General
Target
Filesize
Completed
Task
23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
384KB
05-04-2022 12:20
behavioral1
Score
10/10
MD5
SHA1
SHA256
SHA256
5ac0f050f93f86e69026faea1fbb4450
9709774fde9ec740ad6fed8ed79903296ca9d571
23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2
b554487c4e26a85ec5179cdcc1d25b5bc494e8821a8899fbbf868c3cf41f70cc72db107613b3f6655d3ab70f4db94cce2589066bb354b1ed955098d3911b844d
Malware Config
Extracted
| Path | C:\RyukReadMe.txt |
| Family | ryuk |
| Ransom Note |
Your network has been penetrated.
All files on each host in the network have been encrypted with a strong algorithm.
Backups were either encrypted or deleted or backup disks were formatted.
Shadow copies also removed, so F8 or any other methods may damage encrypted data but not recover.
We exclusively have decryption software for your situation
No decryption software is available in the public.
DO NOT RESET OR SHUTDOWN - files may be damaged.
DO NOT RENAME OR MOVE the encrypted and readme files.
DO NOT DELETE readme files.
This may lead to the impossibility of recovery of the certain files.
To get info (decrypt your files) contact us at
WayneEvenson@protonmail.com
or
WayneEvenson@tutanota.com
BTC wallet:
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk
Ryuk
No system is safe
|
| Emails |
WayneEvenson@protonmail.com WayneEvenson@tutanota.com |
| Wallets |
14hVKm7Ft2rxDBFTNkkRC3kGstMGp2A4hk |
Signatures 18
Filter: none
Collection
Credential Access
Defense Evasion
Discovery
Impact
Persistence
-
Ryuk
Description
Ransomware distributed via existing botnets, often Trickbot or Emotet.
Tags
-
Deletes shadow copies
Description
Ransomware often targets backup files to inhibit system recovery.
Tags
TTPs
-
Executes dropped EXEsmrHY.exe
Reported IOCs
pid process 1908 smrHY.exe -
Modifies extensions of user filessmrHY.exe
Description
Ransomware generally changes the extension on encrypted files.
Tags
Reported IOCs
description ioc process File opened for modification C:\Users\Admin\Pictures\CopyConnect.tiff smrHY.exe -
Deletes itselfsmrHY.exe
Reported IOCs
pid process 1908 smrHY.exe -
Loads dropped DLL23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe
Reported IOCs
pid process 1076 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Adds Run key to start applicationreg.exe
Tags
TTPs
Reported IOCs
description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchos = "C:\\users\\Public\\smrHY.exe" reg.exe Key created \REGISTRY\USER\S-1-5-21-594401021-1341801952-2355885667-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run reg.exe -
Enumerates connected drivesvssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe
Description
Attempts to read the root path of hard drives other than the default C: drive.
TTPs
Reported IOCs
description ioc process File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\H: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe File opened (read-only) \??\D: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\g: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\f: vssadmin.exe File opened (read-only) \??\F: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\e: vssadmin.exe File opened (read-only) \??\E: vssadmin.exe File opened (read-only) \??\G: vssadmin.exe File opened (read-only) \??\h: vssadmin.exe -
Drops file in Program Files directorysmrHY.exe
Reported IOCs
description ioc process File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\update_tracking\com-sun-tools-visualvm-application.xml smrHY.exe File opened for modification C:\Program Files\VideoLAN\VLC\locale\be\LC_MESSAGES\vlc.mo smrHY.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\THEMES14\SATIN\PREVIEW.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\LightSpirit.css smrHY.exe File opened for modification C:\Program Files (x86)\Reference Assemblies\Microsoft\Framework\v3.5\RedistList\FrameworkList.xml smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.frameworkadmin.equinox.nl_zh_4.4.0.v20140623020002.jar smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.ui.themes_1.0.1.v20140819-1717\css\dark\e4-dark_globalstyle.css smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\org-netbeans-modules-masterfs-nio2.jar smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\locale\com-sun-tools-visualvm-profiler_zh_CN.jar smrHY.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\CMap\Identity-H smrHY.exe File opened for modification C:\Program Files (x86)\Common Files\microsoft shared\MSInfo\de-DE\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\zi\America\Monterrey smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR17F.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBBA\MSPUB8.BDR smrHY.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Europe\Vienna smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Theme Fonts\Office 2.xml smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\SpringGreen\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Document Themes 14\Paper.thmx smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\MSOUC.HXS smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR2F.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\rtf_alignright.gif smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\features\org.eclipse.emf.ecore_2.10.1.v20140901-1043\META-INF\ECLIPSE_.SF smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\org.eclipse.equinox.p2.updatechecker_1.1.200.v20131119-0908.jar smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\ext\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\TN00011_.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGAD.DPV smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\missioncontrol\plugins\com.jrockit.mc.rjmx_5.5.0.165303\schema\com.jrockit.mc.rjmx.attributeTransformation.exsd smrHY.exe File opened for modification C:\Program Files\Java\jre7\lib\classlist smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\FD01660_.WMF smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-lib-uihandler_zh_CN.jar smrHY.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0107134.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms4\FormsStyles\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGACCBAR.XML smrHY.exe File opened for modification C:\Program Files\Microsoft Games\Solitaire\es-ES\RyukReadMe.txt smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0200611.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\PUBSPAPR\PDIR7B.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0152626.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\EXCEL.DEV_COL.HXC smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\FORMS\1033\INFOMAIL.CFG smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\Groove\ToolData\groove.net\GrooveForms\VIEW.ICO smrHY.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Hovd smrHY.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Resource\Font\SY______.PFB smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\HH00524_.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GROOVE_K_COL.HXK smrHY.exe File opened for modification C:\Program Files\Java\jre7\lib\zi\Asia\Urumqi smrHY.exe File opened for modification C:\Program Files (x86)\Adobe\Reader 9.0\Reader\plug_ins\Multimedia\MPP\Real.mpp smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\BULLETS\BD14514_.GIF smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\jre\lib\fontconfig.properties.src smrHY.exe File opened for modification C:\Program Files (x86)\Common Files\SpeechEngines\Microsoft\TTS20\en-US\enu-dsk\M1033DSK.UNT smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\WB01293_.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21313_.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\PUBWIZ\DGATNGET.XML smrHY.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Heart_ButtonGraphic.png smrHY.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Memories\button-overlay.png smrHY.exe File opened for modification C:\Program Files\DVD Maker\Shared\DvdStyles\Stacking\NavigationUp_ButtonGraphic.png smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\CLIPART\PUB60COR\J0318448.WMF smrHY.exe File opened for modification C:\Program Files\Common Files\Microsoft Shared\ink\hwrdeush.dat smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\platform\modules\locale\org-netbeans-modules-progress-ui_ja.jar smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\config\Modules\com-sun-tools-visualvm-jmx.xml smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\CAGCAT10\J0199661.WMF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\MEDIA\OFFICE14\LINES\BD21390_.GIF smrHY.exe File opened for modification C:\Program Files (x86)\Microsoft Office\Office14\1033\GrooveForms5\FormsStyles\Swirl\background.gif smrHY.exe File opened for modification C:\Program Files\Java\jdk1.7.0_80\lib\visualvm\visualvm\modules\com-sun-tools-visualvm-application-views.jar smrHY.exe -
Enumerates physical storage devices
Description
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
TTPs
-
Program crashWerFault.exeWerFault.exe
Reported IOCs
pid pid_target process target process 1768 1140 WerFault.exe taskhost.exe 1236 1200 WerFault.exe Dwm.exe -
Interacts with shadow copiesvssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exevssadmin.exe
Description
Shadow copies are often targeted by ransomware to inhibit system recovery.
Tags
TTPs
Reported IOCs
pid process 71512 vssadmin.exe 71580 vssadmin.exe 71048 vssadmin.exe 71180 vssadmin.exe 71448 vssadmin.exe 71416 vssadmin.exe 71480 vssadmin.exe 71644 vssadmin.exe 71012 vssadmin.exe 71544 vssadmin.exe 71612 vssadmin.exe 1716 vssadmin.exe 71384 vssadmin.exe 71676 vssadmin.exe -
Opens file in notepad (likely ransom note)NOTEPAD.EXE
Tags
Reported IOCs
pid process 71172 NOTEPAD.EXE -
Suspicious behavior: EnumeratesProcessessmrHY.exe
Reported IOCs
pid process 1908 smrHY.exe -
Suspicious use of AdjustPrivilegeTokensmrHY.exeAUDIODG.EXEvssvc.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 1908 smrHY.exe Token: 33 29660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 29660 AUDIODG.EXE Token: 33 29660 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 29660 AUDIODG.EXE Token: SeBackupPrivilege 71208 vssvc.exe Token: SeRestorePrivilege 71208 vssvc.exe Token: SeAuditPrivilege 71208 vssvc.exe -
Suspicious use of FindShellTrayWindowNOTEPAD.EXE
Reported IOCs
pid process 71172 NOTEPAD.EXE -
Suspicious use of WriteProcessMemory23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exesmrHY.exetaskhost.execmd.exeDwm.execmd.exe
Reported IOCs
description pid process target process PID 1076 wrote to memory of 1908 1076 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe smrHY.exe PID 1076 wrote to memory of 1908 1076 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe smrHY.exe PID 1076 wrote to memory of 1908 1076 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe smrHY.exe PID 1076 wrote to memory of 1908 1076 23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe smrHY.exe PID 1908 wrote to memory of 964 1908 smrHY.exe cmd.exe PID 1908 wrote to memory of 964 1908 smrHY.exe cmd.exe PID 1908 wrote to memory of 964 1908 smrHY.exe cmd.exe PID 1908 wrote to memory of 1140 1908 smrHY.exe taskhost.exe PID 1140 wrote to memory of 1768 1140 taskhost.exe WerFault.exe PID 1140 wrote to memory of 1768 1140 taskhost.exe WerFault.exe PID 1140 wrote to memory of 1768 1140 taskhost.exe WerFault.exe PID 964 wrote to memory of 852 964 cmd.exe reg.exe PID 964 wrote to memory of 852 964 cmd.exe reg.exe PID 964 wrote to memory of 852 964 cmd.exe reg.exe PID 1908 wrote to memory of 1200 1908 smrHY.exe Dwm.exe PID 1200 wrote to memory of 1236 1200 Dwm.exe WerFault.exe PID 1200 wrote to memory of 1236 1200 Dwm.exe WerFault.exe PID 1200 wrote to memory of 1236 1200 Dwm.exe WerFault.exe PID 1908 wrote to memory of 71136 1908 smrHY.exe cmd.exe PID 1908 wrote to memory of 71136 1908 smrHY.exe cmd.exe PID 1908 wrote to memory of 71136 1908 smrHY.exe cmd.exe PID 71136 wrote to memory of 71180 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71180 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71180 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71384 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71384 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71384 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71416 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71416 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71416 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71448 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71448 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71448 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71480 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71480 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71480 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71512 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71512 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71512 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71544 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71544 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71544 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71580 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71580 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71580 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71612 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71612 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71612 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71644 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71644 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71644 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71676 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71676 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71676 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71012 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71012 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71012 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71048 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71048 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 71048 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 1716 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 1716 71136 cmd.exe vssadmin.exe PID 71136 wrote to memory of 1716 71136 cmd.exe vssadmin.exe
Processes 28
-
C:\Windows\system32\taskhost.exePID:1140"taskhost.exe"Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exePID:1768C:\Windows\system32\WerFault.exe -u -p 1140 -s 232Program crash
-
C:\Windows\system32\Dwm.exePID:1200"C:\Windows\system32\Dwm.exe"Suspicious use of WriteProcessMemory
-
C:\Windows\system32\WerFault.exePID:1236C:\Windows\system32\WerFault.exe -u -p 1200 -s 312Program crash
-
C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exePID:1076"C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exe"Loads dropped DLLSuspicious use of WriteProcessMemory
-
C:\users\Public\smrHY.exePID:1908"C:\users\Public\smrHY.exe" C:\Users\Admin\AppData\Local\Temp\23f8aa94ffb3c08a62735fe7fee5799880a8f322ce1d55ec49a13a3f85312db2.exeExecutes dropped EXEModifies extensions of user filesDeletes itselfDrops file in Program Files directorySuspicious behavior: EnumeratesProcessesSuspicious use of AdjustPrivilegeTokenSuspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exePID:964"C:\Windows\System32\cmd.exe" /C REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\smrHY.exe" /fSuspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exePID:852REG ADD "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "svchos" /t REG_SZ /d "C:\users\Public\smrHY.exe" /fAdds Run key to start application
-
C:\Windows\System32\cmd.exePID:71136"C:\Windows\System32\cmd.exe" /C "C:\users\Public\window.bat"Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exePID:71180vssadmin Delete Shadows /all /quietInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71384vssadmin resize shadowstorage /for=c: /on=c: /maxsize=401MBInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71416vssadmin resize shadowstorage /for=c: /on=c: /maxsize=unboundedInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71448vssadmin resize shadowstorage /for=d: /on=d: /maxsize=401MBEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71480vssadmin resize shadowstorage /for=d: /on=d: /maxsize=unboundedEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71512vssadmin resize shadowstorage /for=e: /on=e: /maxsize=401MBEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71544vssadmin resize shadowstorage /for=e: /on=e: /maxsize=unboundedEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71580vssadmin resize shadowstorage /for=f: /on=f: /maxsize=401MBEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71612vssadmin resize shadowstorage /for=f: /on=f: /maxsize=unboundedEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71644vssadmin resize shadowstorage /for=g: /on=g: /maxsize=401MBEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71676vssadmin resize shadowstorage /for=g: /on=g: /maxsize=unboundedEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71012vssadmin resize shadowstorage /for=h: /on=h: /maxsize=401MBEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:71048vssadmin resize shadowstorage /for=h: /on=h: /maxsize=unboundedEnumerates connected drivesInteracts with shadow copies
-
C:\Windows\system32\vssadmin.exePID:1716vssadmin Delete Shadows /all /quietInteracts with shadow copies
-
C:\Windows\system32\Dwm.exePID:1776"C:\Windows\system32\Dwm.exe"
-
C:\Windows\explorer.exePID:15748"C:\Windows\explorer.exe"
-
C:\Windows\system32\AUDIODG.EXEPID:29660C:\Windows\system32\AUDIODG.EXE 0xc4Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exePID:71208C:\Windows\system32\vssvc.exeSuspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\NOTEPAD.EXEPID:71172"C:\Windows\system32\NOTEPAD.EXE" C:\RyukReadMe.txtOpens file in notepad (likely ransom note)Suspicious use of FindShellTrayWindow
Network
MITRE ATT&CK Matrix
Collection
Command and Control
Credential Access
Defense Evasion
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Replay Monitor
00:00
00:00
Downloads
-
C:\RyukReadMe.txt
MD5cd99cba6153cbc0b14b7a849e4d0180f
SHA1375961866404a705916cbc6cd4915de7d9778923
SHA25674c43a177917b1d57ea2eaf6212ccf3b9012b4d68bc45284349443eed0bf5ee2
SHA5120c9f250c0e2ec9736b072a9807b6c3bec4b670ab2f511e65cf5d79e9a8c9a209eb91736ce2765b52b6d94a57c6aa1c16bb08e16727660699b70608439c8b7cda
-
C:\Users\Public\smrHY.exe
MD531bd0f224e7e74eee2847f43aae23974
SHA192e331e1e8ad30538f38dd7ba31386afafa14a58
SHA2568b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d
SHA512a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249
-
C:\users\Public\window.bat
MD5d2aba3e1af80edd77e206cd43cfd3129
SHA13116da65d097708fad63a3b73d1c39bffa94cb01
SHA2568940135a58d28338ce4ea9b9933e6780507c56ab37a2f2e3a1a98c6564548a12
SHA5120059bd4cc02c52a219a0a2e1836bf04c11e2693446648dd4d92a2f38ed060ecd6c0f835e542ff8cfef8903873c01b8de2b38ed6ed2131a131bdd17887c11d0ec
-
\??\c:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\brndlog.bak
MD5c3784f5d42347b9e3e0411ae32267cf1
SHA1e3b1ab39bba4f18c09132a877362b0e6fae82920
SHA2562780e78a4c7ae016704bd088f21fb60decf3bf0115488cabfcaa920c43f225e2
SHA512e46e42fb05ce593a119025bd7e3341a68daf47f38b2e963b1c1ea8e7e3cb0db8ee6ca7628efcb10894682b761d3e3fd8a0583f5be116b4b0dea779822291a35c
-
\Users\Public\smrHY.exe
MD531bd0f224e7e74eee2847f43aae23974
SHA192e331e1e8ad30538f38dd7ba31386afafa14a58
SHA2568b0a5fb13309623c3518473551cb1f55d38d8450129d4a3c16b476f7b2867d7d
SHA512a13f05a12b084ef425f542ff4be824bbccb5dbdfe085af8b7e19d81a6bcba4b8c1debcc38f6b57bc9265a4db21eed70852ece8cc62b3ef14c47fca3035a55249
-
memory/852-63-0x0000000000000000-mapping.dmp
-
memory/964-59-0x0000000000000000-mapping.dmp
-
memory/1076-54-0x00000000755F1000-0x00000000755F3000-memory.dmp
-
memory/1140-60-0x000000013F1E0000-0x000000013F56E000-memory.dmp
-
memory/1236-66-0x0000000000000000-mapping.dmp
-
memory/1716-83-0x0000000000000000-mapping.dmp
-
memory/1768-62-0x0000000000000000-mapping.dmp
-
memory/1908-58-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp
-
memory/1908-56-0x0000000000000000-mapping.dmp
-
memory/71012-81-0x0000000000000000-mapping.dmp
-
memory/71048-82-0x0000000000000000-mapping.dmp
-
memory/71136-68-0x0000000000000000-mapping.dmp
-
memory/71180-70-0x0000000000000000-mapping.dmp
-
memory/71384-71-0x0000000000000000-mapping.dmp
-
memory/71416-72-0x0000000000000000-mapping.dmp
-
memory/71448-73-0x0000000000000000-mapping.dmp
-
memory/71480-74-0x0000000000000000-mapping.dmp
-
memory/71512-75-0x0000000000000000-mapping.dmp
-
memory/71544-76-0x0000000000000000-mapping.dmp
-
memory/71580-77-0x0000000000000000-mapping.dmp
-
memory/71612-78-0x0000000000000000-mapping.dmp
-
memory/71644-79-0x0000000000000000-mapping.dmp
-
memory/71676-80-0x0000000000000000-mapping.dmp
Title
Loading data