Analysis
-
max time kernel
194s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
20-02-2022 05:04
Static task
static1
Behavioral task
behavioral1
Sample
84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe
-
Size
167KB
-
MD5
bbaf622ea0f80ceb357e19519bca0a49
-
SHA1
a7deca0a331beba2a94e20d34e44c44f4d7cd6b6
-
SHA256
84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e
-
SHA512
20329239226f3c44be4736e3bb5df4f9f8dee477e939b34b7f9d334c6210c70855ad1a827487260879854a3c750ad4ecab782b1e71e955873ea51ed8ae5f805a
Score
10/10
Malware Config
Extracted
Path
C:\RyukReadMe.txt
Family
ryuk
Ransom Note
Your network has been penetrated.
All files on each network host have been encrypted with a strong algorithm.
Backups were encrypted too.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
Only we have exclusive decryption software, suitable for your situation.
More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder.
No decryption software is available in the public.
Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data.
Decryption takes from ten minutes up to several hours.
It is performed automatically and doesn't require from you any actions except decoder launching.
DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged.
DO NOT DELETE readme files.
To confirm our honest intentions. Send 2 different random files and you will get them back decrypted.
It can be from different computers on your network to be sure that one key decrypts everything.
We will unlock 2 files for free.
To get info (decrypt your files) contact us a
[email protected]
or
[email protected]
You will receive btc address for payment in the reply letter
Ryuk
No system is safe
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Drops desktop.ini file(s) 53 IoCs
description ioc Process File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Links\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Saved Games\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Videos\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Documents\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Searches\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Accessibility\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\RO7FJFDE\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Startup\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Desktop\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Recent\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Contacts\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Downloads\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Music\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\K819CMRP\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\FNOUQX38\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\QDAZQ7UR\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Documents\My Pictures\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Documents\My Music\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\SendTo\Desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\All Users\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Desktop\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\NK9YD4KU\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Favorites\Links\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\S3IV548V\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Favorites\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T7AS43M2\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\T0STXTA8\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe File opened for modification C:\Documents and Settings\Admin\Start Menu\desktop.ini 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe Token: SeBackupPrivilege 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1536 wrote to memory of 1116 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 17 PID 1536 wrote to memory of 1172 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 9 PID 1536 wrote to memory of 1924 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 29 PID 1536 wrote to memory of 1924 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 29 PID 1536 wrote to memory of 1924 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 29 PID 1536 wrote to memory of 1924 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 29 PID 1924 wrote to memory of 676 1924 net.exe 31 PID 1924 wrote to memory of 676 1924 net.exe 31 PID 1924 wrote to memory of 676 1924 net.exe 31 PID 1924 wrote to memory of 676 1924 net.exe 31 PID 1536 wrote to memory of 396 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 33 PID 1536 wrote to memory of 396 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 33 PID 1536 wrote to memory of 396 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 33 PID 1536 wrote to memory of 396 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 33 PID 396 wrote to memory of 1140 396 net.exe 35 PID 396 wrote to memory of 1140 396 net.exe 35 PID 396 wrote to memory of 1140 396 net.exe 35 PID 396 wrote to memory of 1140 396 net.exe 35 PID 1536 wrote to memory of 1324 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 36 PID 1536 wrote to memory of 1324 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 36 PID 1536 wrote to memory of 1324 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 36 PID 1536 wrote to memory of 1324 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 36 PID 1324 wrote to memory of 1312 1324 net.exe 38 PID 1324 wrote to memory of 1312 1324 net.exe 38 PID 1324 wrote to memory of 1312 1324 net.exe 38 PID 1324 wrote to memory of 1312 1324 net.exe 38 PID 1536 wrote to memory of 1960 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 39 PID 1536 wrote to memory of 1960 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 39 PID 1536 wrote to memory of 1960 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 39 PID 1536 wrote to memory of 1960 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 39 PID 1960 wrote to memory of 1784 1960 net.exe 41 PID 1960 wrote to memory of 1784 1960 net.exe 41 PID 1960 wrote to memory of 1784 1960 net.exe 41 PID 1960 wrote to memory of 1784 1960 net.exe 41 PID 1536 wrote to memory of 9096 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 42 PID 1536 wrote to memory of 9096 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 42 PID 1536 wrote to memory of 9096 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 42 PID 1536 wrote to memory of 9096 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 42 PID 9096 wrote to memory of 9120 9096 net.exe 44 PID 9096 wrote to memory of 9120 9096 net.exe 44 PID 9096 wrote to memory of 9120 9096 net.exe 44 PID 9096 wrote to memory of 9120 9096 net.exe 44 PID 1536 wrote to memory of 9136 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 45 PID 1536 wrote to memory of 9136 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 45 PID 1536 wrote to memory of 9136 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 45 PID 1536 wrote to memory of 9136 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 45 PID 9136 wrote to memory of 9160 9136 net.exe 47 PID 9136 wrote to memory of 9160 9136 net.exe 47 PID 9136 wrote to memory of 9160 9136 net.exe 47 PID 9136 wrote to memory of 9160 9136 net.exe 47 PID 1536 wrote to memory of 18768 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 49 PID 1536 wrote to memory of 18768 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 49 PID 1536 wrote to memory of 18768 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 49 PID 1536 wrote to memory of 18768 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 49 PID 18768 wrote to memory of 18792 18768 net.exe 51 PID 18768 wrote to memory of 18792 18768 net.exe 51 PID 18768 wrote to memory of 18792 18768 net.exe 51 PID 18768 wrote to memory of 18792 18768 net.exe 51 PID 1536 wrote to memory of 18812 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 52 PID 1536 wrote to memory of 18812 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 52 PID 1536 wrote to memory of 18812 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 52 PID 1536 wrote to memory of 18812 1536 84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe 52 PID 18812 wrote to memory of 18840 18812 net.exe 54 PID 18812 wrote to memory of 18840 18812 net.exe 54
Processes
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1172
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Users\Admin\AppData\Local\Temp\84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe"C:\Users\Admin\AppData\Local\Temp\84df9b0cfcafbf57e05f6f675d95c8ee64c29f456329feb9c4a2945b8468df5e.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1536 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "spooler" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "spooler" /y3⤵PID:676
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1140
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1324 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1312
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1784
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:9096 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9120
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:9136 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:9160
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18768 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18792
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:18812 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:18840
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding1⤵PID:1964