Analysis
-
max time kernel
140s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
06-03-2022 03:42
Static task
static1
Behavioral task
behavioral1
Sample
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
Resource
win7-20220223-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe
-
Size
190KB
-
MD5
65865d94596a90b7e6204deb1de53c3d
-
SHA1
282e3776f86d3b0b2916ed6047ad272fe2f0cf6e
-
SHA256
683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb
-
SHA512
3c148f68856bf284f1775eb67a47ba880d4f69f8d6180a436a860484935c05d95ba5a3ff13e9c4280bb553f49e4f818ffce6e0a6016323d836cabe69bf8be7f5
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
Family
ryuk
Ransom Note
<html><body><p style="font-weight:bold;font-size:125%;top:0;left:0;"> [email protected] <br> </p><p style="position:absolute;bottom:0;right:1%;font-weight:bold;font-size:170%">balance of shadow universe</p><div style="font-size: 550%;font-weight:bold;width:50%;height:50%;overflow:auto;margin:auto;position:absolute;top:35%;left:40%;">Ryuk</div></body></html�������������������������������������������������������������������������������������������������������������������������������������������������������
Emails
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
Family
ryuk
Ransom Note
[email protected]
balance of shadow universe
Ryuk
Emails
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 1 IoCs
pid Process 3760 DBMQnoX.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe Key value queried \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\Control Panel\International\Geo\Nation DBMQnoX.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\a: 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened (read-only) \??\A: 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioProVL_MAK-pl.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\th\LC_MESSAGES\vlc.mo 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_contrast-black.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Windows Defender\es-ES\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\Blank_PhotosSplashWideTile.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-80_altform-unplated_contrast-white.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\de-de\ui-strings.js 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-256_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-64_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailBadge.scale-125.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\AppxMetadata\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-100.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_8.2.22942.0_x64__8wekyb3d8bbwe\Assets\GetStartedAppList.targetsize-36_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Assets\Square44x44Logo.targetsize-36_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\DSCResources\MSFT_PackageManagementSource\en-US\MSFT_PackageManagementSource.strings.psd1 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\WordR_Retail-pl.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\WindowsPowerShell\Modules\Microsoft.PowerShell.Operation.Validation\1.0.1\Test\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\HxCalendarAppList.targetsize-72_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\en-ae\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\en-gb\ui-strings.js 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\AppIcon.targetsize-20_altform-unplated_contrast-black.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-files\js\nls\fr-ma\ui-strings.js 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\Assets\contrast-white\PeopleAppList.targetsize-80_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-96_altform-lightunplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\Word2019VL_MAK_AE-pl.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-200_8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraLargeTile.contrast-white_scale-200.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\StoreLogo.scale-100.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\PeopleAppAssets\Videos\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\O365BusinessR_SubTrial-ul-oob.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeWideTile.scale-125.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsSoundRecorder_10.1906.1972.0_x64__8wekyb3d8bbwe\Assets\VoiceRecorderAppList.contrast-black_targetsize-20_altform-unplated.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-150.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\createpdfupsell-app\js\nls\ca-es\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\my-recent-files\js\nls\da-dk\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\Providers\Plugins2\AdobeHunspellPlugin\Dictionaries\en_CA\README_en_CA.txt 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-100.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsStore_11910.1002.5.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.1706.13331.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\OneNoteSmallTile.scale-125.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\s_organize_18.svg 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\MondoVL_KMS_Client-ul.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\1850_20x20x32.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\contrast-white\OneNoteNewNoteLargeTile.scale-150.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_x64__8wekyb3d8bbwe\Resources\Fonts\SegMVR2.ttf 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Google\Update\1.3.36.71\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\OneNoteR_OEM_Perp-ul-phn.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\PROOF\msth8EN.LEX 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\WATER\THMBNAIL.PNG 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1902.633.0_x64__8wekyb3d8bbwe\AppxMetadata\CodeIntegrity.cat 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Licenses16\VisioPro2019VL_KMS_Client_AE-ppd.xrm-ms 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\OFFSYMSL.TTF 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\9.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.22753.0_x64__8wekyb3d8bbwe\Assets\contrast-white\MedTile.scale-150_contrast-white.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Locale\en_US\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\digsig\js\nls\pt-br\ui-strings.js 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\Microsoft Office\root\vfs\ProgramFilesX64\Microsoft Analysis Services\AS OLEDB\140\Cartridges\as80.xsl 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.YourPhone_0.19051.7.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\AppTiles\contrast-black\SplashScreen.scale-125_contrast-black.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\xaml\onenote\ShareErrorMessagePage.xaml 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsCamera_2018.826.98.0_x64__8wekyb3d8bbwe\Assets\WindowsIcons\WindowsCameraAppList.contrast-black_targetsize-40.png 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\js\nls\nl-nl\ui-strings.js 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\vi\LC_MESSAGES\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_2019.19071.19011.0_neutral_~_8wekyb3d8bbwe\AppxMetadata\RyukReadMe.html 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 18 IoCs
pid Process 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3760 DBMQnoX.exe 3760 DBMQnoX.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3760 DBMQnoX.exe 3760 DBMQnoX.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 3760 DBMQnoX.exe 3760 DBMQnoX.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeBackupPrivilege 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe Token: SeBackupPrivilege 3760 DBMQnoX.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 3488 wrote to memory of 3760 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 61 PID 3488 wrote to memory of 3760 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 61 PID 3488 wrote to memory of 3760 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 61 PID 3488 wrote to memory of 2624 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 62 PID 3488 wrote to memory of 2624 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 62 PID 3488 wrote to memory of 2624 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 62 PID 2624 wrote to memory of 1192 2624 net.exe 64 PID 2624 wrote to memory of 1192 2624 net.exe 64 PID 2624 wrote to memory of 1192 2624 net.exe 64 PID 3488 wrote to memory of 1992 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 65 PID 3488 wrote to memory of 1992 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 65 PID 3488 wrote to memory of 1992 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 65 PID 1992 wrote to memory of 1924 1992 net.exe 67 PID 1992 wrote to memory of 1924 1992 net.exe 67 PID 1992 wrote to memory of 1924 1992 net.exe 67 PID 3488 wrote to memory of 3552 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 72 PID 3488 wrote to memory of 3552 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 72 PID 3488 wrote to memory of 3552 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 72 PID 3552 wrote to memory of 4188 3552 net.exe 74 PID 3552 wrote to memory of 4188 3552 net.exe 74 PID 3552 wrote to memory of 4188 3552 net.exe 74 PID 3760 wrote to memory of 5168 3760 DBMQnoX.exe 75 PID 3760 wrote to memory of 5168 3760 DBMQnoX.exe 75 PID 3760 wrote to memory of 5168 3760 DBMQnoX.exe 75 PID 5168 wrote to memory of 5640 5168 net.exe 77 PID 5168 wrote to memory of 5640 5168 net.exe 77 PID 5168 wrote to memory of 5640 5168 net.exe 77 PID 3488 wrote to memory of 72252 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 81 PID 3488 wrote to memory of 72252 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 81 PID 3488 wrote to memory of 72252 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 81 PID 72252 wrote to memory of 72552 72252 net.exe 83 PID 72252 wrote to memory of 72552 72252 net.exe 83 PID 72252 wrote to memory of 72552 72252 net.exe 83 PID 3488 wrote to memory of 77072 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 85 PID 3488 wrote to memory of 77072 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 85 PID 3488 wrote to memory of 77072 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 85 PID 77072 wrote to memory of 77584 77072 net.exe 86 PID 77072 wrote to memory of 77584 77072 net.exe 86 PID 77072 wrote to memory of 77584 77072 net.exe 86 PID 3760 wrote to memory of 85600 3760 DBMQnoX.exe 87 PID 3760 wrote to memory of 85600 3760 DBMQnoX.exe 87 PID 3760 wrote to memory of 85600 3760 DBMQnoX.exe 87 PID 85600 wrote to memory of 85928 85600 net.exe 89 PID 85600 wrote to memory of 85928 85600 net.exe 89 PID 85600 wrote to memory of 85928 85600 net.exe 89 PID 3488 wrote to memory of 139728 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 90 PID 3488 wrote to memory of 139728 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 90 PID 3488 wrote to memory of 139728 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 90 PID 139728 wrote to memory of 139792 139728 net.exe 92 PID 139728 wrote to memory of 139792 139728 net.exe 92 PID 139728 wrote to memory of 139792 139728 net.exe 92 PID 3488 wrote to memory of 142584 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 93 PID 3488 wrote to memory of 142584 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 93 PID 3488 wrote to memory of 142584 3488 683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe 93 PID 142584 wrote to memory of 142652 142584 net.exe 95 PID 142584 wrote to memory of 142652 142584 net.exe 95 PID 142584 wrote to memory of 142652 142584 net.exe 95 PID 3760 wrote to memory of 145896 3760 DBMQnoX.exe 96 PID 3760 wrote to memory of 145896 3760 DBMQnoX.exe 96 PID 3760 wrote to memory of 145896 3760 DBMQnoX.exe 96 PID 145896 wrote to memory of 146384 145896 net.exe 98 PID 145896 wrote to memory of 146384 145896 net.exe 98 PID 145896 wrote to memory of 146384 145896 net.exe 98
Processes
-
C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe"C:\Users\Admin\AppData\Local\Temp\683c3cdeda665afca5af0d964d280f27b3fbb77185b0a24584e139c33c5edddb.exe"1⤵
- Checks computer location settings
- Drops startup file
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3488 -
C:\Users\Admin\AppData\Local\Temp\DBMQnoX.exe"C:\Users\Admin\AppData\Local\Temp\DBMQnoX.exe" 8 LAN2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3760 -
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:5168 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:5640
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:85600 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:85928
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
PID:145896 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵PID:146384
-
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y2⤵
- Suspicious use of WriteProcessMemory
PID:2624 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y3⤵PID:1192
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:1924
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:3552 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:4188
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:72252 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:72552
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:77072 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:77584
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:139728 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:139792
-
-
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y2⤵
- Suspicious use of WriteProcessMemory
PID:142584 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y3⤵PID:142652
-
-