wannacry | 3dc6191c1255cfbaf94461e9a44f5b698c5563bbf846c94c4edd343828943a1e

Analysis

max time kernel
144s
max time network
133s
platform
windows10_x64
resource
win10
submitted
22-06-2020 15:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

289fb0815a35d88e4e716881561d8d83.exe
Size

3.5MB
MD5

289fb0815a35d88e4e716881561d8d83
SHA1

bfa1b4d8f331d0f226f45e55fba1ea1908c795b9
SHA256

3dc6191c1255cfbaf94461e9a44f5b698c5563bbf846c94c4edd343828943a1e
SHA512

2e3c5c808dc7fcec26352645f14c2542cf363a0ab964477e277668c18ae36505f1a1bdeea25aea4c5c2dbee26dd06b92d81abfefc1e1d70e81e18636f8f46601

Score

10^/10

ransomware persistence worm wannacry spyware discovery

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\@Please_Read_Me@.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@WanaDecryptor@.exe". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Suspicious use of AdjustPrivilegeToken 53 IoCs

Processes:

vssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeBackupPrivilege	1652	vssvc.exe
Token: SeRestorePrivilege	1652	vssvc.exe
Token: SeAuditPrivilege	1652	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1844	WMIC.exe
Token: SeSecurityPrivilege	1844	WMIC.exe
Token: SeTakeOwnershipPrivilege	1844	WMIC.exe
Token: SeLoadDriverPrivilege	1844	WMIC.exe
Token: SeSystemProfilePrivilege	1844	WMIC.exe
Token: SeSystemtimePrivilege	1844	WMIC.exe
Token: SeProfSingleProcessPrivilege	1844	WMIC.exe
Token: SeIncBasePriorityPrivilege	1844	WMIC.exe
Token: SeCreatePagefilePrivilege	1844	WMIC.exe
Token: SeBackupPrivilege	1844	WMIC.exe
Token: SeRestorePrivilege	1844	WMIC.exe
Token: SeShutdownPrivilege	1844	WMIC.exe
Token: SeDebugPrivilege	1844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1844	WMIC.exe
Token: SeRemoteShutdownPrivilege	1844	WMIC.exe
Token: SeUndockPrivilege	1844	WMIC.exe
Token: SeManageVolumePrivilege	1844	WMIC.exe
Token: 33	1844	WMIC.exe
Token: 34	1844	WMIC.exe
Token: 35	1844	WMIC.exe
Token: 36	1844	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1844	WMIC.exe
Token: SeSecurityPrivilege	1844	WMIC.exe
Token: SeTakeOwnershipPrivilege	1844	WMIC.exe
Token: SeLoadDriverPrivilege	1844	WMIC.exe
Token: SeSystemProfilePrivilege	1844	WMIC.exe
Token: SeSystemtimePrivilege	1844	WMIC.exe
Token: SeProfSingleProcessPrivilege	1844	WMIC.exe
Token: SeIncBasePriorityPrivilege	1844	WMIC.exe
Token: SeCreatePagefilePrivilege	1844	WMIC.exe
Token: SeBackupPrivilege	1844	WMIC.exe
Token: SeRestorePrivilege	1844	WMIC.exe
Token: SeShutdownPrivilege	1844	WMIC.exe
Token: SeDebugPrivilege	1844	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1844	WMIC.exe
Token: SeRemoteShutdownPrivilege	1844	WMIC.exe
Token: SeUndockPrivilege	1844	WMIC.exe
Token: SeManageVolumePrivilege	1844	WMIC.exe
Token: 33	1844	WMIC.exe
Token: 34	1844	WMIC.exe
Token: 35	1844	WMIC.exe
Token: 36	1844	WMIC.exe
Token: SeTcbPrivilege	4056	taskse.exe
Token: SeTcbPrivilege	4056	taskse.exe
Token: SeTcbPrivilege	1004	taskse.exe
Token: SeTcbPrivilege	1004	taskse.exe
Token: SeTcbPrivilege	3092	taskse.exe
Token: SeTcbPrivilege	3092	taskse.exe
Token: SeTcbPrivilege	3364	taskse.exe
Token: SeTcbPrivilege	3364	taskse.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware

Data from Local System
T1005

Credentials in Files
T1081
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

1444 vssadmin.exe

pid	process
1444	vssadmin.exe

Suspicious use of WriteProcessMemory 78 IoCs

Processes:

289fb0815a35d88e4e716881561d8d83.execmd.execmd.exe@WanaDecryptor@.exe@WanaDecryptor@.execmd.execmd.exe

description	pid	process	target process
PID 976 wrote to memory of 3884	976	289fb0815a35d88e4e716881561d8d83.exe	attrib.exe
PID 976 wrote to memory of 3884	976	289fb0815a35d88e4e716881561d8d83.exe	attrib.exe
PID 976 wrote to memory of 3884	976	289fb0815a35d88e4e716881561d8d83.exe	attrib.exe
PID 976 wrote to memory of 3448	976	289fb0815a35d88e4e716881561d8d83.exe	icacls.exe
PID 976 wrote to memory of 3448	976	289fb0815a35d88e4e716881561d8d83.exe	icacls.exe
PID 976 wrote to memory of 3448	976	289fb0815a35d88e4e716881561d8d83.exe	icacls.exe
PID 976 wrote to memory of 760	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 760	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 760	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 3128 wrote to memory of 4056	3128	cmd.exe	cscript.exe
PID 3128 wrote to memory of 4056	3128	cmd.exe	cscript.exe
PID 3128 wrote to memory of 4056	3128	cmd.exe	cscript.exe
PID 976 wrote to memory of 3292	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 3292	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 3292	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 3504	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 3504	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 3504	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 3504 wrote to memory of 740	3504	cmd.exe	@WanaDecryptor@.exe
PID 3504 wrote to memory of 740	3504	cmd.exe	@WanaDecryptor@.exe
PID 3504 wrote to memory of 740	3504	cmd.exe	@WanaDecryptor@.exe
PID 3292 wrote to memory of 3824	3292	@WanaDecryptor@.exe	taskhsvc.exe
PID 3292 wrote to memory of 3824	3292	@WanaDecryptor@.exe	taskhsvc.exe
PID 3292 wrote to memory of 3824	3292	@WanaDecryptor@.exe	taskhsvc.exe
PID 740 wrote to memory of 1356	740	@WanaDecryptor@.exe	cmd.exe
PID 740 wrote to memory of 1356	740	@WanaDecryptor@.exe	cmd.exe
PID 740 wrote to memory of 1356	740	@WanaDecryptor@.exe	cmd.exe
PID 1356 wrote to memory of 1444	1356	cmd.exe	vssadmin.exe
PID 1356 wrote to memory of 1444	1356	cmd.exe	vssadmin.exe
PID 1356 wrote to memory of 1444	1356	cmd.exe	vssadmin.exe
PID 1356 wrote to memory of 1844	1356	cmd.exe	WMIC.exe
PID 1356 wrote to memory of 1844	1356	cmd.exe	WMIC.exe
PID 1356 wrote to memory of 1844	1356	cmd.exe	WMIC.exe
PID 976 wrote to memory of 3636	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 3636	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 3636	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 4056	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 4056	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 4056	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 3128	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 2472	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 2472	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 976 wrote to memory of 2472	976	289fb0815a35d88e4e716881561d8d83.exe	cmd.exe
PID 2472 wrote to memory of 2824	2472	cmd.exe	reg.exe
PID 2472 wrote to memory of 2824	2472	cmd.exe	reg.exe
PID 2472 wrote to memory of 2824	2472	cmd.exe	reg.exe
PID 976 wrote to memory of 420	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 420	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 420	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 1004	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 1004	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 1004	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe
PID 976 wrote to memory of 1068	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 1068	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 1068	976	289fb0815a35d88e4e716881561d8d83.exe	@WanaDecryptor@.exe
PID 976 wrote to memory of 2300	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 2300	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 2300	976	289fb0815a35d88e4e716881561d8d83.exe	taskdl.exe
PID 976 wrote to memory of 3092	976	289fb0815a35d88e4e716881561d8d83.exe	taskse.exe

Loads dropped DLL 8 IoCs

Processes:

taskhsvc.exe

pid process

3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

taskhsvc.exe

pid process

3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe
3824 taskhsvc.exe

pid	process
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe

pid	process
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe
3824	taskhsvc.exe

Drops startup file 2 IoCs

Processes:

289fb0815a35d88e4e716881561d8d83.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD9FA.tmp	289fb0815a35d88e4e716881561d8d83.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD9F3.tmp	289fb0815a35d88e4e716881561d8d83.exe

Executes dropped EXE 16 IoCs

Processes:

taskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskse.exe@WanaDecryptor@.exetaskdl.exe

pid	process
760	taskdl.exe
3292	@WanaDecryptor@.exe
740	@WanaDecryptor@.exe
3824	taskhsvc.exe
3636	taskdl.exe
4056	taskse.exe
3128	@WanaDecryptor@.exe
420	taskdl.exe
1004	taskse.exe
1068	@WanaDecryptor@.exe
2300	taskdl.exe
3092	taskse.exe
2860	@WanaDecryptor@.exe
3364	taskse.exe
1168	@WanaDecryptor@.exe
1268	taskdl.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2824 reg.exe

pid	process
2824	reg.exe

Adds Run entry to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pajxwiyyl178 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\""	reg.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

289fb0815a35d88e4e716881561d8d83.exe@WanaDecryptor@.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	289fb0815a35d88e4e716881561d8d83.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	@WanaDecryptor@.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

3448 icacls.exe
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

pid	process
3448	icacls.exe

Suspicious use of SetWindowsHookEx 9 IoCs

Processes:

@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe

pid	process
740	@WanaDecryptor@.exe
3292	@WanaDecryptor@.exe
3292	@WanaDecryptor@.exe
740	@WanaDecryptor@.exe
3128	@WanaDecryptor@.exe
3128	@WanaDecryptor@.exe
1068	@WanaDecryptor@.exe
2860	@WanaDecryptor@.exe
1168	@WanaDecryptor@.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

3884 attrib.exe

pid	process
3884	attrib.exe

Modifies service 2 TTPs 4 IoCs

persistence

Modify Registry

T1112

Modify Existing Service

T1031

Processes:

vssvc.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Shadow Copy Optimization Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\Registry Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\COM+ REGDB Writer	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\VSS\Diag\ASR Writer	vssvc.exe

C:\Users\Admin\AppData\Local\Temp\289fb0815a35d88e4e716881561d8d83.exe
"C:\Users\Admin\AppData\Local\Temp\289fb0815a35d88e4e716881561d8d83.exe"
1⤵
- Suspicious use of WriteProcessMemory
- Drops startup file
- Sets desktop wallpaper using registry
PID:976

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:3884

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:3448

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:760

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 110981592838023.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:3128

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:4056

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe co
2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:3824

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @WanaDecryptor@.exe vs
2⤵
- Suspicious use of WriteProcessMemory
PID:3504

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe vs
3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:740

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- Suspicious use of WriteProcessMemory
PID:1356

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:1444

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1844

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3636

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:4056

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3128

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pajxwiyyl178" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:2472

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pajxwiyyl178" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f
3⤵
- Modifies registry key
- Adds Run entry to start application
PID:2824

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:420

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:1004

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1068

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2300

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:3092

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2860

C:\Users\Admin\AppData\Local\Temp\taskse.exe
taskse.exe C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:3364

C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe
@WanaDecryptor@.exe
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1168

C:\Users\Admin\AppData\Local\Temp\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1268

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
- Modifies service
PID:1652

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Hidden Files and Directories

T1158

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

File Deletion

T1107

Modify Registry

T1112

File Permissions Modification

T1222

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\0.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Download Submit
C:\Users\Admin\AppData\Local\Temp\1.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\10.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\11.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\110981592838023.bat

Download Submit
C:\Users\Admin\AppData\Local\Temp\12.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\13.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\14.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\15.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\16.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\17.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\18.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\19.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\2.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\20.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\21.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\22.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\23.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\24.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\25.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\26.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\27.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\28.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\29.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\3.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\30.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\31.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\32.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\33.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\34.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\35.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\36.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\4.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\5.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\6.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\7.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\8.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\9.WNCRYT

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\@WanaDecryptor@.exe.lnk

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\LIBEAY32.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\SSLEAY32.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll

Download Submit
C:\Users\Admin\AppData\Local\Temp\b.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.vbs

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_bulgarian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (simplified).wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_chinese (traditional).wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_croatian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_czech.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_danish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_dutch.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_english.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_filipino.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_finnish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_french.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_german.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_greek.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_indonesian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_italian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_japanese.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_korean.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_latvian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_norwegian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_polish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_portuguese.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_romanian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_russian.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_slovak.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_spanish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_swedish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_turkish.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\msg\m_vietnamese.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\r.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\s.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\t.wnry

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskdl.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\taskse.exe

Download Submit
C:\Users\Admin\AppData\Local\Temp\u.wnry

Download Submit
C:\Users\Admin\Desktop\@WanaDecryptor@.bmp

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libeay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libevent-2-0-5.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libgcc_s_sjlj-1.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\libssp-0.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\ssleay32.dll

Download Submit
\Users\Admin\AppData\Local\Temp\TaskData\Tor\zlib1.dll

Download Submit
memory/420-1472-0x0000000000000000-mapping.dmp

Download
memory/740-50-0x0000000000000000-mapping.dmp

Download
memory/740-51-0x0000000000000000-mapping.dmp

Download
memory/760-39-0x0000000000000000-mapping.dmp

Download
memory/976-29-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/1004-1474-0x0000000000000000-mapping.dmp

Download
memory/1068-1476-0x0000000000000000-mapping.dmp

Download
memory/1168-1523-0x0000000000000000-mapping.dmp

Download
memory/1268-1525-0x0000000000000000-mapping.dmp

Download
memory/1356-1459-0x0000000000000000-mapping.dmp

Download
memory/1444-1460-0x0000000000000000-mapping.dmp

Download
memory/1844-1461-0x0000000000000000-mapping.dmp

Download
memory/2300-1478-0x0000000000000000-mapping.dmp

Download
memory/2472-1468-0x0000000000000000-mapping.dmp

Download
memory/2824-1469-0x0000000000000000-mapping.dmp

Download
memory/2860-1482-0x0000000000000000-mapping.dmp

Download
memory/3092-1480-0x0000000000000000-mapping.dmp

Download
memory/3128-1466-0x0000000000000000-mapping.dmp

Download
memory/3128-41-0x0000000000000000-mapping.dmp

Download
memory/3292-47-0x0000000000000000-mapping.dmp

Download
memory/3364-1521-0x0000000000000000-mapping.dmp

Download
memory/3448-1-0x0000000000000000-mapping.dmp

Download
memory/3504-48-0x0000000000000000-mapping.dmp

Download
memory/3636-1462-0x0000000000000000-mapping.dmp

Download
memory/3824-544-0x0000000004040000-0x0000000004041000-memory.dmp

Filesize
4KB

Download
memory/3824-80-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-400-0x0000000004040000-0x0000000004041000-memory.dmp

Filesize
4KB

Download
memory/3824-401-0x0000000004840000-0x0000000004841000-memory.dmp

Filesize
4KB

Download
memory/3824-403-0x0000000004040000-0x0000000004041000-memory.dmp

Filesize
4KB

Download
memory/3824-237-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-72-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/3824-71-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-73-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-54-0x0000000000000000-mapping.dmp

Download
memory/3824-74-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-393-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-81-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-87-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-236-0x00000000042B0000-0x00000000042B1000-memory.dmp

Filesize
4KB

Download
memory/3824-90-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-235-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-91-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-140-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3824-107-0x0000000003AB0000-0x0000000003AB1000-memory.dmp

Filesize
4KB

Download
memory/3884-0-0x0000000000000000-mapping.dmp

Download
memory/4056-1464-0x0000000000000000-mapping.dmp

Download
memory/4056-43-0x0000000000000000-mapping.dmp

Download