Resubmissions
18-07-2022 04:40
220718-faqj6ahdd3 109-07-2022 10:37
220709-mn992sgcd4 1008-07-2022 15:34
220708-sz77qaadf8 1020-06-2022 11:39
220620-nsq8eacgfk 1013-06-2022 10:07
220613-l5wmjsbff6 1012-06-2022 12:47
220612-p1kw2acbbp 1012-06-2022 07:39
220612-jg55zagca5 1011-06-2022 20:25
220611-y7pcgabdf5 1011-06-2022 20:25
220611-y7fekabde7 1011-06-2022 20:24
220611-y642jafber 1Analysis
-
max time kernel
1818s -
max time network
1815s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
04-02-2022 10:14
Static task
static1
Behavioral task
behavioral1
Sample
WannaCry.exe
Resource
win10-en-20211208
General
-
Target
WannaCry.exe
-
Size
3.4MB
-
MD5
84c82835a5d21bbcf75a61706d8ab549
-
SHA1
5ff465afaabcbf0150d1a3ab2c2e74f3a4426467
-
SHA256
ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa
-
SHA512
90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Executes dropped EXE 64 IoCs
pid Process 3432 taskdl.exe 1184 taskdl.exe 3716 taskdl.exe 1556 taskdl.exe 3740 @[email protected] 864 @[email protected] 2316 taskse.exe 2292 @[email protected] 2408 taskdl.exe 1664 taskhsvc.exe 3744 taskse.exe 1916 @[email protected] 3404 taskdl.exe 1536 taskse.exe 3672 @[email protected] 1628 taskdl.exe 2008 @[email protected] 3480 taskse.exe 2212 taskdl.exe 3736 taskse.exe 3720 @[email protected] 3824 taskdl.exe 3500 taskse.exe 1184 @[email protected] 3056 taskdl.exe 2072 taskse.exe 3716 @[email protected] 1544 taskdl.exe 1288 taskse.exe 3460 @[email protected] 2152 taskdl.exe 3684 taskse.exe 3696 @[email protected] 512 taskdl.exe 2688 taskse.exe 3404 @[email protected] 3172 taskdl.exe 3892 taskse.exe 1808 @[email protected] 1536 taskdl.exe 1628 taskse.exe 2624 @[email protected] 784 taskdl.exe 3916 taskse.exe 3476 @[email protected] 1300 taskdl.exe 1904 taskse.exe 1660 @[email protected] 1816 taskdl.exe 3728 taskse.exe 3736 @[email protected] 2288 taskdl.exe 2852 taskse.exe 2176 @[email protected] 1184 taskdl.exe 3500 taskse.exe 3324 @[email protected] 3716 taskdl.exe 2072 taskse.exe 3392 @[email protected] 3284 taskdl.exe 3560 taskse.exe 1008 @[email protected] 3448 taskdl.exe -
Modifies Installed Components in the registry 2 TTPs
-
Modifies extensions of user files 18 IoCs
Ransomware generally changes the extension on encrypted files.
description ioc Process File created C:\Users\Admin\Pictures\GrantEnable.tif.WNCRYT WannaCry.exe File renamed C:\Users\Admin\Pictures\GrantEnable.tif.WNCRYT => C:\Users\Admin\Pictures\GrantEnable.tif.WNCRY WannaCry.exe File renamed C:\Users\Admin\Pictures\RestoreReset.tif.WNCRYT => C:\Users\Admin\Pictures\RestoreReset.tif.WNCRY WannaCry.exe File created C:\Users\Admin\Pictures\RestoreReset.tif.WNCRYT WannaCry.exe File renamed C:\Users\Admin\Pictures\TraceUninstall.raw.WNCRYT => C:\Users\Admin\Pictures\TraceUninstall.raw.WNCRY WannaCry.exe File created C:\Users\Admin\Pictures\ConvertToGrant.tif.WNCRYT WannaCry.exe File opened for modification C:\Users\Admin\Pictures\ConvertToGrant.tif.WNCRY WannaCry.exe File created C:\Users\Admin\Pictures\PushEnable.raw.WNCRYT WannaCry.exe File opened for modification C:\Users\Admin\Pictures\PushEnable.raw.WNCRY WannaCry.exe File created C:\Users\Admin\Pictures\SaveUnlock.raw.WNCRYT WannaCry.exe File renamed C:\Users\Admin\Pictures\SaveUnlock.raw.WNCRYT => C:\Users\Admin\Pictures\SaveUnlock.raw.WNCRY WannaCry.exe File created C:\Users\Admin\Pictures\TraceUninstall.raw.WNCRYT WannaCry.exe File renamed C:\Users\Admin\Pictures\ConvertToGrant.tif.WNCRYT => C:\Users\Admin\Pictures\ConvertToGrant.tif.WNCRY WannaCry.exe File opened for modification C:\Users\Admin\Pictures\GrantEnable.tif.WNCRY WannaCry.exe File renamed C:\Users\Admin\Pictures\PushEnable.raw.WNCRYT => C:\Users\Admin\Pictures\PushEnable.raw.WNCRY WannaCry.exe File opened for modification C:\Users\Admin\Pictures\RestoreReset.tif.WNCRY WannaCry.exe File opened for modification C:\Users\Admin\Pictures\SaveUnlock.raw.WNCRY WannaCry.exe File opened for modification C:\Users\Admin\Pictures\TraceUninstall.raw.WNCRY WannaCry.exe -
Drops startup file 18 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4F10.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4C2C.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3824.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDAE3.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3DA8.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD47BD.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4F09.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD46EE.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD46F5.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD3D91.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD2FE9.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD2FFF.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDAEA.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD397B.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD3A0E.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD47C4.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4AEC.tmp WannaCry.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD381D.tmp WannaCry.exe -
Loads dropped DLL 8 IoCs
pid Process 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 3460 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pqrcgiobwmzdqtd497 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\tasksche.exe\"" reg.exe -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" WannaCry.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] -
Drops file in Windows directory 7 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4032412167\2701812693.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\4032412167\2701812693.pri explorer.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri taskmgr.exe File created C:\Windows\rescache\_merged\2717123927\1253081315.pri explorer.exe File created C:\Windows\rescache\_merged\4183903823\97717462.pri ShellExperienceHost.exe File created C:\Windows\rescache\_merged\1601268389\1361672858.pri SearchUI.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 15 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Capabilities explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Capabilities explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{afd97640-86a3-4210-b67c-289c41aabe55}\0003 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{51236583-0c4a-4fe8-b81f-166aec13f510}\0064 explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000 explorer.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU SearchUI.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS SearchUI.exe -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
pid Process 2952 vssadmin.exe -
Kills process with taskkill 5 IoCs
pid Process 2760 taskkill.exe 3364 taskkill.exe 3032 taskkill.exe 2376 taskkill.exe 1628 taskkill.exe -
Modifies registry class 30 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\Total SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\UserStartTime = "132834483419201729" explorer.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "56" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana\Total = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DomStorageState SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\windows.cortana SearchUI.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "56" SearchUI.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "152" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\microsoft.windows.cortana SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\Total\ = "185" SearchUI.exe Set value (int) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\DOMStorage\microsoft.windows.cortana\ = "23" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\TrayNotify\IconStreams = 14000000070000000100010005000000140000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002c100000000000002000000e60702004100720067006a006200650078002000200033000a005600610067007200650061007200670020006e007000700072006600660000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000074ae2078e323294282c1e41cb67d5b9c00000000000000000000000039ebe797b819d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000002000000e60702004600630072006e0078007200650066003a002000360037002500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000100000073ae2078e323294282c1e41cb67d5b9c000000000000000000000000bcc3e097b819d80100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000007b00360051003800300039003300370037002d0036004e00530030002d003400340034004f002d0038003900350037002d004e00330037003700330053003000320032003000300052007d005c004a0076006100710062006a0066002000510072007300720061007100720065005c005a0046004e00460050006800760059002e0072006b007200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000640000000000000000000000e5070c004e0070006700760062006100660020006100720072007100720071002e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000fffffffff9a6406d323dcb4f8a86be992e03dc76000000000000000000000000188b0c8942ecd70100000000000000000000000000000d20feb05a007600700065006200660062007300670020004a0076006100710062006a006600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e5070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff75ae2078e323294282c1e41cb67d5b9c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000007b005300330038004f0053003400300034002d0031005100340033002d0034003200530032002d0039003300300035002d00360037005100520030004f003200380053005000320033007d005c0072006b006300790062006500720065002e0072006b00720000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000e5070c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff81ae2078e323294282c1e41cb67d5b9c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage SearchUI.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" SearchUI.exe Key created \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.windows.cortana_cw5n1h2txyewy\Internet Explorer\EdpDomStorage\windows.cortana SearchUI.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 3736 reg.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 2320 taskmgr.exe 2320 taskmgr.exe 1664 taskhsvc.exe 1664 taskhsvc.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3580 explorer.exe 2320 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeDebugPrivilege 2320 taskmgr.exe Token: SeSystemProfilePrivilege 2320 taskmgr.exe Token: SeCreateGlobalPrivilege 2320 taskmgr.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeTcbPrivilege 2316 taskse.exe Token: SeTcbPrivilege 2316 taskse.exe Token: SeShutdownPrivilege 3580 explorer.exe Token: SeCreatePagefilePrivilege 3580 explorer.exe Token: SeBackupPrivilege 3932 vssvc.exe Token: SeRestorePrivilege 3932 vssvc.exe Token: SeAuditPrivilege 3932 vssvc.exe Token: SeIncreaseQuotaPrivilege 3780 WMIC.exe Token: SeSecurityPrivilege 3780 WMIC.exe Token: SeTakeOwnershipPrivilege 3780 WMIC.exe Token: SeLoadDriverPrivilege 3780 WMIC.exe Token: SeSystemProfilePrivilege 3780 WMIC.exe Token: SeSystemtimePrivilege 3780 WMIC.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 3580 explorer.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 3580 explorer.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe 2320 taskmgr.exe -
Suspicious use of SetWindowsHookEx 63 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2148 wrote to memory of 3432 2148 WannaCry.exe 80 PID 2148 wrote to memory of 3432 2148 WannaCry.exe 80 PID 2148 wrote to memory of 3432 2148 WannaCry.exe 80 PID 2148 wrote to memory of 3460 2148 WannaCry.exe 81 PID 2148 wrote to memory of 3460 2148 WannaCry.exe 81 PID 2148 wrote to memory of 3460 2148 WannaCry.exe 81 PID 3580 wrote to memory of 2320 3580 explorer.exe 85 PID 3580 wrote to memory of 2320 3580 explorer.exe 85 PID 2148 wrote to memory of 3432 2148 WannaCry.exe 87 PID 2148 wrote to memory of 3432 2148 WannaCry.exe 87 PID 2148 wrote to memory of 3432 2148 WannaCry.exe 87 PID 2148 wrote to memory of 3560 2148 WannaCry.exe 89 PID 2148 wrote to memory of 3560 2148 WannaCry.exe 89 PID 2148 wrote to memory of 3560 2148 WannaCry.exe 89 PID 3560 wrote to memory of 3056 3560 cmd.exe 91 PID 3560 wrote to memory of 3056 3560 cmd.exe 91 PID 3560 wrote to memory of 3056 3560 cmd.exe 91 PID 2148 wrote to memory of 1184 2148 WannaCry.exe 93 PID 2148 wrote to memory of 1184 2148 WannaCry.exe 93 PID 2148 wrote to memory of 1184 2148 WannaCry.exe 93 PID 2148 wrote to memory of 3716 2148 WannaCry.exe 95 PID 2148 wrote to memory of 3716 2148 WannaCry.exe 95 PID 2148 wrote to memory of 3716 2148 WannaCry.exe 95 PID 2148 wrote to memory of 1556 2148 WannaCry.exe 98 PID 2148 wrote to memory of 1556 2148 WannaCry.exe 98 PID 2148 wrote to memory of 1556 2148 WannaCry.exe 98 PID 2148 wrote to memory of 3740 2148 WannaCry.exe 99 PID 2148 wrote to memory of 3740 2148 WannaCry.exe 99 PID 2148 wrote to memory of 3740 2148 WannaCry.exe 99 PID 2148 wrote to memory of 1904 2148 WannaCry.exe 100 PID 2148 wrote to memory of 1904 2148 WannaCry.exe 100 PID 2148 wrote to memory of 1904 2148 WannaCry.exe 100 PID 1904 wrote to memory of 864 1904 cmd.exe 102 PID 1904 wrote to memory of 864 1904 cmd.exe 102 PID 1904 wrote to memory of 864 1904 cmd.exe 102 PID 2148 wrote to memory of 2316 2148 WannaCry.exe 104 PID 2148 wrote to memory of 2316 2148 WannaCry.exe 104 PID 2148 wrote to memory of 2316 2148 WannaCry.exe 104 PID 2148 wrote to memory of 2292 2148 WannaCry.exe 105 PID 2148 wrote to memory of 2292 2148 WannaCry.exe 105 PID 2148 wrote to memory of 2292 2148 WannaCry.exe 105 PID 2148 wrote to memory of 2268 2148 WannaCry.exe 106 PID 2148 wrote to memory of 2268 2148 WannaCry.exe 106 PID 2148 wrote to memory of 2268 2148 WannaCry.exe 106 PID 2268 wrote to memory of 3736 2268 cmd.exe 108 PID 2268 wrote to memory of 3736 2268 cmd.exe 108 PID 2268 wrote to memory of 3736 2268 cmd.exe 108 PID 2148 wrote to memory of 2408 2148 WannaCry.exe 109 PID 2148 wrote to memory of 2408 2148 WannaCry.exe 109 PID 2148 wrote to memory of 2408 2148 WannaCry.exe 109 PID 3740 wrote to memory of 1664 3740 @[email protected] 110 PID 3740 wrote to memory of 1664 3740 @[email protected] 110 PID 3740 wrote to memory of 1664 3740 @[email protected] 110 PID 864 wrote to memory of 4088 864 @[email protected] 112 PID 864 wrote to memory of 4088 864 @[email protected] 112 PID 864 wrote to memory of 4088 864 @[email protected] 112 PID 4088 wrote to memory of 2952 4088 cmd.exe 114 PID 4088 wrote to memory of 2952 4088 cmd.exe 114 PID 4088 wrote to memory of 2952 4088 cmd.exe 114 PID 4088 wrote to memory of 3780 4088 cmd.exe 116 PID 4088 wrote to memory of 3780 4088 cmd.exe 116 PID 4088 wrote to memory of 3780 4088 cmd.exe 116 PID 2148 wrote to memory of 3744 2148 WannaCry.exe 118 PID 2148 wrote to memory of 3744 2148 WannaCry.exe 118 -
Views/modifies file attributes 1 TTPs 1 IoCs
pid Process 3432 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:2148 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:3432
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3432
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 167141638878600.bat2⤵
- Suspicious use of WriteProcessMemory
PID:3560 -
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:3056
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3716
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1556
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3740 -
C:\Users\Admin\AppData\Local\Temp\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1664
-
-
-
C:\Windows\SysWOW64\cmd.exePID:1904
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
PID:2952
-
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3780
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2316
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:2292
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pqrcgiobwmzdqtd497" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2268 -
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "pqrcgiobwmzdqtd497" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:3736
-
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3744
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1916
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3480
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2008
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3056
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2072
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3716
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1288
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3696
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:512
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2688
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3172
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3892
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1808
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:784
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3916
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3476
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1904
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3728
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3736
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2288
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2852
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2176
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3500
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3716
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2072
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3392
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3284
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3560
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1008
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3448
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:920
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:364
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:348
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:392
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:4084
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2672
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:376
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3404
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1528
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3432
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1408
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3876
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4080
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1736
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3308
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2212
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3480
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2208
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3824
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3848
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2180
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3216
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2408
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3664
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3388
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3556
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:188
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1008
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1544
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3540
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3460
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:848
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2304
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3192
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3720
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3684
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:376
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3536
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3360
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2576
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3796
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2472
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3672
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3436
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
PID:2760
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im mysqld.exe2⤵
- Kills process with taskkill
PID:3364
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im sqlwriter.exe2⤵
- Kills process with taskkill
PID:3032
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im sqlserver.exe2⤵
- Kills process with taskkill
PID:2376
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill.exe /f /im MSExchange*2⤵
- Kills process with taskkill
PID:1628
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3304
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1660
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1064
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3412
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2860
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:2936
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1184
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3928
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2700
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3828
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3296
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1268
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2152
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1152
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:4028
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:920
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:736
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:848
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1884
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:912
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:1320
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1012
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3184
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3100
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3076
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:1204
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:3916
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3080
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2184
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2624
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:1816
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2632
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2380
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:4008
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:872
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:312
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:208
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:372
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:596
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:440
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:2404
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3316
-
-
C:\Users\Admin\AppData\Local\Temp\taskdl.exetaskdl.exe2⤵PID:3332
-
-
C:\Users\Admin\AppData\Local\Temp\taskse.exePID:4092
-
-
C:\Users\Admin\AppData\Local\Temp\@[email protected]PID:3976
-
-
C:\Windows\system32\werfault.exewerfault.exe /h /shared Global\6a17078f3f174766aa0849d7932c4c4c /t 3060 /p 30561⤵PID:2504
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3580 -
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /42⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2320
-
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:3676
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:804
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3932