Resubmissions
04/06/2025, 23:42
250604-3qetxsfj6v 1019/03/2022, 08:22
220319-j9qwraech8 1019/03/2022, 08:21
220319-j84ffseebn 616/03/2022, 15:34
220316-sz9qjsfba4 1017/02/2022, 18:50
220217-xhdn1aedap 1017/02/2022, 13:21
220217-ql2rnsbbf7 1017/02/2022, 13:20
220217-qljwvscdar 117/02/2022, 13:20
220217-qlb61sbbf6 117/02/2022, 13:19
220217-qkv8hacdap 117/02/2022, 12:49
220217-p2gwrscchl 10Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
17/01/2021, 17:24
Static task
static1
Behavioral task
behavioral1
Sample
important.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
important.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
important.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
Path
C:\Users\Admin\AppData\Local\Temp\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 16 IoCs
pid Process 3624 taskdl.exe 3180 @[email protected] 2192 @[email protected] 3440 taskhsvc.exe 1592 taskse.exe 1156 @[email protected] 1288 taskdl.exe 3416 taskdl.exe 3496 taskse.exe 1252 @[email protected] 2256 taskdl.exe 1308 taskse.exe 1172 @[email protected] 3184 taskse.exe 2376 @[email protected] 2360 taskdl.exe -
Modifies extensions of user files 15 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\RedoSwitch.tiff.WNCRYT important.exe File created C:\Users\Admin\Pictures\WaitUninstall.tif.WNCRYT important.exe File created C:\Users\Admin\Pictures\FormatPing.tiff.WNCRYT important.exe File renamed C:\Users\Admin\Pictures\FormatPing.tiff.WNCRYT => C:\Users\Admin\Pictures\FormatPing.tiff.WNCRY important.exe File opened for modification C:\Users\Admin\Pictures\RedoSwitch.tiff.WNCRY important.exe File renamed C:\Users\Admin\Pictures\WaitUninstall.tif.WNCRYT => C:\Users\Admin\Pictures\WaitUninstall.tif.WNCRY important.exe File renamed C:\Users\Admin\Pictures\ConvertFromBlock.tiff.WNCRYT => C:\Users\Admin\Pictures\ConvertFromBlock.tiff.WNCRY important.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromBlock.tiff.WNCRY important.exe File opened for modification C:\Users\Admin\Pictures\FormatPing.tiff.WNCRY important.exe File renamed C:\Users\Admin\Pictures\RedoSwitch.tiff.WNCRYT => C:\Users\Admin\Pictures\RedoSwitch.tiff.WNCRY important.exe File opened for modification C:\Users\Admin\Pictures\FormatPing.tiff important.exe File created C:\Users\Admin\Pictures\ConvertFromBlock.tiff.WNCRYT important.exe File opened for modification C:\Users\Admin\Pictures\WaitUninstall.tif.WNCRY important.exe File opened for modification C:\Users\Admin\Pictures\ConvertFromBlock.tiff important.exe File opened for modification C:\Users\Admin\Pictures\RedoSwitch.tiff important.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA7B1.tmp important.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA79A.tmp important.exe -
Loads dropped DLL 7 IoCs
pid Process 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3204 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ykfyrlrehuhmwcj780 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
JavaScript code in executable 5 IoCs
resource yara_rule behavioral2/files/0x000100000001ad19-56.dat js behavioral2/files/0x000100000001ad19-57.dat js behavioral2/files/0x000100000001ad10-61.dat js behavioral2/files/0x000100000001ad10-70.dat js behavioral2/files/0x000100000001ad10-69.dat js -
Program crash 1 IoCs
pid pid_target Process procid_target 1260 2284 WerFault.exe 119 -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" important.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2908 vssadmin.exe -
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{03DD06A3-58F1-11EB-B59A-CA9C6575B2E4} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 420 reg.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 3440 taskhsvc.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe 1260 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 56 IoCs
description pid Process Token: SeBackupPrivilege 3508 vssvc.exe Token: SeRestorePrivilege 3508 vssvc.exe Token: SeAuditPrivilege 3508 vssvc.exe Token: SeTcbPrivilege 1592 taskse.exe Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeTcbPrivilege 1592 taskse.exe Token: SeIncreaseQuotaPrivilege 1968 WMIC.exe Token: SeSecurityPrivilege 1968 WMIC.exe Token: SeTakeOwnershipPrivilege 1968 WMIC.exe Token: SeLoadDriverPrivilege 1968 WMIC.exe Token: SeSystemProfilePrivilege 1968 WMIC.exe Token: SeSystemtimePrivilege 1968 WMIC.exe Token: SeProfSingleProcessPrivilege 1968 WMIC.exe Token: SeIncBasePriorityPrivilege 1968 WMIC.exe Token: SeCreatePagefilePrivilege 1968 WMIC.exe Token: SeBackupPrivilege 1968 WMIC.exe Token: SeRestorePrivilege 1968 WMIC.exe Token: SeShutdownPrivilege 1968 WMIC.exe Token: SeDebugPrivilege 1968 WMIC.exe Token: SeSystemEnvironmentPrivilege 1968 WMIC.exe Token: SeRemoteShutdownPrivilege 1968 WMIC.exe Token: SeUndockPrivilege 1968 WMIC.exe Token: SeManageVolumePrivilege 1968 WMIC.exe Token: 33 1968 WMIC.exe Token: 34 1968 WMIC.exe Token: 35 1968 WMIC.exe Token: 36 1968 WMIC.exe Token: SeTcbPrivilege 3496 taskse.exe Token: SeTcbPrivilege 3496 taskse.exe Token: SeTcbPrivilege 1308 taskse.exe Token: SeTcbPrivilege 1308 taskse.exe Token: SeTcbPrivilege 3184 taskse.exe Token: SeTcbPrivilege 3184 taskse.exe Token: SeRestorePrivilege 1260 WerFault.exe Token: SeBackupPrivilege 1260 WerFault.exe Token: SeDebugPrivilege 1260 WerFault.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1156 @[email protected] 3360 iexplore.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 2192 @[email protected] 3180 @[email protected] 3180 @[email protected] 2192 @[email protected] 1156 @[email protected] 1156 @[email protected] 1252 @[email protected] 1172 @[email protected] 2376 @[email protected] 3360 iexplore.exe 3360 iexplore.exe 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 2284 IEXPLORE.EXE 3360 iexplore.exe -
Suspicious use of WriteProcessMemory 81 IoCs
description pid Process procid_target PID 616 wrote to memory of 752 616 important.exe 75 PID 616 wrote to memory of 752 616 important.exe 75 PID 616 wrote to memory of 752 616 important.exe 75 PID 616 wrote to memory of 3204 616 important.exe 77 PID 616 wrote to memory of 3204 616 important.exe 77 PID 616 wrote to memory of 3204 616 important.exe 77 PID 616 wrote to memory of 3624 616 important.exe 80 PID 616 wrote to memory of 3624 616 important.exe 80 PID 616 wrote to memory of 3624 616 important.exe 80 PID 616 wrote to memory of 3520 616 important.exe 81 PID 616 wrote to memory of 3520 616 important.exe 81 PID 616 wrote to memory of 3520 616 important.exe 81 PID 3520 wrote to memory of 1564 3520 cmd.exe 83 PID 3520 wrote to memory of 1564 3520 cmd.exe 83 PID 3520 wrote to memory of 1564 3520 cmd.exe 83 PID 616 wrote to memory of 3180 616 important.exe 85 PID 616 wrote to memory of 3180 616 important.exe 85 PID 616 wrote to memory of 3180 616 important.exe 85 PID 616 wrote to memory of 3244 616 important.exe 86 PID 616 wrote to memory of 3244 616 important.exe 86 PID 616 wrote to memory of 3244 616 important.exe 86 PID 3244 wrote to memory of 2192 3244 cmd.exe 88 PID 3244 wrote to memory of 2192 3244 cmd.exe 88 PID 3244 wrote to memory of 2192 3244 cmd.exe 88 PID 3180 wrote to memory of 3440 3180 @[email protected] 90 PID 3180 wrote to memory of 3440 3180 @[email protected] 90 PID 3180 wrote to memory of 3440 3180 @[email protected] 90 PID 2192 wrote to memory of 720 2192 @[email protected] 95 PID 2192 wrote to memory of 720 2192 @[email protected] 95 PID 2192 wrote to memory of 720 2192 @[email protected] 95 PID 720 wrote to memory of 2908 720 cmd.exe 97 PID 720 wrote to memory of 2908 720 cmd.exe 97 PID 720 wrote to memory of 2908 720 cmd.exe 97 PID 720 wrote to memory of 1968 720 cmd.exe 99 PID 720 wrote to memory of 1968 720 cmd.exe 99 PID 720 wrote to memory of 1968 720 cmd.exe 99 PID 616 wrote to memory of 1592 616 important.exe 100 PID 616 wrote to memory of 1592 616 important.exe 100 PID 616 wrote to memory of 1592 616 important.exe 100 PID 616 wrote to memory of 1156 616 important.exe 101 PID 616 wrote to memory of 1156 616 important.exe 101 PID 616 wrote to memory of 1156 616 important.exe 101 PID 616 wrote to memory of 1516 616 important.exe 102 PID 616 wrote to memory of 1516 616 important.exe 102 PID 616 wrote to memory of 1516 616 important.exe 102 PID 616 wrote to memory of 1288 616 important.exe 104 PID 616 wrote to memory of 1288 616 important.exe 104 PID 616 wrote to memory of 1288 616 important.exe 104 PID 1516 wrote to memory of 420 1516 cmd.exe 105 PID 1516 wrote to memory of 420 1516 cmd.exe 105 PID 1516 wrote to memory of 420 1516 cmd.exe 105 PID 616 wrote to memory of 3416 616 important.exe 107 PID 616 wrote to memory of 3416 616 important.exe 107 PID 616 wrote to memory of 3416 616 important.exe 107 PID 616 wrote to memory of 3496 616 important.exe 108 PID 616 wrote to memory of 3496 616 important.exe 108 PID 616 wrote to memory of 3496 616 important.exe 108 PID 616 wrote to memory of 1252 616 important.exe 109 PID 616 wrote to memory of 1252 616 important.exe 109 PID 616 wrote to memory of 1252 616 important.exe 109 PID 616 wrote to memory of 2256 616 important.exe 111 PID 616 wrote to memory of 2256 616 important.exe 111 PID 616 wrote to memory of 2256 616 important.exe 111 PID 616 wrote to memory of 1308 616 important.exe 112 PID 616 wrote to memory of 1308 616 important.exe 112 PID 616 wrote to memory of 1308 616 important.exe 112 PID 616 wrote to memory of 1172 616 important.exe 113 PID 616 wrote to memory of 1172 616 important.exe 113 PID 616 wrote to memory of 1172 616 important.exe 113 PID 616 wrote to memory of 3184 616 important.exe 114 PID 616 wrote to memory of 3184 616 important.exe 114 PID 616 wrote to memory of 3184 616 important.exe 114 PID 616 wrote to memory of 2376 616 important.exe 115 PID 616 wrote to memory of 2376 616 important.exe 115 PID 616 wrote to memory of 2376 616 important.exe 115 PID 616 wrote to memory of 2360 616 important.exe 116 PID 616 wrote to memory of 2360 616 important.exe 116 PID 616 wrote to memory of 2360 616 important.exe 116 PID 3360 wrote to memory of 2284 3360 iexplore.exe 119 PID 3360 wrote to memory of 2284 3360 iexplore.exe 119 PID 3360 wrote to memory of 2284 3360 iexplore.exe 119 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 752 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\important.exe"C:\Users\Admin\AppData\Local\Temp\important.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:616 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:752
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:3204
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3624
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 313421610907653.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:1564
-
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3180 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:3440
-
-
-
C:\Windows\SysWOW64\cmd.exePID:3244
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2192 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:720 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2908
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:1968
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1592
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1156
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ykfyrlrehuhmwcj780" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ykfyrlrehuhmwcj780" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:420
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3416
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1252
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2256
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1308
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1172
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2376
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2360
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3508
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" C:\Users\Admin\Desktop\ConvertToSkip.xht1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:3360 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3360 CREDAT:82945 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:2284 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2284 -s 32923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-