ryuk | 80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05

Analysis

max time kernel
168s
max time network
189s
platform
windows10-2004_x64
resource
win10v2004-en-20220112
submitted
20-02-2022 05:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
Size

203KB
MD5

8431a207fab74137df795fb46732544c
SHA1

abb80c03d3aa69ac38f62a447636b0fc1bf21d45
SHA256

80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05
SHA512

98971c7ff9154482a53c05e725cea25f873ed88d6ac721e943bad35183ad070788f28da22ec2f8ee5fb38b862664a37c15b97bffcb5567d54c6476b1abef39db

Score

10^/10

ryuk persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Documents and Settings\Admin\AppData\Local\Adobe\Color\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] [email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Executes dropped EXE 1 IoCs

pid	Process
3620	SjvaCxf.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
Key value queried	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation	SjvaCxf.exe

Adds Run key to start application 2 TTPs 6 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\SjvaCxf.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Windows\\system32\\sihost.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
5552	2700	WerFault.exe	37

Modifies registry class 10 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = 999f4d3e2426d801	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de-	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = "Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy"	RuntimeBroker.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = 0114020000000000c0000000000000464c0000000114020000000000c000000000000046830000002000000055cf70929d17d801e729b93a2426d801e729b93a2426d801ca2108000000000001000000000000000000000000000000260514001f50e04fd020ea3a6910a2d808002b30309d19002f433a5c0000000000000000000000000000000000000050003100000000000000000010005573657273003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005500730065007200730000001400500031000000000000000000100041646d696e003c0009000400efbe00000000000000002e0000000000000000000000000000000000000000000000000000000000410064006d0069006e000000140056003100000000000000000010004170704461746100400009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000041007000700044006100740061000000160050003100000000000000000010004c6f63616c003c0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c00000014005a003100000000000000000010005061636b616765730000420009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000005000610063006b00610067006500730000001800e4003100000000000000000010004d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e31683274787965777900009e0009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e003100680032007400780079006500770079000000460060003100000000000000000010004c6f63616c53746174650000460009000400efbe00000000000000002e00000000000000000000000000000000000000000000000000000000004c006f00630061006c005300740061007400650000001a00660031000000000000000000100053746167656441737365747300004a0009000400efbe00000000000000002e000000000000000000000000000000000000000000000000000000000053007400610067006500640041007300730065007400730000001c00ad01320000000000415431972000313936346162363366663833313332383062353437353361306233306631326235383864353664643132326533623733353230373766333138346661363631650000b20009000400efbe41543197415431972e0000000000000000000000000000000000000000000000000000801200310039003600340061006200360033006600660038003300310033003200380030006200350034003700350033006100300062003300300066003100320062003500380038006400350036006400640031003200320065003300620037003300350032003000370037006600330031003800340066006100360036003100650000005000ab0000002700efbe9d00000031535053b79daeff8d1cff43818c84403aa3732d8100000064000000001f000000370000004d006900630072006f0073006f00660074002e00570069006e0064006f00770073002e0043006f006e00740065006e007400440065006c00690076006500720079004d0061006e0061006700650072005f006300770035006e0031006800320074007800790065007700790000000000000000000000000050000000eb0000001c000000010000001c0000003400000000000000ea000000180000000300000033e5ba291000000057696e646f777300433a5c55736572735c41646d696e5c417070446174615c4c6f63616c5c5061636b616765735c4d6963726f736f66742e57696e646f77732e436f6e74656e7444656c69766572794d616e616765725f6377356e3168327478796577795c4c6f63616c53746174655c5374616765644173736574735c31393634616236336666383331333238306235343735336130623330663132623538386435366464313232653362373335323037376633313834666136363165000010000000050000a028000000cd0000001c0000000b0000a08f856c5e220e60479afeea3317b67173cd00000060000000030000a0580000000000000072696263717568710000000000000000bad9b5dc40371b4eb595e9fc647d27d673fb99499083ec1182d0da616a59bcb7bad9b5dc40371b4eb595e9fc647d27d673fb99499083ec1182d0da616a59bcb7ce000000090000a08900000031535053e28a5846bc4c3843bbfc139326986dce6d00000004000000001f0000002e00000053002d0031002d0035002d00320031002d003700390030003700310034003400390038002d0031003500340039003400320031003400390031002d0031003600340033003300390037003100330039002d0031003000300030000000000000003900000031535053b1166d44ad8d7048a748402ea43d788c1d0000006800000000480000002b5b8d01000000000000d01200000000000000000000000000000000	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System	RuntimeBroker.exe
Key created	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de-	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = "8324"	RuntimeBroker.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = "\\\\?\\Volume{018D5B2B-0000-0000-0000-D01200000000}\\Users\\Admin\\AppData\\Local\\Packages\\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\\LocalState\\StagedAssets\\1964ab63ff8313280b54753a0b30f12b588d56dd122e3b7352077f3184fa661e"	RuntimeBroker.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\PersistedStorageItemTable\System\12282a43-b513-45de- = "0"	RuntimeBroker.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3620	SjvaCxf.exe
3620	SjvaCxf.exe
2200	sihost.exe
2200	sihost.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3620	SjvaCxf.exe
3620	SjvaCxf.exe
2200	sihost.exe
2200	sihost.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
Token: SeBackupPrivilege	3620	SjvaCxf.exe
Token: SeBackupPrivilege	2200	sihost.exe
Token: SeBackupPrivilege	2888	StartMenuExperienceHost.exe
Token: SeBackupPrivilege	1376	BackgroundTransferHost.exe
Token: SeBackupPrivilege	3376	backgroundTaskHost.exe
Token: SeBackupPrivilege	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 3148 wrote to memory of 3620	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	60
PID 3148 wrote to memory of 3620	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	60
PID 3148 wrote to memory of 2200	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	41
PID 3148 wrote to memory of 2224	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	40
PID 3148 wrote to memory of 2264	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	12
PID 3148 wrote to memory of 2520	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	38
PID 3148 wrote to memory of 2700	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	37
PID 3148 wrote to memory of 2888	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	35
PID 3148 wrote to memory of 2952	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	13
PID 3148 wrote to memory of 3032	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	34
PID 3148 wrote to memory of 2640	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	33
PID 3148 wrote to memory of 3344	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	31
PID 3148 wrote to memory of 1712	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	14
PID 3148 wrote to memory of 1376	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	23
PID 3148 wrote to memory of 3156	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	21
PID 3148 wrote to memory of 3376	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	20
PID 2200 wrote to memory of 3196	2200	sihost.exe	63
PID 2200 wrote to memory of 3196	2200	sihost.exe	63
PID 3196 wrote to memory of 2884	3196	cmd.exe	65
PID 3196 wrote to memory of 2884	3196	cmd.exe	65
PID 3148 wrote to memory of 3868	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	66
PID 3148 wrote to memory of 3868	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	66
PID 3868 wrote to memory of 4324	3868	cmd.exe	68
PID 3868 wrote to memory of 4324	3868	cmd.exe	68
PID 3148 wrote to memory of 4728	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	69
PID 3148 wrote to memory of 4728	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	69
PID 3620 wrote to memory of 4744	3620	SjvaCxf.exe	78
PID 3620 wrote to memory of 4744	3620	SjvaCxf.exe	78
PID 2200 wrote to memory of 4948	2200	sihost.exe	77
PID 2200 wrote to memory of 4948	2200	sihost.exe	77
PID 3148 wrote to memory of 4940	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	70
PID 3148 wrote to memory of 4940	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	70
PID 3148 wrote to memory of 4956	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	76
PID 3148 wrote to memory of 4956	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	76
PID 3620 wrote to memory of 4976	3620	SjvaCxf.exe	81
PID 3620 wrote to memory of 4976	3620	SjvaCxf.exe	81
PID 2200 wrote to memory of 4984	2200	sihost.exe	79
PID 2200 wrote to memory of 4984	2200	sihost.exe	79
PID 3148 wrote to memory of 5192	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	84
PID 3148 wrote to memory of 5192	3148	80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe	84
PID 4744 wrote to memory of 5388	4744	net.exe	93
PID 4744 wrote to memory of 5388	4744	net.exe	93
PID 4948 wrote to memory of 5396	4948	net.exe	92
PID 4948 wrote to memory of 5396	4948	net.exe	92
PID 4984 wrote to memory of 5404	4984	net.exe	91
PID 4984 wrote to memory of 5404	4984	net.exe	91
PID 4956 wrote to memory of 5412	4956	net.exe	90
PID 4956 wrote to memory of 5412	4956	net.exe	90
PID 4940 wrote to memory of 5420	4940	net.exe	89
PID 4940 wrote to memory of 5420	4940	net.exe	89
PID 5192 wrote to memory of 5428	5192	net.exe	88
PID 5192 wrote to memory of 5428	5192	net.exe	88
PID 4728 wrote to memory of 5444	4728	net.exe	87
PID 4728 wrote to memory of 5444	4728	net.exe	87
PID 4976 wrote to memory of 5456	4976	net.exe	86
PID 4976 wrote to memory of 5456	4976	net.exe	86
PID 2700 wrote to memory of 5552	2700	DllHost.exe	97
PID 2700 wrote to memory of 5552	2700	DllHost.exe	97
PID 3620 wrote to memory of 5904	3620	SjvaCxf.exe	99
PID 3620 wrote to memory of 5904	3620	SjvaCxf.exe	99
PID 5904 wrote to memory of 5956	5904	cmd.exe	101
PID 5904 wrote to memory of 5956	5904	cmd.exe	101

C:\Windows\system32\taskhostw.exe
taskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}
1⤵
PID:2264

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2952

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
- Modifies registry class
PID:1712

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppXmtcan0h2tfbfy7k9kn8hbxb6dmzz1zh0.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3376

C:\Windows\system32\backgroundTaskHost.exe
"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:CortanaUI.AppX3bn25b6f886wmg6twh46972vprk9tnbf.mca
1⤵
PID:3156

C:\Windows\system32\BackgroundTransferHost.exe
"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.1
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1376

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:3344

C:\Windows\System32\RuntimeBroker.exe
C:\Windows\System32\RuntimeBroker.exe -Embedding
1⤵
PID:2640

C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
1⤵
PID:3032

C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2888

C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
1⤵
- Suspicious use of WriteProcessMemory
PID:2700
- C:\Windows\system32\WerFault.exe
  C:\Windows\system32\WerFault.exe -u -p 2700 -s 1008
  2⤵
  - Program crash
  PID:5552

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p
1⤵
PID:2520

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k UnistackSvcGroup
1⤵
PID:2224

C:\Windows\system32\sihost.exe
sihost.exe
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Windows\system32\sihost.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3196
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Windows\system32\sihost.exe" /f
    3⤵
    - Adds Run key to start application
    PID:2884
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5396
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4984
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5404

C:\Users\Admin\AppData\Local\Temp\80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe
"C:\Users\Admin\AppData\Local\Temp\80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3148
- C:\Users\Admin\AppData\Local\Temp\SjvaCxf.exe
  "C:\Users\Admin\AppData\Local\Temp\SjvaCxf.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Checks computer location settings
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4744
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "audioendpointbuilder" /y
      4⤵
      PID:5388
- - C:\Windows\System32\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:4976
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:5456
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SjvaCxf.exe" /f
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\system32\reg.exe
      REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\SjvaCxf.exe" /f
      4⤵
      Adds Run key to start application
      PID:5956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3868
- - C:\Windows\system32\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\80bb8c391d008606bf99888d7341e530375b92b0ff5ad326b0b0fddacb5ebb05.exe" /f
    3⤵
    - Adds Run key to start application
    PID:4324
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4728
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5444
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4940
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:5420
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5412
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5192
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5428

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 440 -p 3376 -ip 3376
1⤵
PID:5512

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 488 -p 1376 -ip 1376
1⤵
PID:5504

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 424 -p 2700 -ip 2700
1⤵
PID:5536

C:\Windows\system32\WerFault.exe
C:\Windows\system32\WerFault.exe -pss -s 572 -p 2888 -ip 2888
1⤵
PID:5632

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2200-132-0x00007FF7741A0000-0x00007FF774236000-memory.dmp

Filesize
600KB

Download
memory/2224-133-0x00007FF7741A0000-0x00007FF774236000-memory.dmp

Filesize
600KB

Download
memory/2888-134-0x00007FF7741A0000-0x00007FF774236000-memory.dmp

Filesize
600KB

Download