Analysis
-
max time kernel
163s -
max time network
146s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
06-03-2022 06:51
Static task
static1
Behavioral task
behavioral1
Sample
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe
Resource
win10v2004-en-20220113
General
-
Target
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe
-
Size
808KB
-
MD5
50cc057a164640715e70a43979175a3f
-
SHA1
690d83a764b7f4b65232e25c410c02cc5901ad72
-
SHA256
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
-
SHA512
ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
unumschooler1972@protonmail.com
Extracted
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.html
ryuk
unumschooler1972@protonmail.com
Signatures
-
Ryuk
Ransomware distributed via existing botnets, often Trickbot or Emotet.
-
Executes dropped EXE 2 IoCs
Processes:
WZcPXBA.exeWZcPXBA.exepid process 1408 WZcPXBA.exe 1400 WZcPXBA.exe -
Loads dropped DLL 3 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exepid process 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1408 WZcPXBA.exe -
Enumerates connected drives 3 TTPs 2 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exedescription ioc process File opened (read-only) \??\a: aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened (read-only) \??\A: aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exedescription pid process target process PID 1772 set thread context of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 1408 set thread context of 1400 1408 WZcPXBA.exe WZcPXBA.exe -
Drops file in Program Files directory 64 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exedescription ioc process File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\9.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0151061.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0182946.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\JAVA_01.MID aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO02228_.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PAGESIZE\PGLBL086.XML aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\AIR98.POC aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XML2WORD.XSL aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\46.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\7-Zip\Lang\nl.txt aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21321_.GIF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\bg_GreenTea.gif aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\7-Zip\Lang\cs.txt aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0309480.JPG aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms3\DELETE.GIF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\FlipPage\203x8subpicture.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0105244.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SO00917_.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\7-Zip\Lang\pl.txt aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\ia\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Weather.Gadget\images\8.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0382963.JPG aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PARNT_01.MID aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\BIZCARD.DPV aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.help_2.0.102.v20141007-2301\META-INF\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Currency.Gadget\images\combo-hover-right.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0153398.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Weather.Gadget\images\23.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\MSBuild\Microsoft\Windows Workflow Foundation\v3.5\Workflow.Targets aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0195260.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGTOC.XML aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Push\push_title.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\fur\LC_MESSAGES\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\zu\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107750.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\Sounds\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\AMT\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\RIPPLE\RIPPLE.ELM aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\XLCPRTID.XML aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\PicturePuzzle.Gadget\en-US\css\settings.css aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\ICE\THMBNAIL.PNG aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\fsdefinitions\oskmenu.xml aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0145373.JPG aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0212601.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\NA02390_.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\PH02062U.BMP aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGBARBLL.DPV aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\p2\org.eclipse.equinox.p2.engine\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\gd\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Windows Sidebar\Gadgets\Clock.Gadget\images\modern_m.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\INDUST\THMBNAIL.PNG aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Effects\Couture.eftx aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\ADDINS\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Performance\Title_Trans_Scene_PAL.wmv aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\ResizingPanels\1047x576black.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\bin\plugin2\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SY01006_.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Windows Sidebar\Gadgets\Clock.Gadget\images\cronometer_settings.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Microsoft Games\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Travel\btn-previous-static.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\America\North_Dakota\RyukReadMe.html aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\SL00452_.WMF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\J0115856.GIF aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\HueCycle\NavigationLeft_SelectionSubpicture.png aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 39 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exepid process 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1400 WZcPXBA.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 1400 WZcPXBA.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1400 WZcPXBA.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exepid process 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1408 WZcPXBA.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exedescription pid process Token: SeBackupPrivilege 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe Token: SeBackupPrivilege 1400 WZcPXBA.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exepid process 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe 1408 WZcPXBA.exe 1408 WZcPXBA.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeaced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exeWZcPXBA.exenet.exenet.exenet.exenet.exeWZcPXBA.exenet.exenet.exedescription pid process target process PID 1772 wrote to memory of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 1772 wrote to memory of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 1772 wrote to memory of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 1772 wrote to memory of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 1772 wrote to memory of 304 1772 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe PID 304 wrote to memory of 1408 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe WZcPXBA.exe PID 304 wrote to memory of 1408 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe WZcPXBA.exe PID 304 wrote to memory of 1408 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe WZcPXBA.exe PID 304 wrote to memory of 1408 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe WZcPXBA.exe PID 1408 wrote to memory of 1400 1408 WZcPXBA.exe WZcPXBA.exe PID 1408 wrote to memory of 1400 1408 WZcPXBA.exe WZcPXBA.exe PID 1408 wrote to memory of 1400 1408 WZcPXBA.exe WZcPXBA.exe PID 1408 wrote to memory of 1400 1408 WZcPXBA.exe WZcPXBA.exe PID 1408 wrote to memory of 1400 1408 WZcPXBA.exe WZcPXBA.exe PID 304 wrote to memory of 1440 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1440 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1440 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1440 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 364 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 364 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 364 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 364 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 1440 wrote to memory of 1684 1440 net.exe net1.exe PID 1440 wrote to memory of 1684 1440 net.exe net1.exe PID 1440 wrote to memory of 1684 1440 net.exe net1.exe PID 1440 wrote to memory of 1684 1440 net.exe net1.exe PID 364 wrote to memory of 1696 364 net.exe net1.exe PID 364 wrote to memory of 1696 364 net.exe net1.exe PID 364 wrote to memory of 1696 364 net.exe net1.exe PID 364 wrote to memory of 1696 364 net.exe net1.exe PID 304 wrote to memory of 1088 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1088 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1088 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1088 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 1088 wrote to memory of 1812 1088 net.exe net1.exe PID 1088 wrote to memory of 1812 1088 net.exe net1.exe PID 1088 wrote to memory of 1812 1088 net.exe net1.exe PID 1088 wrote to memory of 1812 1088 net.exe net1.exe PID 304 wrote to memory of 1836 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1836 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1836 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 1836 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 1836 wrote to memory of 1392 1836 net.exe net1.exe PID 1836 wrote to memory of 1392 1836 net.exe net1.exe PID 1836 wrote to memory of 1392 1836 net.exe net1.exe PID 1836 wrote to memory of 1392 1836 net.exe net1.exe PID 1400 wrote to memory of 2220 1400 WZcPXBA.exe net.exe PID 1400 wrote to memory of 2220 1400 WZcPXBA.exe net.exe PID 1400 wrote to memory of 2220 1400 WZcPXBA.exe net.exe PID 1400 wrote to memory of 2220 1400 WZcPXBA.exe net.exe PID 2220 wrote to memory of 2252 2220 net.exe net1.exe PID 2220 wrote to memory of 2252 2220 net.exe net1.exe PID 2220 wrote to memory of 2252 2220 net.exe net1.exe PID 2220 wrote to memory of 2252 2220 net.exe net1.exe PID 304 wrote to memory of 22508 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 22508 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 22508 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 22508 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 22508 wrote to memory of 22456 22508 net.exe net1.exe PID 22508 wrote to memory of 22456 22508 net.exe net1.exe PID 22508 wrote to memory of 22456 22508 net.exe net1.exe PID 22508 wrote to memory of 22456 22508 net.exe net1.exe PID 304 wrote to memory of 28496 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe PID 304 wrote to memory of 28496 304 aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe net.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe"C:\Users\Admin\AppData\Local\Temp\aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe"C:\Users\Admin\AppData\Local\Temp\aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5.exe"2⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exe"C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exe" 8 LAN3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exe"C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exe" 8 LAN4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y6⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y5⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y6⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "audioendpointbuilder" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "audioendpointbuilder" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
-
C:\Windows\SysWOW64\net.exe"C:\Windows\System32\net.exe" stop "samss" /y3⤵
-
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop "samss" /y4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\08e575673cce10c72090304839888e02_3bd845b8-ce6a-4337-9974-31490196462aMD5
93a5aadeec082ffc1bca5aa27af70f52
SHA147a92aee3ea4d1c1954ed4da9f86dd79d9277d31
SHA256a1a21799e98f97f271657ce656076f33dcb020d9370f1f2671d783cafd230294
SHA512df388c8d83e779e006d6311b2046fcf9259ec33d379fc0e2c6a4b6b90418f587a12c5c23acd488413a02568ca2d3effe04608ec7c791925c7ed53dc71093ca45
-
C:\Users\Admin\AppData\Local\Temp\RyukReadMe.htmlMD5
3b40f517a25611205b0ba7af8ae225f1
SHA1aa7e89f3d1202b37ff89d629ebe10dae8c4e14db
SHA256385752904c61abf42b315b172c40b4a50d50cc58c94077cff0815c834e1ac013
SHA5128d17239868ef33175214e14fc5ad245c9d5505deaf8747c079e6e05bca1c77e62bbacc5af8519dccae63b8d4e959ed32d3748d62de1aa3f7b256c35524af9f52
-
C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
C:\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
\Users\Admin\AppData\Local\Temp\WZcPXBA.exeMD5
50cc057a164640715e70a43979175a3f
SHA1690d83a764b7f4b65232e25c410c02cc5901ad72
SHA256aced9fc0fe2737e1b1354b27462b7013126a573bf13b7b73fcb9b35a637831b5
SHA512ea527edb150fd8e582e13597053a0e84604f45265181aa410608161a6e0e8aa0988e9c84735cdda01cdf6bab362a60ef490c233e1c947a15ee7b61cd48d60aa2
-
memory/304-58-0x0000000030000000-0x0000000030170000-memory.dmpFilesize
1.4MB
-
memory/1400-67-0x0000000030000000-0x0000000030170000-memory.dmpFilesize
1.4MB
-
memory/1772-55-0x00000000762C1000-0x00000000762C3000-memory.dmpFilesize
8KB
-
memory/1772-56-0x0000000000270000-0x00000000002A3000-memory.dmpFilesize
204KB