ryuk | 30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122

Analysis

max time kernel
170s
max time network
145s
platform
windows7_x64
resource
win7-en-20211208
submitted
20-02-2022 08:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
Size

208KB
MD5

c596f71c6048997c88e80b57f045b891
SHA1

ed2b5d11f20648a49a11be1795be5632c412879d
SHA256

30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122
SHA512

e18effe825ca1355bafcaf1da41bdf0485bab3af2898d963c059b922f03c2128756da679667b6480234bb3daed4b2e2a366241782f9f4b404ca7897683cc11eb

Score

10^/10

ryuk ransomware

Malware Config

Extracted

Path

C:\RyukReadMe.txt

Family

ryuk

Ransom Note

Special warning for system administrators, network administrators and third parties: Do not try to solve this problem by yourselves! Don't change file extensions! It can be dangerous for the encrypted information! Your network has been penetrated. All files on each network host have been encrypted with a strong algorithm. Backups were encrypted too. Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover. Decryption takes from ten minutes up to several hours. It is performed automatically and doesn't require from you any actions except decoder launching. DO NOT RESET OR SHUTDOWN SYSTEM � files may be damaged. DO NOT DELETE readme files.Your system administrators are trying to solve problem by simple file extension changing. This actions seriously increase the time needed to recover your company's PCs and network servers! To confirm our honest intentions. Send 2 different random files and you will get them back decrypted. It can be from different computers on your network to be sure that one key decrypts everything. We will unlock 2 files for free. To get info (decrypt your files) contact us at [email protected] or [email protected] You will receive btc address for payment in the reply letter Ryuk No system is safe

Emails

[email protected]

Signatures

Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
ransomware ryuk

Drops desktop.ini file(s) 56 IoCs

description	ioc	Process
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Downloads\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Music\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\History\History.IE5\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\8927RJE4\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\ZZZ3YRT4\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\ZKOSACOX\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Contacts\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Videos\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\Documents\My Pictures\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows Mail\Stationery\Desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\VL9MRVWS\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\E16QEJ8K\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Feeds Cache\H2R8HLJC\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\Desktop\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\Favorites\Links for United States\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\AKOZAZUE\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	taskhost.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\DBS3QI6C\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Local\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temporary Internet Files\Content.IE5\desktop.ini	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
File opened for modification	C:\Documents and Settings\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	taskhost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Runs net.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
1108	taskhost.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
1108	taskhost.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
1108	taskhost.exe
948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
Token: SeBackupPrivilege	1108	taskhost.exe
Token: SeBackupPrivilege	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 1108	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	16
PID 948 wrote to memory of 1408	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	27
PID 948 wrote to memory of 1408	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	27
PID 948 wrote to memory of 1408	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	27
PID 948 wrote to memory of 1164	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	15
PID 948 wrote to memory of 1176	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	29
PID 948 wrote to memory of 1176	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	29
PID 948 wrote to memory of 1176	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	29
PID 1408 wrote to memory of 1856	1408	net.exe	31
PID 1408 wrote to memory of 1856	1408	net.exe	31
PID 1408 wrote to memory of 1856	1408	net.exe	31
PID 1176 wrote to memory of 1364	1176	net.exe	32
PID 1176 wrote to memory of 1364	1176	net.exe	32
PID 1176 wrote to memory of 1364	1176	net.exe	32
PID 1108 wrote to memory of 992	1108	taskhost.exe	34
PID 1108 wrote to memory of 992	1108	taskhost.exe	34
PID 1108 wrote to memory of 992	1108	taskhost.exe	34
PID 992 wrote to memory of 1848	992	net.exe	35
PID 992 wrote to memory of 1848	992	net.exe	35
PID 992 wrote to memory of 1848	992	net.exe	35
PID 1108 wrote to memory of 1628	1108	taskhost.exe	36
PID 1108 wrote to memory of 1628	1108	taskhost.exe	36
PID 1108 wrote to memory of 1628	1108	taskhost.exe	36
PID 1628 wrote to memory of 824	1628	net.exe	38
PID 1628 wrote to memory of 824	1628	net.exe	38
PID 1628 wrote to memory of 824	1628	net.exe	38
PID 948 wrote to memory of 1764	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	39
PID 948 wrote to memory of 1764	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	39
PID 948 wrote to memory of 1764	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	39
PID 1764 wrote to memory of 1660	1764	net.exe	41
PID 1764 wrote to memory of 1660	1764	net.exe	41
PID 1764 wrote to memory of 1660	1764	net.exe	41
PID 948 wrote to memory of 1616	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	42
PID 948 wrote to memory of 1616	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	42
PID 948 wrote to memory of 1616	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	42
PID 1616 wrote to memory of 1936	1616	net.exe	44
PID 1616 wrote to memory of 1936	1616	net.exe	44
PID 1616 wrote to memory of 1936	1616	net.exe	44
PID 948 wrote to memory of 4980	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	47
PID 948 wrote to memory of 4980	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	47
PID 948 wrote to memory of 4980	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	47
PID 4980 wrote to memory of 5004	4980	net.exe	49
PID 4980 wrote to memory of 5004	4980	net.exe	49
PID 4980 wrote to memory of 5004	4980	net.exe	49
PID 1108 wrote to memory of 1224	1108	taskhost.exe	50
PID 1108 wrote to memory of 1224	1108	taskhost.exe	50
PID 1108 wrote to memory of 1224	1108	taskhost.exe	50
PID 1224 wrote to memory of 4976	1224	net.exe	52
PID 1224 wrote to memory of 4976	1224	net.exe	52
PID 1224 wrote to memory of 4976	1224	net.exe	52
PID 948 wrote to memory of 5004	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	53
PID 948 wrote to memory of 5004	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	53
PID 948 wrote to memory of 5004	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	53
PID 5004 wrote to memory of 5012	5004	net.exe	55
PID 5004 wrote to memory of 5012	5004	net.exe	55
PID 5004 wrote to memory of 5012	5004	net.exe	55
PID 948 wrote to memory of 16860	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	56
PID 948 wrote to memory of 16860	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	56
PID 948 wrote to memory of 16860	948	30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe	56
PID 16860 wrote to memory of 16884	16860	net.exe	58
PID 16860 wrote to memory of 16884	16860	net.exe	58
PID 16860 wrote to memory of 16884	16860	net.exe	58
PID 1108 wrote to memory of 17012	1108	taskhost.exe	59
PID 1108 wrote to memory of 17012	1108	taskhost.exe	59

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1164

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1108
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1848
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1628
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:824
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1224
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:4976
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:17012
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17036

C:\Users\Admin\AppData\Local\Temp\30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe
"C:\Users\Admin\AppData\Local\Temp\30d986f622f5f1f7dbab689ab17293ede8e37edbb1a8709658b2a4320683c122.exe"
1⤵
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1408
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1856
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1176
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1364
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1764
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "audioendpointbuilder" /y
    3⤵
    PID:1660
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1616
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:1936
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4980
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5004
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:5004
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:5012
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:16860
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:16884
- C:\Windows\System32\net.exe
  "C:\Windows\System32\net.exe" stop "samss" /y
  2⤵
  PID:17048
- - C:\Windows\system32\net1.exe
    C:\Windows\system32\net1 stop "samss" /y
    3⤵
    PID:17072

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/948-56-0x000007FEFBEB1000-0x000007FEFBEB3000-memory.dmp

Filesize
8KB

Download
memory/1108-55-0x000000013F1A0000-0x000000013F537000-memory.dmp

Filesize
3.6MB

Download
memory/1108-57-0x000000013F1A0000-0x000000013F537000-memory.dmp

Filesize
3.6MB

Download