Analysis
-
max time kernel
820s -
max time network
822s -
platform
windows7_x64 -
resource
win7-20220812-es -
resource tags
arch:x64arch:x86image:win7-20220812-eslocale:es-esos:windows7-x64systemwindows -
submitted
07-02-2023 20:27
Static task
static1
URLScan task
urlscan1
Behavioral task
behavioral1
Sample
http://google.com
Resource
win7-20220812-es
General
-
Target
http://google.com
Malware Config
Extracted
C:\Users\Admin\Desktop\@Please_Read_Me@.txt
wannacry
12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw
Signatures
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies extensions of user files 10 IoCs
Ransomware generally changes the extension on encrypted files.
Processes:
Endermanch@WannaCrypt0r.exedescription ioc process File created C:\Users\Admin\Pictures\BlockRestart.png.WNCRYT Endermanch@WannaCrypt0r.exe File created C:\Users\Admin\Pictures\EnableConvertTo.png.WNCRYT Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\MergeImport.tiff.WNCRY Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\BlockRestart.png.WNCRYT => C:\Users\Admin\Pictures\BlockRestart.png.WNCRY Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\BlockRestart.png.WNCRY Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\EnableConvertTo.png.WNCRYT => C:\Users\Admin\Pictures\EnableConvertTo.png.WNCRY Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\EnableConvertTo.png.WNCRY Endermanch@WannaCrypt0r.exe File created C:\Users\Admin\Pictures\MergeImport.tiff.WNCRYT Endermanch@WannaCrypt0r.exe File renamed C:\Users\Admin\Pictures\MergeImport.tiff.WNCRYT => C:\Users\Admin\Pictures\MergeImport.tiff.WNCRY Endermanch@WannaCrypt0r.exe File opened for modification C:\Users\Admin\Pictures\MergeImport.tiff Endermanch@WannaCrypt0r.exe -
Drops startup file 1 IoCs
Processes:
Endermanch@WannaCrypt0r.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8D86.tmp Endermanch@WannaCrypt0r.exe -
Executes dropped EXE 50 IoCs
Processes:
ChromeRecovery.exetaskdl.exe@WanaDecryptor@.exe@WanaDecryptor@.exetaskhsvc.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskse.exe@WanaDecryptor@.exetaskdl.exetaskdl.exetaskdl.exetaskdl.exepid process 2068 ChromeRecovery.exe 2136 taskdl.exe 2096 @WanaDecryptor@.exe 2068 @WanaDecryptor@.exe 2272 taskhsvc.exe 2208 taskse.exe 2320 @WanaDecryptor@.exe 2868 taskdl.exe 972 taskse.exe 980 @WanaDecryptor@.exe 604 taskdl.exe 1768 taskse.exe 2920 @WanaDecryptor@.exe 2152 taskdl.exe 2864 taskse.exe 2556 @WanaDecryptor@.exe 1052 taskdl.exe 1520 taskse.exe 2160 @WanaDecryptor@.exe 1252 taskdl.exe 2784 taskse.exe 2972 @WanaDecryptor@.exe 1116 taskdl.exe 2036 taskse.exe 2612 @WanaDecryptor@.exe 568 taskdl.exe 2648 taskse.exe 2636 @WanaDecryptor@.exe 1684 taskdl.exe 1860 taskse.exe 2564 @WanaDecryptor@.exe 2940 taskdl.exe 896 taskse.exe 1700 @WanaDecryptor@.exe 1112 taskdl.exe 2912 taskse.exe 912 @WanaDecryptor@.exe 2004 taskdl.exe 956 taskse.exe 2780 @WanaDecryptor@.exe 1576 taskdl.exe 2192 taskse.exe 2156 @WanaDecryptor@.exe 2312 taskdl.exe 2236 taskse.exe 2172 @WanaDecryptor@.exe 2860 taskdl.exe 3000 taskdl.exe 2432 taskdl.exe 896 taskdl.exe -
Loads dropped DLL 56 IoCs
Processes:
Endermanch@WannaCrypt0r.execscript.execmd.exe@WanaDecryptor@.exetaskhsvc.exepid process 2996 Endermanch@WannaCrypt0r.exe 2160 cscript.exe 2996 Endermanch@WannaCrypt0r.exe 268 cmd.exe 2096 @WanaDecryptor@.exe 2096 @WanaDecryptor@.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe 2996 Endermanch@WannaCrypt0r.exe -
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\cccyglfkpf608 = "\"C:\\Users\\Admin\\Desktop\\tasksche.exe\"" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
Processes:
Endermanch@WannaCrypt0r.exe@WanaDecryptor@.exe@WanaDecryptor@.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" Endermanch@WannaCrypt0r.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" @WanaDecryptor@.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@WanaDecryptor@.bmp" @WanaDecryptor@.exe -
Drops file in Program Files directory 7 IoCs
Processes:
elevation_service.exedescription ioc process File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\manifest.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\manifest.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\_metadata\verified_contents.json elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\_metadata\verified_contents.json elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecoveryCRX.crx elevation_service.exe File created C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecovery.exe elevation_service.exe File opened for modification C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecovery.exe elevation_service.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
chrome.exeEXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer chrome.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName chrome.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
Processes:
vssadmin.exepid process 2576 vssadmin.exe -
Processes:
iexplore.exeEXCEL.EXEIEXPLORE.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete\C:\Users\Admin\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{300EBD83-A72E-11ED-AE00-66C13449FA90}.dat = "0" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingDelete iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MINIE iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{300EBD81-A72E-11ED-AE00-66C13449FA90} = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" EXCEL.EXE -
Modifies registry key 1 TTPs 1 IoCs
-
Opens file in notepad (likely ransom note) 1 IoCs
Processes:
NOTEPAD.EXEpid process 2968 NOTEPAD.EXE -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
vlc.exeEXCEL.EXEpid process 1268 vlc.exe 2736 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 33 IoCs
Processes:
chrome.exechrome.exechrome.exechrome.exechrome.exetaskmgr.exetaskhsvc.exepid process 1820 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 2980 chrome.exe 3004 chrome.exe 2116 chrome.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2272 taskhsvc.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2272 taskhsvc.exe 2272 taskhsvc.exe -
Suspicious behavior: GetForegroundWindowSpam 4 IoCs
Processes:
taskmgr.exevlc.exemsconfig.exe@WanaDecryptor@.exepid process 2092 taskmgr.exe 1268 vlc.exe 3052 msconfig.exe 2636 @WanaDecryptor@.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
AUDIODG.EXEtaskmgr.exevssvc.exeWMIC.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exedescription pid process Token: 33 1716 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1716 AUDIODG.EXE Token: 33 1716 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1716 AUDIODG.EXE Token: SeDebugPrivilege 2092 taskmgr.exe Token: SeBackupPrivilege 2192 vssvc.exe Token: SeRestorePrivilege 2192 vssvc.exe Token: SeAuditPrivilege 2192 vssvc.exe Token: SeIncreaseQuotaPrivilege 3060 WMIC.exe Token: SeSecurityPrivilege 3060 WMIC.exe Token: SeTakeOwnershipPrivilege 3060 WMIC.exe Token: SeLoadDriverPrivilege 3060 WMIC.exe Token: SeSystemProfilePrivilege 3060 WMIC.exe Token: SeSystemtimePrivilege 3060 WMIC.exe Token: SeProfSingleProcessPrivilege 3060 WMIC.exe Token: SeIncBasePriorityPrivilege 3060 WMIC.exe Token: SeCreatePagefilePrivilege 3060 WMIC.exe Token: SeBackupPrivilege 3060 WMIC.exe Token: SeRestorePrivilege 3060 WMIC.exe Token: SeShutdownPrivilege 3060 WMIC.exe Token: SeDebugPrivilege 3060 WMIC.exe Token: SeSystemEnvironmentPrivilege 3060 WMIC.exe Token: SeRemoteShutdownPrivilege 3060 WMIC.exe Token: SeUndockPrivilege 3060 WMIC.exe Token: SeManageVolumePrivilege 3060 WMIC.exe Token: 33 3060 WMIC.exe Token: 34 3060 WMIC.exe Token: 35 3060 WMIC.exe Token: SeIncreaseQuotaPrivilege 3060 WMIC.exe Token: SeSecurityPrivilege 3060 WMIC.exe Token: SeTakeOwnershipPrivilege 3060 WMIC.exe Token: SeLoadDriverPrivilege 3060 WMIC.exe Token: SeSystemProfilePrivilege 3060 WMIC.exe Token: SeSystemtimePrivilege 3060 WMIC.exe Token: SeProfSingleProcessPrivilege 3060 WMIC.exe Token: SeIncBasePriorityPrivilege 3060 WMIC.exe Token: SeCreatePagefilePrivilege 3060 WMIC.exe Token: SeBackupPrivilege 3060 WMIC.exe Token: SeRestorePrivilege 3060 WMIC.exe Token: SeShutdownPrivilege 3060 WMIC.exe Token: SeDebugPrivilege 3060 WMIC.exe Token: SeSystemEnvironmentPrivilege 3060 WMIC.exe Token: SeRemoteShutdownPrivilege 3060 WMIC.exe Token: SeUndockPrivilege 3060 WMIC.exe Token: SeManageVolumePrivilege 3060 WMIC.exe Token: 33 3060 WMIC.exe Token: 34 3060 WMIC.exe Token: 35 3060 WMIC.exe Token: SeTcbPrivilege 2208 taskse.exe Token: SeTcbPrivilege 2208 taskse.exe Token: SeTcbPrivilege 972 taskse.exe Token: SeTcbPrivilege 972 taskse.exe Token: SeTcbPrivilege 1768 taskse.exe Token: SeTcbPrivilege 1768 taskse.exe Token: SeTcbPrivilege 2864 taskse.exe Token: SeTcbPrivilege 2864 taskse.exe Token: SeTcbPrivilege 1520 taskse.exe Token: SeTcbPrivilege 1520 taskse.exe Token: SeTcbPrivilege 2784 taskse.exe Token: SeTcbPrivilege 2784 taskse.exe Token: SeTcbPrivilege 2036 taskse.exe Token: SeTcbPrivilege 2036 taskse.exe Token: SeTcbPrivilege 2648 taskse.exe Token: SeTcbPrivilege 2648 taskse.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
iexplore.exechrome.exetaskmgr.exepid process 1728 iexplore.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
chrome.exetaskmgr.exepid process 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 1392 chrome.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe 2092 taskmgr.exe -
Suspicious use of SetWindowsHookEx 38 IoCs
Processes:
iexplore.exeIEXPLORE.EXE@WanaDecryptor@.exe@WanaDecryptor@.exetaskmgr.exe@WanaDecryptor@.exexpsrchvw.exevlc.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exeEXCEL.EXE@WanaDecryptor@.exe@WanaDecryptor@.exemsconfig.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exe@WanaDecryptor@.exepid process 1728 iexplore.exe 1728 iexplore.exe 1160 IEXPLORE.EXE 1160 IEXPLORE.EXE 2096 @WanaDecryptor@.exe 2068 @WanaDecryptor@.exe 2068 @WanaDecryptor@.exe 2096 @WanaDecryptor@.exe 2092 taskmgr.exe 2320 @WanaDecryptor@.exe 2320 @WanaDecryptor@.exe 2172 xpsrchvw.exe 2172 xpsrchvw.exe 2172 xpsrchvw.exe 2172 xpsrchvw.exe 1268 vlc.exe 980 @WanaDecryptor@.exe 2920 @WanaDecryptor@.exe 2556 @WanaDecryptor@.exe 2160 @WanaDecryptor@.exe 2972 @WanaDecryptor@.exe 2612 @WanaDecryptor@.exe 2636 @WanaDecryptor@.exe 2636 @WanaDecryptor@.exe 2736 EXCEL.EXE 2736 EXCEL.EXE 2736 EXCEL.EXE 2736 EXCEL.EXE 2564 @WanaDecryptor@.exe 2736 EXCEL.EXE 2736 EXCEL.EXE 1700 @WanaDecryptor@.exe 3052 msconfig.exe 3052 msconfig.exe 912 @WanaDecryptor@.exe 2780 @WanaDecryptor@.exe 2156 @WanaDecryptor@.exe 2172 @WanaDecryptor@.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
iexplore.exechrome.exedescription pid process target process PID 1728 wrote to memory of 1160 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1160 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1160 1728 iexplore.exe IEXPLORE.EXE PID 1728 wrote to memory of 1160 1728 iexplore.exe IEXPLORE.EXE PID 1392 wrote to memory of 1688 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1688 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1688 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1724 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1820 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1820 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1820 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe PID 1392 wrote to memory of 1884 1392 chrome.exe chrome.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://google.com1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1728 CREDAT:275457 /prefetch:22⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe"1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=89.0.4389.114 --initial-client-data=0xc0,0xc4,0xc8,0x94,0xcc,0x7fef63b4f50,0x7fef63b4f60,0x7fef63b4f702⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1116 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=network --mojo-platform-channel-handle=1276 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1784 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --use-gl=swiftshader-webgl --mojo-platform-channel-handle=3260 /prefetch:22⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=956 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3476 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3592 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3888 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3964 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4072 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3872 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4132 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4148 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4492 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3904 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3864 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4260 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4228 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2220 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2464 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1740 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1820 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1716 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1732 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1756 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4432 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2204 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3480 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=500 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=540 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3028 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4772 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1820 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4724 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5052 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4900 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --disable-gpu-compositing --lang=en-US --extension-process --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:12⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4860 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2364 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3484 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=4976 /prefetch:82⤵
-
C:\Program Files\Google\Chrome\Application\chrome.exe"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --field-trial-handle=1096,4814424167763940600,16304758325614269997,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=5244 /prefetch:82⤵
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4581⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"C:\Program Files\Google\Chrome\Application\89.0.4389.114\elevation_service.exe"1⤵
- Drops file in Program Files directory
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecovery.exe"C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecovery.exe" --appguid={8A69D345-D564-463c-AFF1-A69D9E530F96} --browser-version=89.0.4389.114 --sessionid={0d39c646-3f44-4df2-bf59-380dfce19268} --system2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\Endermanch@WannaCrypt0r.exe"C:\Users\Admin\Desktop\Endermanch@WannaCrypt0r.exe"1⤵
- Modifies extensions of user files
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd /c 293021675805528.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
- Loads dropped DLL
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe co2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b @WanaDecryptor@.exe vs2⤵
- Loads dropped DLL
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe vs3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\vssadmin.exevssadmin delete shadows /all /quiet5⤵
- Interacts with shadow copies
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cccyglfkpf608" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "cccyglfkpf608" /t REG_SZ /d "\"C:\Users\Admin\Desktop\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskse.exetaskse.exe C:\Users\Admin\Desktop\@WanaDecryptor@.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe@WanaDecryptor@.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\Desktop\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\xpsrchvw.exe"C:\Windows\System32\xpsrchvw.exe" "C:\Users\Admin\Desktop\PublishNew.edrwx"1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\VideoLAN\VLC\vlc.exe"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\RenameUpdate.m1v"1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\NOTEPAD.EXE"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\dieog.txt1⤵
- Opens file in notepad (likely ransom note)
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde1⤵
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵
-
C:\Windows\system32\msconfig.exe"C:\Windows\system32\msconfig.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl1⤵
-
C:\Windows\System32\rundll32.exe"C:\Windows\System32\rundll32.exe" C:\Windows\System32\shell32.dll,Control_RunDLL C:\Windows\System32\timedate.cpl1⤵
-
C:\Users\Admin\Desktop\taskdl.exe"C:\Users\Admin\Desktop\taskdl.exe"1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files\Google\Chrome\ChromeRecovery\scoped_dir1720_493069948\ChromeRecovery.exeFilesize
253KB
MD549ac3c96d270702a27b4895e4ce1f42a
SHA155b90405f1e1b72143c64113e8bc65608dd3fd76
SHA25682aa3fd6a25cda9e16689cfadea175091be010cecae537e517f392e0bef5ba0f
SHA512b62f6501cb4c992d42d9097e356805c88ac4ac5a46ead4a8eee9f8cbae197b2305da8aab5b4a61891fe73951588025f2d642c32524b360687993f98c913138a0
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.jsFilesize
531KB
MD56eebed29e6a6301e92a9b8b347807f5f
SHA165dfb69b650560551110b33dcba50b25e5b876de
SHA25604cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
SHA512fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.jsFilesize
255KB
MD51709b6f00a136241185161aa3df46a06
SHA133da7d262ffed1a5c2d85b7390e9dbc830cbe494
SHA2565721a4b3f8e09c869a629effd350b51c9d46f0ac136717d4db6265c0ee6f9ac8
SHA51226835b4c050f53ad2ddb84469df9a84bbb2786a655ab52dfc20b54bedcb81d1ecd789198d5b7d8b940242e5ceac818a177444d402397ae82c203438c4b1d19cb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.dbFilesize
28KB
MD502e63f9dda664051c5f8e5f8825885c4
SHA173b86a36f30c94143b60f599d73898c02d33093b
SHA2561c57909ca621ab927b31aca493155754d389daecb5713f027d0e1bb54aeae860
SHA512754b1142320db002599c458ffab80d97ca7a4602fc405cd08423639284af06a966ffdd65147fa84fc31055d49d36b22ff08ec849349769497c00b5fc7704febb
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\heavy_ad_intervention_opt_out.dbFilesize
16KB
MD59a8e0fb6cf4941534771c38bb54a76be
SHA192d45ac2cc921f6733e68b454dc171426ec43c1c
SHA2569ee9211a57c3f6fa211fe0323fa8cd521e7cbffcd8ff0896645a45795dc472be
SHA51212ed22537dcc79d53f6c7d39e92a38f8fea076d793198928f5b7a5dd1234d50a3c0b4815632f3fadf8bc4ef0499773d22bd83f961d2d0ffd8afacf471bd3a5ae
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\previews_opt_out.dbFilesize
16KB
MD5d926f072b41774f50da6b28384e0fed1
SHA1237dfa5fa72af61f8c38a1e46618a4de59bd6f10
SHA2564f7b0e525d4bfc53d5df49589e25a0bccf2fcf6a1a0ca3f94d3285bb9cf0a249
SHA512a140df6ec0d3099ef374e8f3ece09bf91bc896ac4a1d251799a521543fe9bdea796ba09fa47932bd54fa939118495078f9258557b32c31d3d4011b0666a4723f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\RecoveryImproved\1.3.36.141\Recovery.crx3Filesize
141KB
MD5ea1c1ffd3ea54d1fb117bfdbb3569c60
SHA110958b0f690ae8f5240e1528b1ccffff28a33272
SHA2567c3a6a7d16ac44c3200f572a764bce7d8fa84b9572dd028b15c59bdccbc0a77d
SHA5126c30728cac9eac53f0b27b7dbe2222da83225c3b63617d6b271a6cfedf18e8f0a8dffa1053e1cbc4c5e16625f4bbc0d03aa306a946c9d72faa4ceb779f8ffcaf
-
C:\Users\Admin\Desktop\293021675805528.batFilesize
318B
MD5b741d0951bc2d29318d75208913ea377
SHA1a13de54ccfbd4ea29d9f78b86615b028bd50d0a5
SHA256595dc1b7a6f1d7933c2d142d773e445dbc7b1a2089243b51193bc7f730b1c8df
SHA512bf7b44ba7f0cfe093b24f26b288b715c0f0910fa7dc5f318edfc5c4fdc8c9b8a3b6ced5b61672ecfa9820ffd054b5bc2650ae0812804d2b3fc901aa06dd3ca14
-
C:\Users\Admin\Desktop\293021675805528.batFilesize
318B
MD5ff1b76ef1a6fc43dfdfaad2b4feb8d32
SHA19fb5876f1071b8dd48ec7d6a2606283cbfb19ef5
SHA25682e5d30aa84260c0217cde2b48bc0aa050919514d139a6b73055c2e64b0375e0
SHA51236bcae3ac13220cdc021f4c9d7288e50fa6f2a5a28e654067bfe5656622fd823d7193d7211a0d1d9af6605294be68cda74c1813d2839d5c62ec9675463e27100
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exeFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
C:\Users\Admin\Desktop\@WanaDecryptor@.exe.lnkFilesize
472B
MD569d20664a84dc19053232a28af7d1694
SHA14ecf45f07e45b437daa492bb64cb8903ff0778ce
SHA256bb7a4d2ae844d7b16c05eef5dff8a5ecc31392be1b3edba8b898db0f30e52db6
SHA512877dd3390a9e316cfd85b7e081b7fced4dbbf76fd93ecb8b5bc9b28ebfef809aa268630063af387221ecf3d0a72fbdfb70a1ee96cd4e98d880e62e41971858e1
-
C:\Users\Admin\Desktop\m.vbsFilesize
197B
MD594bdc24abf89cb36e00816911e6ae19e
SHA187335eea1d8eb1d70e715cc88daf248bb1f83021
SHA256e9757f002a632de82ff9bd1283f90bcff2eec4ce6926f8b7e37879ff0c518660
SHA5123bec73a3c6360499bb280aec0562157cda47c8ed11e3b1280c4fb8a457ab48dc1f3aea42d6a0d5c2842d60ca09436da96ef7136c0652d2b5c613fae87799ac0f
-
C:\Users\Admin\Desktop\taskdl.exeFilesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
\??\PIPE\wkssvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\??\pipe\crashpad_1392_HCICRJTFFFNWYPDNMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\Desktop\@WanaDecryptor@.exeFilesize
240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
\Users\Admin\Desktop\taskdl.exeFilesize
20KB
MD54fef5e34143e646dbf9907c4374276f5
SHA147a9ad4125b6bd7c55e4e7da251e23f089407b8f
SHA2564a468603fdcb7a2eb5770705898cf9ef37aade532a7964642ecd705a74794b79
SHA5124550dd1787deb353ebd28363dd2cdccca861f6a5d9358120fa6aa23baa478b2a9eb43cef5e3f6426f708a0753491710ac05483fac4a046c26bec4234122434d5
-
memory/268-87-0x0000000000000000-mapping.dmp
-
memory/568-147-0x0000000000000000-mapping.dmp
-
memory/604-126-0x0000000000000000-mapping.dmp
-
memory/896-189-0x0000000000000000-mapping.dmp
-
memory/896-164-0x0000000000000000-mapping.dmp
-
memory/912-171-0x0000000000000000-mapping.dmp
-
memory/956-174-0x0000000000000000-mapping.dmp
-
memory/972-123-0x0000000000000000-mapping.dmp
-
memory/980-124-0x0000000000000000-mapping.dmp
-
memory/1052-135-0x0000000000000000-mapping.dmp
-
memory/1112-168-0x0000000000000000-mapping.dmp
-
memory/1116-143-0x0000000000000000-mapping.dmp
-
memory/1252-139-0x0000000000000000-mapping.dmp
-
memory/1520-136-0x0000000000000000-mapping.dmp
-
memory/1576-178-0x0000000000000000-mapping.dmp
-
memory/1684-151-0x0000000000000000-mapping.dmp
-
memory/1700-165-0x0000000000000000-mapping.dmp
-
memory/1768-128-0x0000000000000000-mapping.dmp
-
memory/1860-157-0x0000000000000000-mapping.dmp
-
memory/2004-173-0x0000000000000000-mapping.dmp
-
memory/2004-71-0x0000000000000000-mapping.dmp
-
memory/2036-144-0x0000000000000000-mapping.dmp
-
memory/2068-57-0x0000000000000000-mapping.dmp
-
memory/2068-59-0x0000000075781000-0x0000000075783000-memory.dmpFilesize
8KB
-
memory/2068-89-0x0000000000000000-mapping.dmp
-
memory/2072-55-0x000007FEFB721000-0x000007FEFB723000-memory.dmpFilesize
8KB
-
memory/2092-108-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2092-109-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2092-92-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2092-91-0x0000000140000000-0x00000001405E8000-memory.dmpFilesize
5.9MB
-
memory/2096-86-0x0000000000000000-mapping.dmp
-
memory/2108-62-0x0000000000000000-mapping.dmp
-
memory/2136-69-0x0000000000000000-mapping.dmp
-
memory/2144-118-0x0000000000000000-mapping.dmp
-
memory/2152-131-0x0000000000000000-mapping.dmp
-
memory/2156-180-0x0000000000000000-mapping.dmp
-
memory/2160-137-0x0000000000000000-mapping.dmp
-
memory/2160-73-0x0000000000000000-mapping.dmp
-
memory/2172-121-0x00000000FF7A1000-0x00000000FF7A3000-memory.dmpFilesize
8KB
-
memory/2172-184-0x0000000000000000-mapping.dmp
-
memory/2192-179-0x0000000000000000-mapping.dmp
-
memory/2208-114-0x0000000000000000-mapping.dmp
-
memory/2212-105-0x0000000000000000-mapping.dmp
-
memory/2236-183-0x0000000000000000-mapping.dmp
-
memory/2272-101-0x0000000073B90000-0x0000000073C12000-memory.dmpFilesize
520KB
-
memory/2272-103-0x0000000000B00000-0x0000000000DFE000-memory.dmpFilesize
3.0MB
-
memory/2272-112-0x0000000073B90000-0x0000000073C12000-memory.dmpFilesize
520KB
-
memory/2272-111-0x0000000073C20000-0x0000000073E3C000-memory.dmpFilesize
2.1MB
-
memory/2272-110-0x0000000073EE0000-0x0000000073F62000-memory.dmpFilesize
520KB
-
memory/2272-93-0x0000000000000000-mapping.dmp
-
memory/2272-104-0x0000000000B00000-0x0000000000DFE000-memory.dmpFilesize
3.0MB
-
memory/2272-113-0x0000000000B00000-0x0000000000DFE000-memory.dmpFilesize
3.0MB
-
memory/2272-102-0x0000000073B60000-0x0000000073B82000-memory.dmpFilesize
136KB
-
memory/2272-100-0x0000000073C20000-0x0000000073E3C000-memory.dmpFilesize
2.1MB
-
memory/2272-99-0x0000000073EE0000-0x0000000073F62000-memory.dmpFilesize
520KB
-
memory/2272-98-0x0000000073B60000-0x0000000073B82000-memory.dmpFilesize
136KB
-
memory/2272-97-0x0000000073B90000-0x0000000073C12000-memory.dmpFilesize
520KB
-
memory/2272-96-0x0000000073C20000-0x0000000073E3C000-memory.dmpFilesize
2.1MB
-
memory/2272-95-0x0000000073EE0000-0x0000000073F62000-memory.dmpFilesize
520KB
-
memory/2312-182-0x0000000000000000-mapping.dmp
-
memory/2320-115-0x0000000000000000-mapping.dmp
-
memory/2340-116-0x0000000000000000-mapping.dmp
-
memory/2556-133-0x0000000000000000-mapping.dmp
-
memory/2564-158-0x0000000000000000-mapping.dmp
-
memory/2576-106-0x0000000000000000-mapping.dmp
-
memory/2612-145-0x0000000000000000-mapping.dmp
-
memory/2636-149-0x0000000000000000-mapping.dmp
-
memory/2648-148-0x0000000000000000-mapping.dmp
-
memory/2736-160-0x0000000071D5D000-0x0000000071D68000-memory.dmpFilesize
44KB
-
memory/2736-162-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2736-163-0x0000000071D5D000-0x0000000071D68000-memory.dmpFilesize
44KB
-
memory/2736-156-0x0000000071D5D000-0x0000000071D68000-memory.dmpFilesize
44KB
-
memory/2736-154-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2736-152-0x000000002F851000-0x000000002F854000-memory.dmpFilesize
12KB
-
memory/2736-153-0x0000000070D71000-0x0000000070D73000-memory.dmpFilesize
8KB
-
memory/2780-175-0x0000000000000000-mapping.dmp
-
memory/2784-140-0x0000000000000000-mapping.dmp
-
memory/2860-187-0x0000000000000000-mapping.dmp
-
memory/2864-132-0x0000000000000000-mapping.dmp
-
memory/2868-119-0x0000000000000000-mapping.dmp
-
memory/2912-170-0x0000000000000000-mapping.dmp
-
memory/2920-129-0x0000000000000000-mapping.dmp
-
memory/2940-161-0x0000000000000000-mapping.dmp
-
memory/2972-141-0x0000000000000000-mapping.dmp
-
memory/2996-64-0x0000000010000000-0x0000000010010000-memory.dmpFilesize
64KB
-
memory/3000-188-0x0000000000000000-mapping.dmp
-
memory/3024-61-0x0000000000000000-mapping.dmp
-
memory/3060-107-0x0000000000000000-mapping.dmp