Analysis
-
max time kernel
160s -
max time network
26s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 05:30
Static task
static1
Behavioral task
behavioral1
Sample
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe
Resource
win10v2004-en-20220112
General
-
Target
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe
-
Size
171KB
-
MD5
d92a64dce52edbbf70f9a5ebd25600be
-
SHA1
7e0a7323d4ba0454e6d54c4746dbac8373af9d0d
-
SHA256
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841
-
SHA512
a629f2c4e38b4ee3a357f24da3f5e5310081bb46617f5e67a634e6308ce946860701879a114852eb2dc30d7d5696bcf01df9715cd3f689c2b19f879701600471
Malware Config
Extracted
C:\RyukReadMe.html
ryuk
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 47 IoCs
Processes:
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exedescription ioc process File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exepid process 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exedescription pid process Token: SeDebugPrivilege 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe Token: SeBackupPrivilege 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exenet.exedescription pid process target process PID 960 wrote to memory of 1108 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe taskhost.exe PID 960 wrote to memory of 1176 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe Dwm.exe PID 960 wrote to memory of 1092 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1092 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1092 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1092 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 1092 wrote to memory of 1652 1092 net.exe net1.exe PID 1092 wrote to memory of 1652 1092 net.exe net1.exe PID 1092 wrote to memory of 1652 1092 net.exe net1.exe PID 1092 wrote to memory of 1652 1092 net.exe net1.exe PID 960 wrote to memory of 1136 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1136 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1136 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1136 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 1136 wrote to memory of 624 1136 net.exe net1.exe PID 1136 wrote to memory of 624 1136 net.exe net1.exe PID 1136 wrote to memory of 624 1136 net.exe net1.exe PID 1136 wrote to memory of 624 1136 net.exe net1.exe PID 960 wrote to memory of 1804 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1804 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1804 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 1804 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 1804 wrote to memory of 1068 1804 net.exe net1.exe PID 1804 wrote to memory of 1068 1804 net.exe net1.exe PID 1804 wrote to memory of 1068 1804 net.exe net1.exe PID 1804 wrote to memory of 1068 1804 net.exe net1.exe PID 960 wrote to memory of 2096 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 2096 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 2096 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 2096 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 2096 wrote to memory of 2208 2096 net.exe net1.exe PID 2096 wrote to memory of 2208 2096 net.exe net1.exe PID 2096 wrote to memory of 2208 2096 net.exe net1.exe PID 2096 wrote to memory of 2208 2096 net.exe net1.exe PID 960 wrote to memory of 18428 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18428 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18428 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18428 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 18428 wrote to memory of 18456 18428 net.exe net1.exe PID 18428 wrote to memory of 18456 18428 net.exe net1.exe PID 18428 wrote to memory of 18456 18428 net.exe net1.exe PID 18428 wrote to memory of 18456 18428 net.exe net1.exe PID 960 wrote to memory of 18468 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18468 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18468 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18468 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 18468 wrote to memory of 18496 18468 net.exe net1.exe PID 18468 wrote to memory of 18496 18468 net.exe net1.exe PID 18468 wrote to memory of 18496 18468 net.exe net1.exe PID 18468 wrote to memory of 18496 18468 net.exe net1.exe PID 960 wrote to memory of 18540 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18540 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18540 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18540 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 18540 wrote to memory of 18564 18540 net.exe net1.exe PID 18540 wrote to memory of 18564 18540 net.exe net1.exe PID 18540 wrote to memory of 18564 18540 net.exe net1.exe PID 18540 wrote to memory of 18564 18540 net.exe net1.exe PID 960 wrote to memory of 18584 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18584 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18584 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 960 wrote to memory of 18584 960 7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe net.exe PID 18584 wrote to memory of 18608 18584 net.exe net1.exe PID 18584 wrote to memory of 18608 18584 net.exe net1.exe
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1108
-
C:\Users\Admin\AppData\Local\Temp\7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe"C:\Users\Admin\AppData\Local\Temp\7a08d89337170c61788759dcb0d9287551a338b592ebd915cd0249be33736841.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1092 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1652
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:624
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1804 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1068
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:2208
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18428 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18456
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18468 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18496
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18540 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18564
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18608
-
-