Analysis
-
max time kernel
149s -
max time network
158s -
platform
windows10_x64 -
resource
win10v191014 -
submitted
13-02-2020 15:34
Static task
static1
Behavioral task
behavioral1
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win7v191014
Behavioral task
behavioral2
Sample
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Resource
win10v191014
General
-
Target
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Drops startup file 6 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exedescription ioc process File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE580.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE580.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDE580.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File created (read-only) C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE5A7.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE5A7.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File deleted C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDE5A7.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Executes dropped EXE 14 IoCs
Processes:
taskdl.exetaskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exepid process 3712 taskdl.exe 4308 taskdl.exe 4140 @WanaDecryptor@.exe 4168 @WanaDecryptor@.exe 2752 taskhsvc.exe 1468 taskse.exe 1596 @WanaDecryptor@.exe 2088 taskdl.exe 1284 taskse.exe 5048 @WanaDecryptor@.exe 5020 taskdl.exe 4144 taskse.exe 4168 @WanaDecryptor@.exe 3956 taskdl.exe -
Suspicious use of AdjustPrivilegeToken 51 IoCs
Processes:
vssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exedescription pid process Token: SeBackupPrivilege 536 vssvc.exe Token: SeRestorePrivilege 536 vssvc.exe Token: SeAuditPrivilege 536 vssvc.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe Token: SeSystemProfilePrivilege 828 WMIC.exe Token: SeSystemtimePrivilege 828 WMIC.exe Token: SeProfSingleProcessPrivilege 828 WMIC.exe Token: SeIncBasePriorityPrivilege 828 WMIC.exe Token: SeCreatePagefilePrivilege 828 WMIC.exe Token: SeBackupPrivilege 828 WMIC.exe Token: SeRestorePrivilege 828 WMIC.exe Token: SeShutdownPrivilege 828 WMIC.exe Token: SeDebugPrivilege 828 WMIC.exe Token: SeSystemEnvironmentPrivilege 828 WMIC.exe Token: SeRemoteShutdownPrivilege 828 WMIC.exe Token: SeUndockPrivilege 828 WMIC.exe Token: SeManageVolumePrivilege 828 WMIC.exe Token: 33 828 WMIC.exe Token: 34 828 WMIC.exe Token: 35 828 WMIC.exe Token: 36 828 WMIC.exe Token: SeIncreaseQuotaPrivilege 828 WMIC.exe Token: SeSecurityPrivilege 828 WMIC.exe Token: SeTakeOwnershipPrivilege 828 WMIC.exe Token: SeLoadDriverPrivilege 828 WMIC.exe Token: SeSystemProfilePrivilege 828 WMIC.exe Token: SeSystemtimePrivilege 828 WMIC.exe Token: SeProfSingleProcessPrivilege 828 WMIC.exe Token: SeIncBasePriorityPrivilege 828 WMIC.exe Token: SeCreatePagefilePrivilege 828 WMIC.exe Token: SeBackupPrivilege 828 WMIC.exe Token: SeRestorePrivilege 828 WMIC.exe Token: SeShutdownPrivilege 828 WMIC.exe Token: SeDebugPrivilege 828 WMIC.exe Token: SeSystemEnvironmentPrivilege 828 WMIC.exe Token: SeRemoteShutdownPrivilege 828 WMIC.exe Token: SeUndockPrivilege 828 WMIC.exe Token: SeManageVolumePrivilege 828 WMIC.exe Token: 33 828 WMIC.exe Token: 34 828 WMIC.exe Token: 35 828 WMIC.exe Token: 36 828 WMIC.exe Token: SeTcbPrivilege 1468 taskse.exe Token: SeTcbPrivilege 1468 taskse.exe Token: SeTcbPrivilege 1284 taskse.exe Token: SeTcbPrivilege 1284 taskse.exe Token: SeTcbPrivilege 4144 taskse.exe Token: SeTcbPrivilege 4144 taskse.exe -
Wannacry
WannaCry is a ransomware cryptoworm.
-
Views/modifies file attributes 1 TTPs 1 IoCs
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious use of WriteProcessMemory 72 IoCs
Processes:
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.execmd.execmd.exe@WanaDecryptor@.exe@WanaDecryptor@.execmd.execmd.exedescription pid process target process PID 4960 wrote to memory of 4988 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 4960 wrote to memory of 4988 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 4960 wrote to memory of 4988 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe attrib.exe PID 4960 wrote to memory of 4996 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 4960 wrote to memory of 4996 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 4960 wrote to memory of 4996 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe icacls.exe PID 4960 wrote to memory of 3712 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 3712 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 3712 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 3828 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 3828 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 3828 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 3828 wrote to memory of 4556 3828 cmd.exe cscript.exe PID 3828 wrote to memory of 4556 3828 cmd.exe cscript.exe PID 3828 wrote to memory of 4556 3828 cmd.exe cscript.exe PID 4960 wrote to memory of 4308 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 4308 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 4308 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 4140 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 4140 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 4140 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 4272 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 4272 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 4272 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4272 wrote to memory of 4168 4272 cmd.exe @WanaDecryptor@.exe PID 4272 wrote to memory of 4168 4272 cmd.exe @WanaDecryptor@.exe PID 4272 wrote to memory of 4168 4272 cmd.exe @WanaDecryptor@.exe PID 4140 wrote to memory of 2752 4140 @WanaDecryptor@.exe taskhsvc.exe PID 4140 wrote to memory of 2752 4140 @WanaDecryptor@.exe taskhsvc.exe PID 4140 wrote to memory of 2752 4140 @WanaDecryptor@.exe taskhsvc.exe PID 4168 wrote to memory of 4692 4168 @WanaDecryptor@.exe cmd.exe PID 4168 wrote to memory of 4692 4168 @WanaDecryptor@.exe cmd.exe PID 4168 wrote to memory of 4692 4168 @WanaDecryptor@.exe cmd.exe PID 4692 wrote to memory of 4184 4692 cmd.exe vssadmin.exe PID 4692 wrote to memory of 4184 4692 cmd.exe vssadmin.exe PID 4692 wrote to memory of 4184 4692 cmd.exe vssadmin.exe PID 4692 wrote to memory of 828 4692 cmd.exe WMIC.exe PID 4692 wrote to memory of 828 4692 cmd.exe WMIC.exe PID 4692 wrote to memory of 828 4692 cmd.exe WMIC.exe PID 4960 wrote to memory of 1468 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 1468 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 1468 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 1596 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 1596 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 1596 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 1624 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 1624 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 4960 wrote to memory of 1624 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe cmd.exe PID 1624 wrote to memory of 1820 1624 cmd.exe reg.exe PID 1624 wrote to memory of 1820 1624 cmd.exe reg.exe PID 1624 wrote to memory of 1820 1624 cmd.exe reg.exe PID 4960 wrote to memory of 2088 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 2088 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 2088 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 1284 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 1284 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 1284 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe PID 4960 wrote to memory of 5048 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 5048 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 5048 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe @WanaDecryptor@.exe PID 4960 wrote to memory of 5020 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 5020 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 5020 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskdl.exe PID 4960 wrote to memory of 4144 4960 ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe taskse.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exepid process 4168 @WanaDecryptor@.exe 4140 @WanaDecryptor@.exe 4140 @WanaDecryptor@.exe 4168 @WanaDecryptor@.exe 1596 @WanaDecryptor@.exe 1596 @WanaDecryptor@.exe 5048 @WanaDecryptor@.exe 4168 @WanaDecryptor@.exe -
Loads dropped DLL 7 IoCs
Processes:
taskhsvc.exepid process 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\nmsqcsinudawe237 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
taskhsvc.exepid process 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe 2752 taskhsvc.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
@WanaDecryptor@.exeed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" @WanaDecryptor@.exe Set value (str) \REGISTRY\USER\S-1-5-21-634046074-2673730973-2644684987-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 4184 vssadmin.exe -
Modifies service 2 TTPs 4 IoCs
Processes:
vssvc.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer vssvc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer vssvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 13721581611714.bat2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe co2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @WanaDecryptor@.exe vs2⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe vs3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "nmsqcsinudawe237" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Modifies registry key
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\0.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\00000000.res
-
C:\Users\Admin\AppData\Local\Temp\1.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\10.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\11.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\12.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\13.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\13721581611714.bat
-
C:\Users\Admin\AppData\Local\Temp\14.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\15.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\16.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\17.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\18.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\19.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\2.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\20.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\21.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\22.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\23.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\24.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\25.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\26.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\27.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\28.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\3.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\4.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\5.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\6.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\7.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\8.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\9.WNCRYT
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
-
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe.lnk
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\SSLEAY32.dll
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
-
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
-
C:\Users\Admin\AppData\Local\Temp\b.wnry
-
C:\Users\Admin\AppData\Local\Temp\c.wnry
-
C:\Users\Admin\AppData\Local\Temp\c.wnry
-
C:\Users\Admin\AppData\Local\Temp\m.vbs
-
C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry
-
C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry
-
C:\Users\Admin\AppData\Local\Temp\r.wnry
-
C:\Users\Admin\AppData\Local\Temp\s.wnry
-
C:\Users\Admin\AppData\Local\Temp\t.wnry
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exe
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
C:\Users\Admin\AppData\Local\Temp\taskse.exe
-
C:\Users\Admin\AppData\Local\Temp\u.wnry
-
C:\Users\Admin\Desktop\@WanaDecryptor@.bmp
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\ssleay32.dll
-
\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll
-
memory/2752-278-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-261-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-62-0x0000000003D20000-0x0000000003D21000-memory.dmpFilesize
4KB
-
memory/2752-63-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-68-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-144-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-145-0x0000000003D20000-0x0000000003D21000-memory.dmpFilesize
4KB
-
memory/2752-388-0x0000000003A60000-0x0000000003A61000-memory.dmpFilesize
4KB
-
memory/2752-146-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-190-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-61-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-270-0x0000000003520000-0x0000000003521000-memory.dmpFilesize
4KB
-
memory/2752-308-0x0000000003A60000-0x0000000003A61000-memory.dmpFilesize
4KB
-
memory/2752-309-0x0000000004260000-0x0000000004261000-memory.dmpFilesize
4KB
-
memory/2752-310-0x0000000003A60000-0x0000000003A61000-memory.dmpFilesize
4KB
-
memory/4960-36-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB