ryuk | 320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689

Analysis

max time kernel
173s
max time network
82s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 08:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
Size

190KB
MD5

ffef678beca8ee60200bc88809d89630
SHA1

b31070af1ac3e088dfc6f1599f8d12edb1b16783
SHA256

320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689
SHA512

54298098a866e24d99e3764154ae3ca4481e9163fd6e9e0d2c27d7978065a38da38accd58268c985b4ed0cfd4c11a27f4fa51e815c2d7a15e3ec18c453df89c3

Score

10^/10

ryuk discovery persistence ransomware

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html��

Emails

[email protected]

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html

Family

ryuk

Ransom Note

[email protected] balance of shadow universe Ryuk

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Executes dropped EXE 1 IoCs

pid	Process
516	EahlAUB.exe

Loads dropped DLL 2 IoCs

pid	Process
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe

Modifies file permissions 1 TTPs 4 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1260	icacls.exe
672	icacls.exe
1528	icacls.exe
1512	icacls.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe"	reg.exe
Key created	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\Users\\Admin\\AppData\\Local\\Temp\\EahlAUB.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Interacts with shadow copies 2 TTPs 2 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1107

Inhibit System Recovery

T1490

pid	Process
1376	vssadmin.exe
976	vssadmin.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 35 IoCs

pid	Process
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
516	EahlAUB.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
516	EahlAUB.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe
516	EahlAUB.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
Token: SeBackupPrivilege	516	EahlAUB.exe
Token: SeBackupPrivilege	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
Token: SeIncreaseQuotaPrivilege	2044	WMIC.exe
Token: SeSecurityPrivilege	2044	WMIC.exe
Token: SeTakeOwnershipPrivilege	2044	WMIC.exe
Token: SeLoadDriverPrivilege	2044	WMIC.exe
Token: SeSystemProfilePrivilege	2044	WMIC.exe
Token: SeSystemtimePrivilege	2044	WMIC.exe
Token: SeProfSingleProcessPrivilege	2044	WMIC.exe
Token: SeIncBasePriorityPrivilege	2044	WMIC.exe
Token: SeCreatePagefilePrivilege	2044	WMIC.exe
Token: SeBackupPrivilege	2044	WMIC.exe
Token: SeRestorePrivilege	2044	WMIC.exe
Token: SeShutdownPrivilege	2044	WMIC.exe
Token: SeDebugPrivilege	2044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2044	WMIC.exe
Token: SeRemoteShutdownPrivilege	2044	WMIC.exe
Token: SeUndockPrivilege	2044	WMIC.exe
Token: SeManageVolumePrivilege	2044	WMIC.exe
Token: 33	2044	WMIC.exe
Token: 34	2044	WMIC.exe
Token: 35	2044	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1960	WMIC.exe
Token: SeSecurityPrivilege	1960	WMIC.exe
Token: SeTakeOwnershipPrivilege	1960	WMIC.exe
Token: SeLoadDriverPrivilege	1960	WMIC.exe
Token: SeSystemProfilePrivilege	1960	WMIC.exe
Token: SeSystemtimePrivilege	1960	WMIC.exe
Token: SeProfSingleProcessPrivilege	1960	WMIC.exe
Token: SeIncBasePriorityPrivilege	1960	WMIC.exe
Token: SeCreatePagefilePrivilege	1960	WMIC.exe
Token: SeBackupPrivilege	1960	WMIC.exe
Token: SeRestorePrivilege	1960	WMIC.exe
Token: SeShutdownPrivilege	1960	WMIC.exe
Token: SeDebugPrivilege	1960	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1960	WMIC.exe
Token: SeRemoteShutdownPrivilege	1960	WMIC.exe
Token: SeUndockPrivilege	1960	WMIC.exe
Token: SeManageVolumePrivilege	1960	WMIC.exe
Token: 33	1960	WMIC.exe
Token: 34	1960	WMIC.exe
Token: 35	1960	WMIC.exe
Token: SeBackupPrivilege	1764	vssvc.exe
Token: SeRestorePrivilege	1764	vssvc.exe
Token: SeAuditPrivilege	1764	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2044	WMIC.exe
Token: SeSecurityPrivilege	2044	WMIC.exe
Token: SeTakeOwnershipPrivilege	2044	WMIC.exe
Token: SeLoadDriverPrivilege	2044	WMIC.exe
Token: SeSystemProfilePrivilege	2044	WMIC.exe
Token: SeSystemtimePrivilege	2044	WMIC.exe
Token: SeProfSingleProcessPrivilege	2044	WMIC.exe
Token: SeIncBasePriorityPrivilege	2044	WMIC.exe
Token: SeCreatePagefilePrivilege	2044	WMIC.exe
Token: SeBackupPrivilege	2044	WMIC.exe
Token: SeRestorePrivilege	2044	WMIC.exe
Token: SeShutdownPrivilege	2044	WMIC.exe
Token: SeDebugPrivilege	2044	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2044	WMIC.exe
Token: SeRemoteShutdownPrivilege	2044	WMIC.exe
Token: SeUndockPrivilege	2044	WMIC.exe
Token: SeManageVolumePrivilege	2044	WMIC.exe
Token: 33	2044	WMIC.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 516	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	27
PID 1036 wrote to memory of 516	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	27
PID 1036 wrote to memory of 516	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	27
PID 1036 wrote to memory of 516	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	27
PID 1036 wrote to memory of 1116	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	14
PID 1036 wrote to memory of 1624	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	28
PID 1036 wrote to memory of 1624	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	28
PID 1036 wrote to memory of 1624	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	28
PID 1036 wrote to memory of 1624	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	28
PID 1624 wrote to memory of 564	1624	net.exe	30
PID 1624 wrote to memory of 564	1624	net.exe	30
PID 1624 wrote to memory of 564	1624	net.exe	30
PID 1624 wrote to memory of 564	1624	net.exe	30
PID 1036 wrote to memory of 832	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	31
PID 1036 wrote to memory of 832	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	31
PID 1036 wrote to memory of 832	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	31
PID 1036 wrote to memory of 832	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	31
PID 832 wrote to memory of 276	832	net.exe	33
PID 832 wrote to memory of 276	832	net.exe	33
PID 832 wrote to memory of 276	832	net.exe	33
PID 832 wrote to memory of 276	832	net.exe	33
PID 1036 wrote to memory of 1184	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	13
PID 516 wrote to memory of 1512	516	EahlAUB.exe	34
PID 516 wrote to memory of 1512	516	EahlAUB.exe	34
PID 516 wrote to memory of 1512	516	EahlAUB.exe	34
PID 516 wrote to memory of 1512	516	EahlAUB.exe	34
PID 516 wrote to memory of 1260	516	EahlAUB.exe	35
PID 516 wrote to memory of 1260	516	EahlAUB.exe	35
PID 516 wrote to memory of 1260	516	EahlAUB.exe	35
PID 516 wrote to memory of 1260	516	EahlAUB.exe	35
PID 516 wrote to memory of 2012	516	EahlAUB.exe	38
PID 516 wrote to memory of 2012	516	EahlAUB.exe	38
PID 516 wrote to memory of 2012	516	EahlAUB.exe	38
PID 516 wrote to memory of 2012	516	EahlAUB.exe	38
PID 1036 wrote to memory of 672	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	40
PID 1036 wrote to memory of 672	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	40
PID 1036 wrote to memory of 672	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	40
PID 1036 wrote to memory of 672	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	40
PID 1036 wrote to memory of 1528	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	42
PID 1036 wrote to memory of 1528	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	42
PID 1036 wrote to memory of 1528	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	42
PID 1036 wrote to memory of 1528	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	42
PID 1036 wrote to memory of 952	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	44
PID 1036 wrote to memory of 952	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	44
PID 1036 wrote to memory of 952	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	44
PID 1036 wrote to memory of 952	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	44
PID 516 wrote to memory of 1376	516	EahlAUB.exe	46
PID 516 wrote to memory of 1376	516	EahlAUB.exe	46
PID 516 wrote to memory of 1376	516	EahlAUB.exe	46
PID 516 wrote to memory of 1376	516	EahlAUB.exe	46
PID 1036 wrote to memory of 976	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	47
PID 1036 wrote to memory of 976	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	47
PID 1036 wrote to memory of 976	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	47
PID 1036 wrote to memory of 976	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	47
PID 1036 wrote to memory of 1604	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	50
PID 1036 wrote to memory of 1604	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	50
PID 1036 wrote to memory of 1604	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	50
PID 1036 wrote to memory of 1604	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	50
PID 1036 wrote to memory of 1692	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	51
PID 1036 wrote to memory of 1692	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	51
PID 1036 wrote to memory of 1692	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	51
PID 1036 wrote to memory of 1692	1036	320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe	51
PID 1692 wrote to memory of 1284	1692	net.exe	54
PID 1692 wrote to memory of 1284	1692	net.exe	54

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1184

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1116

C:\Users\Admin\AppData\Local\Temp\320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe
"C:\Users\Admin\AppData\Local\Temp\320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe"
1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Users\Admin\AppData\Local\Temp\EahlAUB.exe
  "C:\Users\Admin\AppData\Local\Temp\EahlAUB.exe" 8 LAN
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:516
- - C:\Windows\SysWOW64\icacls.exe
    icacls "C:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1512
- - C:\Windows\SysWOW64\icacls.exe
    icacls "D:\*" /grant Everyone:F /T /C /Q
    3⤵
    - Modifies file permissions
    PID:1260
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c "WMIC.exe shadowcopy delet"
    3⤵
    PID:2012
  - - C:\Windows\SysWOW64\Wbem\WMIC.exe
      WMIC.exe shadowcopy delet
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1960
- - C:\Windows\SysWOW64\vssadmin.exe
    vssadmin.exe Delete Shadows /all /quiet
    3⤵
    - Interacts with shadow copies
    PID:1376
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:1612
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:1756
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EahlAUB.exe" /f /reg:64
    3⤵
    PID:2476
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\EahlAUB.exe" /f /reg:64
      4⤵
      Adds Run key to start application
      PID:2504
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" stop "samss" /y
    3⤵
    PID:28112
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "samss" /y
      4⤵
      PID:28144
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1624
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:564
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:832
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:276
- C:\Windows\SysWOW64\icacls.exe
  icacls "C:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:672
- C:\Windows\SysWOW64\icacls.exe
  icacls "D:\*" /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1528
- C:\Windows\SysWOW64\cmd.exe
  cmd /c "WMIC.exe shadowcopy delet"
  2⤵
  PID:952
- - C:\Windows\SysWOW64\Wbem\WMIC.exe
    WMIC.exe shadowcopy delet
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2044
- C:\Windows\SysWOW64\vssadmin.exe
  vssadmin.exe Delete Shadows /all /quiet
  2⤵
  - Interacts with shadow copies
  PID:976
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe" /f /reg:64
  2⤵
  PID:1604
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\320c98a9fd479c43fde9d3773a9eccd58e6cc63d1ba93343222c0b565460d689.exe" /f /reg:64
    3⤵
    - Adds Run key to start application
    PID:1936
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1692
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1284
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:19316
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:22988
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:28076
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:28100
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:28264
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:28288
- C:\Windows\SysWOW64\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:36332
- - C:\Windows\SysWOW64\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:38088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

File Deletion

T1107

File and Directory Permissions Modification

T1222

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1036-54-0x0000000075531000-0x0000000075533000-memory.dmp

Filesize
8KB

Download
memory/1116-59-0x0000000030000000-0x000000003016F000-memory.dmp

Filesize
1.4MB

Download