ryuk | b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a

Analysis

max time kernel
165s
max time network
138s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
Size

207KB
MD5

f2f7bef5ff555a8d94876c33903e3676
SHA1

d54850d80c6ada0c22881048640f911b79ea6d35
SHA256

b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a
SHA512

97d2eedba86483e60073a42fcefa1a6b06abf37a425dd4c2a03e3d11523e213340fbfb2bcc6cd9efd97c5d5cdcbc71b411aeb486df456433e2e5c0e5b1d2efed

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] [email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Recent\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\SendTo\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Start Menu\Programs\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Saved Games\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1108	taskhost.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1108	taskhost.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
1108	taskhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
Token: SeBackupPrivilege	1108	taskhost.exe
Token: SeBackupPrivilege	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1588 wrote to memory of 1056	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	27
PID 1588 wrote to memory of 1056	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	27
PID 1588 wrote to memory of 1056	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	27
PID 1588 wrote to memory of 1108	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	15
PID 1588 wrote to memory of 1032	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	29
PID 1588 wrote to memory of 1032	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	29
PID 1588 wrote to memory of 1032	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	29
PID 1056 wrote to memory of 1484	1056	net.exe	31
PID 1056 wrote to memory of 1484	1056	net.exe	31
PID 1056 wrote to memory of 1484	1056	net.exe	31
PID 1032 wrote to memory of 1148	1032	net.exe	32
PID 1032 wrote to memory of 1148	1032	net.exe	32
PID 1032 wrote to memory of 1148	1032	net.exe	32
PID 1588 wrote to memory of 1164	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	14
PID 1588 wrote to memory of 1648	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	33
PID 1588 wrote to memory of 1648	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	33
PID 1588 wrote to memory of 1648	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	33
PID 1648 wrote to memory of 1212	1648	net.exe	35
PID 1648 wrote to memory of 1212	1648	net.exe	35
PID 1648 wrote to memory of 1212	1648	net.exe	35
PID 1108 wrote to memory of 1348	1108	taskhost.exe	36
PID 1108 wrote to memory of 1348	1108	taskhost.exe	36
PID 1108 wrote to memory of 1348	1108	taskhost.exe	36
PID 1348 wrote to memory of 1440	1348	net.exe	38
PID 1348 wrote to memory of 1440	1348	net.exe	38
PID 1348 wrote to memory of 1440	1348	net.exe	38
PID 1588 wrote to memory of 8768	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	41
PID 1588 wrote to memory of 8768	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	41
PID 1588 wrote to memory of 8768	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	41
PID 8768 wrote to memory of 8796	8768	net.exe	43
PID 8768 wrote to memory of 8796	8768	net.exe	43
PID 8768 wrote to memory of 8796	8768	net.exe	43
PID 1588 wrote to memory of 16476	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	44
PID 1588 wrote to memory of 16476	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	44
PID 1588 wrote to memory of 16476	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	44
PID 1108 wrote to memory of 16504	1108	taskhost.exe	46
PID 1108 wrote to memory of 16504	1108	taskhost.exe	46
PID 1108 wrote to memory of 16504	1108	taskhost.exe	46
PID 16476 wrote to memory of 16520	16476	net.exe	48
PID 16476 wrote to memory of 16520	16476	net.exe	48
PID 16476 wrote to memory of 16520	16476	net.exe	48
PID 16504 wrote to memory of 16536	16504	net.exe	49
PID 16504 wrote to memory of 16536	16504	net.exe	49
PID 16504 wrote to memory of 16536	16504	net.exe	49
PID 1588 wrote to memory of 34668	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	51
PID 1588 wrote to memory of 34668	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	51
PID 1588 wrote to memory of 34668	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	51
PID 34668 wrote to memory of 34692	34668	net.exe	53
PID 34668 wrote to memory of 34692	34668	net.exe	53
PID 34668 wrote to memory of 34692	34668	net.exe	53
PID 1108 wrote to memory of 34712	1108	taskhost.exe	55
PID 1108 wrote to memory of 34712	1108	taskhost.exe	55
PID 1108 wrote to memory of 34712	1108	taskhost.exe	55
PID 1588 wrote to memory of 34720	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	54
PID 1588 wrote to memory of 34720	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	54
PID 1588 wrote to memory of 34720	1588	b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe	54
PID 34712 wrote to memory of 34760	34712	net.exe	58
PID 34712 wrote to memory of 34760	34712	net.exe	58
PID 34712 wrote to memory of 34760	34712	net.exe	58
PID 34720 wrote to memory of 34768	34720	net.exe	59
PID 34720 wrote to memory of 34768	34720	net.exe	59
PID 34720 wrote to memory of 34768	34720	net.exe	59

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1348
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1440
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16504
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16536
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:34712
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:34760

C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe
"C:\Users\Admin\AppData\Local\Temp\b3f9ac2849fcbafb5abcede2fff0d05754d4b08b20b102af9f14849c2c10e63a.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1588
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1484
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1032
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1148
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1212
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:8768
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:8796
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16476
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16520
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:34668
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:34692
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:34720
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:34768

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-58-0x000000013F7A0000-0x000000013FB37000-memory.dmp

Filesize
3.6MB

Download
memory/1108-56-0x000000013F7A0000-0x000000013FB37000-memory.dmp

Filesize
3.6MB

Download
memory/1164-59-0x000000013F7A0000-0x000000013FB37000-memory.dmp

Filesize
3.6MB

Download
memory/1588-55-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Filesize
8KB

Download