ryuk | 646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629

Analysis

max time kernel
169s
max time network
27s
platform
windows7_x64
resource
win7-en-20211208
submitted
20/02/2022, 06:31 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
Size

212KB
MD5

3920d0157efcfbc01837be686e636a8d
SHA1

494414c45d655abf60b393c7c299f7647c0dbe1d
SHA256

646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629
SHA512

30ad22af397df2f0d4757e9fe45a17cdee92a19ed582b93fc24250a6bb3713b8fa01d487deae5fb99b46519ffa3c007b4805a3b785d64ebd8c27d6459879eb48

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Only we have exclusive decryption software, suitable for your situation. More than a year ago, world experts recognized the impossibility of such encryption deciphering by any means except the original decoder. No decryption software is available in the public. Antivirus companies, researchers, IT specialists, and any other persons cannot help you to decipher the data. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files. To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us a KaysynKuechle@protonmail.com or StridDeana1995@protonmail.com You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

KaysynKuechle@protonmail.com

StridDeana1995@protonmail.com

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 49 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1256	taskhost.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1256	taskhost.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
1256	taskhost.exe
1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
Token: SeBackupPrivilege	1256	taskhost.exe
Token: SeBackupPrivilege	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1256	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	16
PID 1540 wrote to memory of 1360	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	15
PID 1540 wrote to memory of 696	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	27
PID 1540 wrote to memory of 696	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	27
PID 1540 wrote to memory of 696	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	27
PID 1540 wrote to memory of 1004	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	29
PID 1540 wrote to memory of 1004	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	29
PID 1540 wrote to memory of 1004	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	29
PID 1540 wrote to memory of 836	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	31
PID 1540 wrote to memory of 836	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	31
PID 1540 wrote to memory of 836	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	31
PID 836 wrote to memory of 896	836	net.exe	35
PID 836 wrote to memory of 896	836	net.exe	35
PID 836 wrote to memory of 896	836	net.exe	35
PID 1004 wrote to memory of 1524	1004	net.exe	34
PID 1004 wrote to memory of 1524	1004	net.exe	34
PID 1004 wrote to memory of 1524	1004	net.exe	34
PID 696 wrote to memory of 1852	696	net.exe	33
PID 696 wrote to memory of 1852	696	net.exe	33
PID 696 wrote to memory of 1852	696	net.exe	33
PID 1256 wrote to memory of 1788	1256	taskhost.exe	36
PID 1256 wrote to memory of 1788	1256	taskhost.exe	36
PID 1256 wrote to memory of 1788	1256	taskhost.exe	36
PID 1788 wrote to memory of 1964	1788	net.exe	38
PID 1788 wrote to memory of 1964	1788	net.exe	38
PID 1788 wrote to memory of 1964	1788	net.exe	38
PID 1256 wrote to memory of 1104	1256	taskhost.exe	39
PID 1256 wrote to memory of 1104	1256	taskhost.exe	39
PID 1256 wrote to memory of 1104	1256	taskhost.exe	39
PID 1104 wrote to memory of 2040	1104	net.exe	41
PID 1104 wrote to memory of 2040	1104	net.exe	41
PID 1104 wrote to memory of 2040	1104	net.exe	41
PID 1256 wrote to memory of 1152	1256	taskhost.exe	43
PID 1256 wrote to memory of 1152	1256	taskhost.exe	43
PID 1256 wrote to memory of 1152	1256	taskhost.exe	43
PID 1152 wrote to memory of 964	1152	net.exe	45
PID 1152 wrote to memory of 964	1152	net.exe	45
PID 1152 wrote to memory of 964	1152	net.exe	45
PID 1540 wrote to memory of 1780	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	46
PID 1540 wrote to memory of 1780	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	46
PID 1540 wrote to memory of 1780	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	46
PID 1780 wrote to memory of 1700	1780	net.exe	48
PID 1780 wrote to memory of 1700	1780	net.exe	48
PID 1780 wrote to memory of 1700	1780	net.exe	48
PID 1540 wrote to memory of 1760	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	49
PID 1540 wrote to memory of 1760	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	49
PID 1540 wrote to memory of 1760	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	49
PID 1760 wrote to memory of 1940	1760	net.exe	51
PID 1760 wrote to memory of 1940	1760	net.exe	51
PID 1760 wrote to memory of 1940	1760	net.exe	51
PID 1540 wrote to memory of 4888	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	54
PID 1540 wrote to memory of 4888	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	54
PID 1540 wrote to memory of 4888	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	54
PID 4888 wrote to memory of 4912	4888	net.exe	56
PID 4888 wrote to memory of 4912	4888	net.exe	56
PID 4888 wrote to memory of 4912	4888	net.exe	56
PID 1256 wrote to memory of 4924	1256	taskhost.exe	57
PID 1256 wrote to memory of 4924	1256	taskhost.exe	57
PID 1256 wrote to memory of 4924	1256	taskhost.exe	57
PID 4924 wrote to memory of 4952	4924	net.exe	59
PID 4924 wrote to memory of 4952	4924	net.exe	59
PID 4924 wrote to memory of 4952	4924	net.exe	59
PID 1540 wrote to memory of 4968	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	60
PID 1540 wrote to memory of 4968	1540	646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe	60

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1360

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1788
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:1964
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1104
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:2040
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1152
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:964
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4924
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4952
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:16956
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16980

C:\Users\Admin\AppData\Local\Temp\646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe
"C:\Users\Admin\AppData\Local\Temp\646632b7ef80f2a29327db44817aa61792c7c2fe15e09daa6643d59312b9d629.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "spooler" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "spooler" /y
    3⤵
    PID:1852
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1524
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:836
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:896
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1780
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1700
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1760
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1940
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4888
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4912
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:4968
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4992
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:16908
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16932
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:16996
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17020

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {995C996E-D918-4a8c-A302-45719A6F4EA7} -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1256-58-0x000000013F720000-0x000000013FAB7000-memory.dmp

Filesize
3.6MB

Download
memory/1256-56-0x000000013F720000-0x000000013FAB7000-memory.dmp

Filesize
3.6MB

Download
memory/1360-59-0x000000013F720000-0x000000013FAB7000-memory.dmp

Filesize
3.6MB

Download
memory/1540-55-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp

Filesize
8KB

Download