exe
Token: SeCreatePagefilePrivilege	1136	WMIC.exe
Token: SeBackupPrivilege	1136	WMIC.exe
Token: SeRestorePrivilege	1136	WMIC.exe
Token: SeShutdownPrivilege	1136	WMIC.exe
Token: SeDebugPrivilege	1136	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1136	WMIC.exe
Token: SeRemoteShutdownPrivilege	1136	WMIC.exe
Token: SeUndockPrivilege	1136	WMIC.exe
Token: SeManageVolumePrivilege	1136	WMIC.exe
Token: 33	1136	WMIC.exe
Token: 34	1136	WMIC.exe
Token: 35	1136	WMIC.exe
Token: SeBackupPrivilege	2212	vssvc.exe
Token: SeRestorePrivilege	2212	vssvc.exe
Token: SeAuditPrivilege	2212	vssvc.exe
Token: SeIncreaseQuotaPrivilege	588	WMIC.exe
Token: SeSecurityPrivilege	588	WMIC.exe
Token: SeTakeOwnershipPrivilege	588	WMIC.exe
Token: SeLoadDriverPrivilege	588	WMIC.exe
Token: SeSystemProfilePrivilege	588	WMIC.exe
Token: SeSystemtimePrivilege	588	WMIC.exe
Token: SeProfSingleProcessPrivilege	588	WMIC.exe
Token: SeIncBasePriorityPrivilege	588	WMIC.exe
Token: SeCreatePagefilePrivilege	588	WMIC.exe
Token: SeBackupPrivilege	588	WMIC.exe
Token: SeRestorePrivilege	588	WMIC.exe
Token: SeShutdownPrivilege	588	WMIC.exe
Token: SeDebugPrivilege	588	WMIC.exe
Token: SeSystemEnvironmentPrivilege	588	WMIC.exe
Token: SeRemoteShutdownPrivilege	588	WMIC.exe
Token: SeUndockPrivilege	588	WMIC.exe
Token: SeManageVolumePrivilege	588	WMIC.exe
Token: 33	588	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1664 wrote to memory of 1120	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	27
PID 1664 wrote to memory of 1120	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	27
PID 1664 wrote to memory of 1120	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	27
PID 1664 wrote to memory of 1120	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	27
PID 1664 wrote to memory of 1276	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	19
PID 1664 wrote to memory of 1372	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	20
PID 1664 wrote to memory of 276	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	28
PID 1664 wrote to memory of 276	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	28
PID 1664 wrote to memory of 276	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	28
PID 1664 wrote to memory of 276	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	28
PID 1664 wrote to memory of 1832	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	30
PID 1664 wrote to memory of 1832	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	30
PID 1664 wrote to memory of 1832	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	30
PID 1664 wrote to memory of 1832	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	30
PID 276 wrote to memory of 1168	276	net.exe	33
PID 276 wrote to memory of 1168	276	net.exe	33
PID 276 wrote to memory of 1168	276	net.exe	33
PID 276 wrote to memory of 1168	276	net.exe	33
PID 1832 wrote to memory of 1132	1832	net.exe	32
PID 1832 wrote to memory of 1132	1832	net.exe	32
PID 1832 wrote to memory of 1132	1832	net.exe	32
PID 1832 wrote to memory of 1132	1832	net.exe	32
PID 1664 wrote to memory of 1540	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	34
PID 1664 wrote to memory of 1540	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	34
PID 1664 wrote to memory of 1540	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	34
PID 1664 wrote to memory of 1540	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	34
PID 1664 wrote to memory of 864	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	35
PID 1664 wrote to memory of 864	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	35
PID 1664 wrote to memory of 864	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	35
PID 1664 wrote to memory of 864	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	35
PID 1664 wrote to memory of 1992	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	38
PID 1664 wrote to memory of 1992	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	38
PID 1664 wrote to memory of 1992	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	38
PID 1664 wrote to memory of 1992	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	38
PID 1664 wrote to memory of 1356	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	40
PID 1664 wrote to memory of 1356	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	40
PID 1664 wrote to memory of 1356	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	40
PID 1664 wrote to memory of 1356	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	40
PID 1120 wrote to memory of 1720	1120	jrDvYvp.exe	42
PID 1120 wrote to memory of 1720	1120	jrDvYvp.exe	42
PID 1120 wrote to memory of 1720	1120	jrDvYvp.exe	42
PID 1120 wrote to memory of 1720	1120	jrDvYvp.exe	42
PID 1120 wrote to memory of 2008	1120	jrDvYvp.exe	46
PID 1120 wrote to memory of 2008	1120	jrDvYvp.exe	46
PID 1120 wrote to memory of 2008	1120	jrDvYvp.exe	46
PID 1120 wrote to memory of 2008	1120	jrDvYvp.exe	46
PID 1120 wrote to memory of 744	1120	jrDvYvp.exe	43
PID 1120 wrote to memory of 744	1120	jrDvYvp.exe	43
PID 1120 wrote to memory of 744	1120	jrDvYvp.exe	43
PID 1120 wrote to memory of 744	1120	jrDvYvp.exe	43
PID 1120 wrote to memory of 1000	1120	jrDvYvp.exe	44
PID 1120 wrote to memory of 1000	1120	jrDvYvp.exe	44
PID 1120 wrote to memory of 1000	1120	jrDvYvp.exe	44
PID 1120 wrote to memory of 1000	1120	jrDvYvp.exe	44
PID 1664 wrote to memory of 1080	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	50
PID 1664 wrote to memory of 1080	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	50
PID 1664 wrote to memory of 1080	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	50
PID 1664 wrote to memory of 1080	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	50
PID 1664 wrote to memory of 1736	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	51
PID 1664 wrote to memory of 1736	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	51
PID 1664 wrote to memory of 1736	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	51
PID 1664 wrote to memory of 1736	1664	b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe	51
PID 1736 wrote to memory of 1484	1736	net.exe	54
PID 1736 wrote to memory of 1484	1736	net.exe	54

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1276

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1372

C:\Users\Admin\AppData\Local\Temp\b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe
"C:\Users\Admin\AppData\Local\Temp\b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1664
- C:\Users\Admin\AppData\Local\Temp\jrDvYvp.exe
  "C:\Users\Admin\AppData\Local\Temp\jrDvYvp.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1120
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "WMIC.exe shadowcopy delet"
    3⤵
    PID:744
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC.exe shadowcopy delet
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:588
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1000
- - C:\Windows\SysWOW64\icacls.exe
    icacls "D:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:2008
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
    3⤵
    PID:944
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
      4⤵
      PID:1476
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:1560
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:2072
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jrDvYvp.exe" /f /reg:64
    3⤵
    PID:2580
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\jrDvYvp.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      PID:2188
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:22244
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:22272
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:32888
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:32912
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:276
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1168
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1132
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1540
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:864
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "WMIC.exe shadowcopy delet"
  2⤵
  PID:1992
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC.exe shadowcopy delet
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1136
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:1356
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe" /f /reg:64
  2⤵
  PID:1080
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6a77965f94dfc6f0ed0a3465e8d17e998328a9659ef860fbe2396bb0014f8a2.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:2024
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1736
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1484
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:568
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1328
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:19144
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:19444
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:22300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:22324
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:22300
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1728
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:28356
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:28468

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2212

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1276-59-0x0000000030000000-0x0000000030171000-memory.dmp

Filesize
1.4MB

Download
memory/1664-54-0x0000000075D61000-0x0000000075D63000-memory.dmp

Filesize
8KB

Download