ryuk | 66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe

Analysis

max time kernel
171s
max time network
151s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 06:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
Size

200KB
MD5

ebcadf583bfc61ebb3dd8a119527d829
SHA1

259be1414a0ac7892dddea0259b41094150b8d3d
SHA256

66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe
SHA512

9d1099a3cd7675b2baebd2b9b67db42800f0afd33c8ff326155c54e16328bf0b477cfff6fa3785921f1b62eeca8b8ece9afd01cdc3f6fd9f3751e5603c3a87bb

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> [email protected] </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] [email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 64 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\SendTo\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Administrative Tools\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Recent\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Saved Games\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\Searches\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\System Tools\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Recent\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\SendTo\Desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Links\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Accessories\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\Downloads\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Start Menu\Programs\Maintenance\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1108	taskhost.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1108	taskhost.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
1108	taskhost.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
Token: SeBackupPrivilege	1108	taskhost.exe
Token: SeBackupPrivilege	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1304 wrote to memory of 1108	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	17
PID 1304 wrote to memory of 1172	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	16
PID 1304 wrote to memory of 572	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	27
PID 1304 wrote to memory of 572	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	27
PID 1304 wrote to memory of 572	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	27
PID 1304 wrote to memory of 1488	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	29
PID 1304 wrote to memory of 1488	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	29
PID 1304 wrote to memory of 1488	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	29
PID 572 wrote to memory of 556	572	net.exe	32
PID 572 wrote to memory of 556	572	net.exe	32
PID 572 wrote to memory of 556	572	net.exe	32
PID 1488 wrote to memory of 324	1488	net.exe	31
PID 1488 wrote to memory of 324	1488	net.exe	31
PID 1488 wrote to memory of 324	1488	net.exe	31
PID 1304 wrote to memory of 1924	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	33
PID 1304 wrote to memory of 1924	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	33
PID 1304 wrote to memory of 1924	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	33
PID 1924 wrote to memory of 1804	1924	net.exe	35
PID 1924 wrote to memory of 1804	1924	net.exe	35
PID 1924 wrote to memory of 1804	1924	net.exe	35
PID 1108 wrote to memory of 1100	1108	taskhost.exe	36
PID 1108 wrote to memory of 1100	1108	taskhost.exe	36
PID 1108 wrote to memory of 1100	1108	taskhost.exe	36
PID 1100 wrote to memory of 732	1100	net.exe	38
PID 1100 wrote to memory of 732	1100	net.exe	38
PID 1100 wrote to memory of 732	1100	net.exe	38
PID 1304 wrote to memory of 1680	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	39
PID 1304 wrote to memory of 1680	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	39
PID 1304 wrote to memory of 1680	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	39
PID 1680 wrote to memory of 1336	1680	net.exe	41
PID 1680 wrote to memory of 1336	1680	net.exe	41
PID 1680 wrote to memory of 1336	1680	net.exe	41
PID 1108 wrote to memory of 1640	1108	taskhost.exe	43
PID 1108 wrote to memory of 1640	1108	taskhost.exe	43
PID 1108 wrote to memory of 1640	1108	taskhost.exe	43
PID 1640 wrote to memory of 1752	1640	net.exe	44
PID 1640 wrote to memory of 1752	1640	net.exe	44
PID 1640 wrote to memory of 1752	1640	net.exe	44
PID 1304 wrote to memory of 5780	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	47
PID 1304 wrote to memory of 5780	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	47
PID 1304 wrote to memory of 5780	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	47
PID 5780 wrote to memory of 5804	5780	net.exe	49
PID 5780 wrote to memory of 5804	5780	net.exe	49
PID 5780 wrote to memory of 5804	5780	net.exe	49
PID 1304 wrote to memory of 6220	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	50
PID 1304 wrote to memory of 6220	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	50
PID 1304 wrote to memory of 6220	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	50
PID 1108 wrote to memory of 6248	1108	taskhost.exe	52
PID 1108 wrote to memory of 6248	1108	taskhost.exe	52
PID 1108 wrote to memory of 6248	1108	taskhost.exe	52
PID 6220 wrote to memory of 6256	6220	net.exe	53
PID 6220 wrote to memory of 6256	6220	net.exe	53
PID 6220 wrote to memory of 6256	6220	net.exe	53
PID 6248 wrote to memory of 6280	6248	net.exe	55
PID 6248 wrote to memory of 6280	6248	net.exe	55
PID 6248 wrote to memory of 6280	6248	net.exe	55
PID 1304 wrote to memory of 17048	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	56
PID 1304 wrote to memory of 17048	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	56
PID 1304 wrote to memory of 17048	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	56
PID 17048 wrote to memory of 17072	17048	net.exe	58
PID 17048 wrote to memory of 17072	17048	net.exe	58
PID 17048 wrote to memory of 17072	17048	net.exe	58
PID 1304 wrote to memory of 17108	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	59
PID 1304 wrote to memory of 17108	1304	66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe	59

C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe
"C:\Users\Admin\AppData\Local\Temp\66973026e9f6c24e4e88f631fc72efb4c9096e67e9e726486cea4c2986512ebe.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1304
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:572
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:556
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1488
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:324
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1804
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1680
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1336
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5804
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6220
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:6256
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:17048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17072
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:17108
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17136

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1172

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1100
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:732
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1752
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:6248
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:6280
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:17144
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17168

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1108-57-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

Filesize
2.9MB

Download
memory/1108-55-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

Filesize
2.9MB

Download
memory/1172-59-0x000000013FAE0000-0x000000013FDBA000-memory.dmp

Filesize
2.9MB

Download
memory/1304-56-0x000007FEFBD21000-0x000007FEFBD23000-memory.dmp

Filesize
8KB

Download