ryuk | 9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd

Analysis

max time kernel
196s
max time network
193s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20-02-2022 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
Size

202KB
MD5

547f87db796b69e28453b142e9da9ed4
SHA1

019faca2d3d5675a6d6bbcd00629c8fe33d54705
SHA256

9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd
SHA512

682e6cb1d510119c9897ed25a62bc436be21e3f00deccf952897b234e36444c2ebd85ef906086dfc432a491d4f3c9a63d1ab2c0e23626ac71a863521109d1eb5

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Suspicious use of NtCreateProcessExOtherParentProcess 3 IoCs

description	pid	Process	procid_target
PID 5644 created 2740	5644	WerFault.exe	30
PID 5552 created 3684	5552	WerFault.exe	57
PID 5560 created 2916	5560	WerFault.exe	28

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe

Drops desktop.ini file(s) 2 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	sihost.exe
File opened for modification	C:\Documents and Settings\Admin\3D Objects\desktop.ini	sihost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 4 IoCs

pid	pid_target	Process	procid_target
5544	2740	WerFault.exe	30
5948	3684	WerFault.exe	57
5020	2916	WerFault.exe	28
5032	2740	WerFault.exe	30

Runs net.exe

Suspicious behavior: EnumeratesProcesses 20 IoCs

pid	Process
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
2224	sihost.exe
2224	sihost.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
2224	sihost.exe
2224	sihost.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
2224	sihost.exe
2224	sihost.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
Token: SeBackupPrivilege	2224	sihost.exe
Token: SeBackupPrivilege	2916	StartMenuExperienceHost.exe
Token: SeBackupPrivilege	3684	backgroundTaskHost.exe
Token: SeBackupPrivilege	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1760 wrote to memory of 2224	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	35
PID 1760 wrote to memory of 2244	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	34
PID 1760 wrote to memory of 2296	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	33
PID 1760 wrote to memory of 2536	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	31
PID 1760 wrote to memory of 2740	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	30
PID 1760 wrote to memory of 2916	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	28
PID 1760 wrote to memory of 2980	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	8
PID 1760 wrote to memory of 3068	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	27
PID 1760 wrote to memory of 2772	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	26
PID 1760 wrote to memory of 3496	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	24
PID 1760 wrote to memory of 2924	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	20
PID 1760 wrote to memory of 3684	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	57
PID 1760 wrote to memory of 4948	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	62
PID 1760 wrote to memory of 4956	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	60
PID 1760 wrote to memory of 4956	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	60
PID 1760 wrote to memory of 4948	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	62
PID 2224 wrote to memory of 4972	2224	sihost.exe	61
PID 2224 wrote to memory of 4972	2224	sihost.exe	61
PID 2224 wrote to memory of 4996	2224	sihost.exe	64
PID 2224 wrote to memory of 4996	2224	sihost.exe	64
PID 2224 wrote to memory of 4284	2224	sihost.exe	72
PID 2224 wrote to memory of 4284	2224	sihost.exe	72
PID 1760 wrote to memory of 4664	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	67
PID 1760 wrote to memory of 4664	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	67
PID 1760 wrote to memory of 4392	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	69
PID 1760 wrote to memory of 4392	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	69
PID 4956 wrote to memory of 5152	4956	net.exe	79
PID 4956 wrote to memory of 5152	4956	net.exe	79
PID 4948 wrote to memory of 5160	4948	net.exe	78
PID 4948 wrote to memory of 5160	4948	net.exe	78
PID 4972 wrote to memory of 5144	4972	net.exe	80
PID 4972 wrote to memory of 5144	4972	net.exe	80
PID 4392 wrote to memory of 5168	4392	net.exe	77
PID 4392 wrote to memory of 5168	4392	net.exe	77
PID 4996 wrote to memory of 5176	4996	net.exe	76
PID 4996 wrote to memory of 5176	4996	net.exe	76
PID 4284 wrote to memory of 5184	4284	net.exe	75
PID 4284 wrote to memory of 5184	4284	net.exe	75
PID 4664 wrote to memory of 5192	4664	net.exe	74
PID 4664 wrote to memory of 5192	4664	net.exe	74
PID 1760 wrote to memory of 5328	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	81
PID 1760 wrote to memory of 5328	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	81
PID 1760 wrote to memory of 5336	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	82
PID 1760 wrote to memory of 5336	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	82
PID 5328 wrote to memory of 5492	5328	net.exe	86
PID 5328 wrote to memory of 5492	5328	net.exe	86
PID 5336 wrote to memory of 5500	5336	net.exe	85
PID 5336 wrote to memory of 5500	5336	net.exe	85
PID 2740 wrote to memory of 5544	2740	DllHost.exe	87
PID 2740 wrote to memory of 5544	2740	DllHost.exe	87
PID 2224 wrote to memory of 5696	2224	sihost.exe	91
PID 2224 wrote to memory of 5696	2224	sihost.exe	91
PID 5696 wrote to memory of 5752	5696	net.exe	93
PID 5696 wrote to memory of 5752	5696	net.exe	93
PID 2224 wrote to memory of 5772	2224	sihost.exe	94
PID 2224 wrote to memory of 5772	2224	sihost.exe	94
PID 5772 wrote to memory of 5824	5772	net.exe	96
PID 5772 wrote to memory of 5824	5772	net.exe	96
PID 2224 wrote to memory of 5848	2224	sihost.exe	97
PID 2224 wrote to memory of 5848	2224	sihost.exe	97
PID 5848 wrote to memory of 5900	5848	net.exe	99
PID 5848 wrote to memory of 5900	5848	net.exe	99
PID 1760 wrote to memory of 5976	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	100
PID 1760 wrote to memory of 5968	1760	9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe	103

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2924

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3496

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2772

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3068

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2916 -s 3020
  2⤵
  - Program crash
  PID:5020

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of WriteProcessMemory
PID:2740
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 860
  2⤵
  - Program crash
  PID:5544
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2740 -s 860
  2⤵
  - Program crash
  PID:5032

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2536

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2296

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2244

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4972
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5144
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5176
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4284
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5184
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5752
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5772
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5824
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5900
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:3288
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:2860
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:4084
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1944
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5380
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5760

C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe
"C:\Users\Admin\AppData\Local\Temp\9232dd5978aedc5919b7e2b4772cb7abcdd58c299b9b0028101d99dd2cf320fd.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5152
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5160
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4664
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5192
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4392
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5168
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5492
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5336
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5500
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:5976
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:6052
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:5968
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:6064
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:6108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1984
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:6100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:344
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5608
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4432
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:4320
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5108
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:6048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:5592
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  PID:2236
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:2972
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:4328
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:3780
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  PID:5116
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1620
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5580
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5560
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:5584
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:2360

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3684
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 3684 -s 1876
  2⤵
  - Program crash
  PID:5948

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 464 -p 3684 -ip 3684
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5552

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 512 -p 2916 -ip 2916
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5560

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 528 -p 2740 -ip 2740
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
PID:5644

C:\Windows\system32\MusNotifyIcon.exe
%systemroot%\system32\MusNotifyIcon.exe NotifyTrayIcon 13
1⤵
PID:5864

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2224-130-0x00007FF6B3E70000-0x00007FF6B4206000-memory.dmp

Filesize
3.6MB

Download
memory/2244-131-0x00007FF6B3E70000-0x00007FF6B4206000-memory.dmp

Filesize
3.6MB

Download