wannacry | hxxps://bazaar[.]abuse[.]ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

RedEye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1"	RedEye.exe

UAC bypass 3 TTPs 1 IoCs
evasion trojan

Bypass User Account Control
T1088

Disabling Security Tools
T1089

Modify Registry
T1112

Processes:

RedEye.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RedEye.exe
Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Disables RegEdit via registry modification 2 IoCs

evasion

Processes:

RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe

Disables Task Manager via registry modification
evasion
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Modifies Windows Firewall 1 TTPs 1 IoCs
evasion

Modify Existing Service
T1031

Processes:

NetSh.exe

pid process

4992 NetSh.exe

pid	process
4992	NetSh.exe

Modifies extensions of user files 24 IoCs

Ransomware generally changes the extension on encrypted files.

ransomware

Processes:

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exeRedEye.exe

description	ioc	process
File opened for modification	C:\Users\Admin\Pictures\JoinRestore.tif.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File renamed	C:\Users\Admin\Pictures\UnpublishMeasure.raw.WCRYT => C:\Users\Admin\Pictures\UnpublishMeasure.raw.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishMeasure.raw.WCRY.RedEye	RedEye.exe
File created	C:\Users\Admin\Pictures\HideRepair.tiff.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\RestoreFind.tif.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchStop.png.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\SwitchStop.png.WCRY.RedEye	RedEye.exe
File renamed	C:\Users\Admin\Pictures\JoinRestore.tif.WCRYT => C:\Users\Admin\Pictures\JoinRestore.tif.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\HideRepair.tiff.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File created	C:\Users\Admin\Pictures\JoinRestore.tif.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File created	C:\Users\Admin\Pictures\LockRevoke.png.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File renamed	C:\Users\Admin\Pictures\LockRevoke.png.WCRYT => C:\Users\Admin\Pictures\LockRevoke.png.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File created	C:\Users\Admin\Pictures\UnpublishMeasure.raw.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\UnpublishMeasure.raw.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\HideRepair.tiff.WCRY.RedEye	RedEye.exe
File renamed	C:\Users\Admin\Pictures\HideRepair.tiff.WCRYT => C:\Users\Admin\Pictures\HideRepair.tiff.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\RestoreFind.tif.WCRY.RedEye	RedEye.exe
File opened for modification	C:\Users\Admin\Pictures\JoinRestore.tif.WCRY.RedEye	RedEye.exe
File created	C:\Users\Admin\Pictures\RestoreFind.tif.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File renamed	C:\Users\Admin\Pictures\RestoreFind.tif.WCRYT => C:\Users\Admin\Pictures\RestoreFind.tif.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File created	C:\Users\Admin\Pictures\SwitchStop.png.WCRYT	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File renamed	C:\Users\Admin\Pictures\SwitchStop.png.WCRYT => C:\Users\Admin\Pictures\SwitchStop.png.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\Pictures\LockRevoke.png.WCRY.RedEye	RedEye.exe
File opened for modification	C:\Users\Admin\Pictures\LockRevoke.png.WCRY	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

Sets file execution options in registry 2 TTPs 64 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

RedEye.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.com	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ComboFix.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\powershell.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.scr\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ZAM.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bcdedit.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\a2start.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HitmanPro_x64.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AdwCleaner.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\firefox.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UserAccountControlSettings.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\yandex.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rkill-unsigned64.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill64.scr\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\logoff.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mb3-setup-1878.1878-3.3.1.2183.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedgecp.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad++.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns.exe\Debugger = "RIP"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mspaint.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iExplore64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\notepad.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Autoruns64.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\attrib.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sethc.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rkill.com	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RKill.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\msconfig.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cmd.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\recoverydrive.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\control.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\microsoftedge.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskkill.exe\Debugger = "RIP"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\MSASCuiL.exe\Debugger = "RIP"	RedEye.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RedEye.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation RedEye.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\International\Geo\Nation	RedEye.exe

Drops startup file 2 IoCs

Processes:

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC84.tmp	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC5D.tmp	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

Executes dropped EXE 9 IoCs

Processes:

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeMEMZ Trojan.exeRedEye.exeRedEye.exe

pid	process
4864	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
3708	!WannaDecryptor!.exe
3784	!WannaDecryptor!.exe
3068	!WannaDecryptor!.exe
3600	!WannaDecryptor!.exe
2192	!WannaDecryptor!.exe
4180	MEMZ Trojan.exe
528	RedEye.exe
2092	RedEye.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

Processes:

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exeRedEye.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" /r"	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\Malware-database-main\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\Malware-database-main\\RedEye.exe"	RedEye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\Downloads\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\\Malware-database-main\\RedEye.exe"	RedEye.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs
evasion trojan

System Information Discovery
T1082

Processes:

RedEye.exe

description ioc process

Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" RedEye.exe
Drops autorun.inf file 1 TTPs 2 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media
T1091

Processes:

RedEye.exe

description ioc process

File created C:\autorun.inf RedEye.exe
File opened for modification C:\autorun.inf RedEye.exe

description	ioc	process
File created	C:\autorun.inf	RedEye.exe
File opened for modification	C:\autorun.inf	RedEye.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

!WannaDecryptor!.exeRedEye.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000\Control Panel\Desktop\WallPaper = "C:\\redeyebmp.bmp"	RedEye.exe

Drops file in Windows directory 3 IoCs

Processes:

mspaint.exemspaint.exeRedEye.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\Nope.txt	RedEye.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

System Information Discovery

Processes:

chrome.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Interacts with shadow copies 2 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exevssadmin.exevssadmin.exe

pid process

4824 vssadmin.exe
3568 vssadmin.exe
4612 vssadmin.exe
Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

3464 taskkill.exe
4180 taskkill.exe
3068 taskkill.exe
3316 taskkill.exe

pid	process
4824	vssadmin.exe
3568	vssadmin.exe
4612	vssadmin.exe

pid	process
3464	taskkill.exe
4180	taskkill.exe
3068	taskkill.exe
3316	taskkill.exe

Modifies data under HKEY_USERS 17 IoCs

Processes:

chrome.exeLogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133307097729117043"	chrome.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	chrome.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "15"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

chrome.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings chrome.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

2056 vlc.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-4238149048-355649189-894321705-1000_Classes\Local Settings	chrome.exe

pid	process
2056	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

chrome.exetaskmgr.exechrome.exe

pid	process
2084	chrome.exe
2084	chrome.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1676	chrome.exe
1676	chrome.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

vlc.exe

pid process

2056 vlc.exe
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

Processes:

chrome.exe

pid process

2084 chrome.exe
2084 chrome.exe
2084 chrome.exe
2084 chrome.exe
2084 chrome.exe

pid	process
2056	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

chrome.exe

description	pid	process
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe
Token: SeShutdownPrivilege	2084	chrome.exe
Token: SeCreatePagefilePrivilege	2084	chrome.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

chrome.exe7zG.exetaskmgr.exevlc.exe

pid	process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
708	7zG.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
2056	vlc.exe
2056	vlc.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

chrome.exetaskmgr.exevlc.exe

pid	process
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
2084	chrome.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
2056	vlc.exe
2056	vlc.exe
1748	taskmgr.exe
2056	vlc.exe
2056	vlc.exe
1748	taskmgr.exe
2056	vlc.exe
2056	vlc.exe
2056	vlc.exe
1748	taskmgr.exe
1748	taskmgr.exe
1748	taskmgr.exe
2056	vlc.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exevlc.exemspaint.exemspaint.exe!WannaDecryptor!.exeLogonUI.exe

pid	process
3708	!WannaDecryptor!.exe
3708	!WannaDecryptor!.exe
3784	!WannaDecryptor!.exe
3784	!WannaDecryptor!.exe
3068	!WannaDecryptor!.exe
3068	!WannaDecryptor!.exe
3600	!WannaDecryptor!.exe
3600	!WannaDecryptor!.exe
2056	vlc.exe
4140	mspaint.exe
4140	mspaint.exe
4140	mspaint.exe
4140	mspaint.exe
2116	mspaint.exe
2116	mspaint.exe
2116	mspaint.exe
2116	mspaint.exe
2192	!WannaDecryptor!.exe
4840	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

chrome.exe

description	pid	process	target process
PID 2084 wrote to memory of 180	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 180	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 4172	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 2320	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 2320	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe
PID 2084 wrote to memory of 1732	2084	chrome.exe	chrome.exe

System policy modification 1 TTPs 11 IoCs

evasion

Modify Registry

Processes:

RedEye.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoControlPanel = "1"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDrives = "4"	RedEye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	RedEye.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\WindowsDefenderMAJ = "1"	RedEye.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer	RedEye.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoRun = "1"	RedEye.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" "--simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT'" https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2084

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=106.0.5249.119 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff92b009758,0x7ff92b009768,0x7ff92b009778
2⤵
PID:180

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:2
2⤵
PID:4172

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:2320

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2248 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:1732

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --mojo-platform-channel-handle=3140 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:1
2⤵
PID:2520

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --first-renderer-process --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --mojo-platform-channel-handle=3136 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:1
2⤵
PID:1264

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --mojo-platform-channel-handle=4488 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:1
2⤵
PID:4288

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=8 --mojo-platform-channel-handle=3428 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:1
2⤵
PID:2980

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:4880

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:4496

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:2816

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --display-capture-permissions-policy-allowed --enable-chrome-cart --disable-gpu-compositing --lang=en-US --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --mojo-platform-channel-handle=4400 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:1
2⤵
PID:3184

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAACQAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2816 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1676

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 --field-trial-handle=1812,i,1857490234361159940,11307858594699107266,131072 /prefetch:8
2⤵
PID:5064

C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\106.0.5249.119\elevation_service.exe"
1⤵
PID:5068

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:3628

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\" -spe -an -ai#7zMap999:190:7zEvent10527
1⤵
- Suspicious use of FindShellTrayWindow
PID:708

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"
1⤵
- Modifies extensions of user files
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
PID:4864

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 142561686236217.bat
2⤵
PID:2880

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
PID:4100

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3708

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- Kills process with taskkill
PID:3068

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- Kills process with taskkill
PID:3316

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- Kills process with taskkill
PID:3464

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- Kills process with taskkill
PID:4180

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3784

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
PID:60

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3068

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:4000

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
PID:3316

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:3600

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1748

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\ResizeSend.aifc"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:2056

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4612

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\ConvertExpand.dib"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:748

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Pictures\ConvertFromReset.wmf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:2116

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2192

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\" -spe -an -ai#7zMap28849:190:7zEvent28441
1⤵
PID:4132

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\" -spe -an -ai#7zMap15102:320:7zEvent28282
1⤵
PID:1212

C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\MEMZ Trojan.exe
"C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\MEMZ Trojan.exe"
1⤵
- Executes dropped EXE
PID:4180

C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\RedEye.exe
"C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\RedEye.exe"
1⤵
- Modifies Windows Defender Real-time Protection settings
- UAC bypass
- Disables RegEdit via registry modification
- Modifies extensions of user files
- Sets file execution options in registry
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops autorun.inf file
- Sets desktop wallpaper using registry
- Drops file in Windows directory
- System policy modification
PID:528

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4824

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:3568

C:\Windows\SYSTEM32\vssadmin.exe
vssadmin delete shadows /all /quiet
2⤵
- Interacts with shadow copies
PID:4612

C:\Windows\SYSTEM32\NetSh.exe
NetSh Advfirewall set allprofiles state off
2⤵
- Modifies Windows Firewall
PID:4992

C:\Windows\System32\shutdown.exe
"C:\Windows\System32\shutdown.exe" -r -t 00 -f
2⤵
PID:5112

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4456

C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\RedEye.exe
"C:\Users\Admin\Downloads\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\82e34351115b01948c0ed5ba16337e6ddd3f519a0b6f681061fd5f50f95fda46\Malware-database-main\RedEye.exe"
1⤵
- Executes dropped EXE
PID:2092

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa396c055 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:4840

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Replication Through Removable Media

T1091

Execution

Persistence

Modify Existing Service

T1031

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Modify Registry

Disabling Security Tools

T1089

Bypass User Account Control

T1088

File Deletion

T1107

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

System Information Discovery