chaos | 24266d8af5e54a179ca62fe8ba586a9bced5e39565ad05f33583a3fc8f509613

pid	Process
1528	bcdedit.exe
1408	bcdedit.exe

Renames multiple (193) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
1764	wbadmin.exe

Drops startup file 3 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\meleaicara.txt	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
2652	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\Sample Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\Sample Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\Accessibility\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\Sample Videos\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-2248906074-2862704502-246302768-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links for United States\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\F:	perfmon.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\tlsx3binf.jpg"	svchost.exe

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\pss\desktop.ini.cursoDFIR.Startup	msconfig.exe
File created	C:\Windows\pss\boot.backup	msconfig.exe
File opened for modification	C:\Windows\pss\svchost.url.Startup	msconfig.exe
File created	C:\Windows\pss\svchost.url.Startup	msconfig.exe
File opened for modification	C:\Windows\pss\meleaicara.txt.Startup	msconfig.exe
File created	C:\Windows\pss\meleaicara.txt.Startup	msconfig.exe
File opened for modification	C:\Windows\pss\desktop.ini.cursoDFIR.Startup	msconfig.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 11 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	perfmon.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key opened	\Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0	perfmon.exe

Enumerates system info in registry 2 TTPs 32 IoCs

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier	csrss.exe
Key enumerated	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data	csrss.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter	csrss.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2	csrss.exe
Key queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral	csrss.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
2404	vssadmin.exe

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\DefaultTokenId = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech\\AudioOutput\\TokenEnums\\MMAudioOut\\"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\Attributes\Vendor = "Microsoft"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\Attributes\Technology = "MMSys"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}\Files	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\System	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\DeviceId = "{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\ = "Current User Lexicon"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}\Files\Datafile = "%1a%\\Microsoft\\Speech\\Files\\UserLexicons\\SP_0C7BF35DD75A4C0B9B7C29DCE1506329.dat"	utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\Generation = "0"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AppLexicons	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles"	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\Voices\DefaultTokenId = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech\\Voices\\Tokens\\MS-Anna-1033-20-DSK"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\AppLexicons	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\PhoneConverters	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\PhoneConverters\DefaultTokenId = "HKEY_LOCAL_MACHINE\\SOFTWARE\\Microsoft\\Speech\\PhoneConverters\\Tokens\\English"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\ = "Speakers (High Definition Audio Device)"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\CLSID = "{A8C680EB-3D32-11D2-9EE7-00C04F797396}"	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\DeviceName = "Speakers (High Definition Audio Device)"	utilman.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000	winlogon.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize"	winlogon.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\{C9E37C15-DF92-4727-85D6-72E5EEB6995A}	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\AudioOutput\TokenEnums\MMAudioOut\{0.0.0.00000000}.{8064d2fe-e02b-49ca-b0d4-b85553918655}\Attributes	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\Voices	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon	utilman.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Speech\CurrentUserLexicon\CLSID = "{C9E37C15-DF92-4727-85D6-72E5EEB6995A}"	utilman.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	utilman.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	utilman.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file\shell	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file\shell\open\command	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file\	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.cursoDFIR\ = "cursoDFIR_auto_file"	rundll32.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\.cursoDFIR	rundll32.exe
Key created	\REGISTRY\USER\S-1-5-21-2248906074-2862704502-246302768-1000_CLASSES\cursoDFIR_auto_file\shell\open	rundll32.exe

Opens file in notepad (likely ransom note) 3 IoCs

pid	Process
208	Notepad.exe
1360	NOTEPAD.EXE
852	NOTEPAD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2652	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
2652	svchost.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
1532	taskmgr.exe
1684	msconfig.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
Token: SeDebugPrivilege	2652	svchost.exe
Token: SeBackupPrivilege	1456	vssvc.exe
Token: SeRestorePrivilege	1456	vssvc.exe
Token: SeAuditPrivilege	1456	vssvc.exe
Token: SeIncreaseQuotaPrivilege	352	WMIC.exe
Token: SeSecurityPrivilege	352	WMIC.exe
Token: SeTakeOwnershipPrivilege	352	WMIC.exe
Token: SeLoadDriverPrivilege	352	WMIC.exe
Token: SeSystemProfilePrivilege	352	WMIC.exe
Token: SeSystemtimePrivilege	352	WMIC.exe
Token: SeProfSingleProcessPrivilege	352	WMIC.exe
Token: SeIncBasePriorityPrivilege	352	WMIC.exe
Token: SeCreatePagefilePrivilege	352	WMIC.exe
Token: SeBackupPrivilege	352	WMIC.exe
Token: SeRestorePrivilege	352	WMIC.exe
Token: SeShutdownPrivilege	352	WMIC.exe
Token: SeDebugPrivilege	352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	352	WMIC.exe
Token: SeRemoteShutdownPrivilege	352	WMIC.exe
Token: SeUndockPrivilege	352	WMIC.exe
Token: SeManageVolumePrivilege	352	WMIC.exe
Token: 33	352	WMIC.exe
Token: 34	352	WMIC.exe
Token: 35	352	WMIC.exe
Token: SeIncreaseQuotaPrivilege	352	WMIC.exe
Token: SeSecurityPrivilege	352	WMIC.exe
Token: SeTakeOwnershipPrivilege	352	WMIC.exe
Token: SeLoadDriverPrivilege	352	WMIC.exe
Token: SeSystemProfilePrivilege	352	WMIC.exe
Token: SeSystemtimePrivilege	352	WMIC.exe
Token: SeProfSingleProcessPrivilege	352	WMIC.exe
Token: SeIncBasePriorityPrivilege	352	WMIC.exe
Token: SeCreatePagefilePrivilege	352	WMIC.exe
Token: SeBackupPrivilege	352	WMIC.exe
Token: SeRestorePrivilege	352	WMIC.exe
Token: SeShutdownPrivilege	352	WMIC.exe
Token: SeDebugPrivilege	352	WMIC.exe
Token: SeSystemEnvironmentPrivilege	352	WMIC.exe
Token: SeRemoteShutdownPrivilege	352	WMIC.exe
Token: SeUndockPrivilege	352	WMIC.exe
Token: SeManageVolumePrivilege	352	WMIC.exe
Token: 33	352	WMIC.exe
Token: 34	352	WMIC.exe
Token: 35	352	WMIC.exe
Token: SeBackupPrivilege	2792	wbengine.exe
Token: SeRestorePrivilege	2792	wbengine.exe
Token: SeSecurityPrivilege	2792	wbengine.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	780	firefox.exe
Token: SeDebugPrivilege	1532	taskmgr.exe
Token: 33	2748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2748	AUDIODG.EXE
Token: 33	2748	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2748	AUDIODG.EXE
Token: SeDebugPrivilege	308	perfmon.exe
Token: SeSystemProfilePrivilege	308	perfmon.exe
Token: SeCreateGlobalPrivilege	308	perfmon.exe
Token: 33	308	perfmon.exe
Token: SeIncBasePriorityPrivilege	308	perfmon.exe
Token: SeBackupPrivilege	1684	msconfig.exe
Token: SeRestorePrivilege	1684	msconfig.exe
Token: SeRestorePrivilege	1684	msconfig.exe
Token: SeRestorePrivilege	1684	msconfig.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
780	firefox.exe
780	firefox.exe
780	firefox.exe
780	firefox.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
780	firefox.exe
780	firefox.exe
780	firefox.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe
1532	taskmgr.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1684	msconfig.exe
1684	msconfig.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 2652	1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe	28
PID 1772 wrote to memory of 2652	1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe	28
PID 1772 wrote to memory of 2652	1772	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe	28
PID 2652 wrote to memory of 2336	2652	svchost.exe	30
PID 2652 wrote to memory of 2336	2652	svchost.exe	30
PID 2652 wrote to memory of 2336	2652	svchost.exe	30
PID 2336 wrote to memory of 2404	2336	cmd.exe	32
PID 2336 wrote to memory of 2404	2336	cmd.exe	32
PID 2336 wrote to memory of 2404	2336	cmd.exe	32
PID 2336 wrote to memory of 352	2336	cmd.exe	35
PID 2336 wrote to memory of 352	2336	cmd.exe	35
PID 2336 wrote to memory of 352	2336	cmd.exe	35
PID 2652 wrote to memory of 2372	2652	svchost.exe	37
PID 2652 wrote to memory of 2372	2652	svchost.exe	37
PID 2652 wrote to memory of 2372	2652	svchost.exe	37
PID 2372 wrote to memory of 1528	2372	cmd.exe	39
PID 2372 wrote to memory of 1528	2372	cmd.exe	39
PID 2372 wrote to memory of 1528	2372	cmd.exe	39
PID 2372 wrote to memory of 1408	2372	cmd.exe	40
PID 2372 wrote to memory of 1408	2372	cmd.exe	40
PID 2372 wrote to memory of 1408	2372	cmd.exe	40
PID 2652 wrote to memory of 1596	2652	svchost.exe	41
PID 2652 wrote to memory of 1596	2652	svchost.exe	41
PID 2652 wrote to memory of 1596	2652	svchost.exe	41
PID 1596 wrote to memory of 1764	1596	cmd.exe	43
PID 1596 wrote to memory of 1764	1596	cmd.exe	43
PID 1596 wrote to memory of 1764	1596	cmd.exe	43
PID 2652 wrote to memory of 852	2652	svchost.exe	47
PID 2652 wrote to memory of 852	2652	svchost.exe	47
PID 2652 wrote to memory of 852	2652	svchost.exe	47
PID 1680 wrote to memory of 1380	1680	rundll32.exe	50
PID 1680 wrote to memory of 1380	1680	rundll32.exe	50
PID 1680 wrote to memory of 1380	1680	rundll32.exe	50
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 1380 wrote to memory of 780	1380	firefox.exe	51
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53
PID 780 wrote to memory of 2656	780	firefox.exe	53

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2652
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2336
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:2404
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:352
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:2372
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1528
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1408
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1596
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:1764
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\meleaicara.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:852

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1456

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2792

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:2988

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
PID:676

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" C:\Windows\system32\shell32.dll,OpenAs_RunDLL C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk.cursoDFIR
1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk.cursoDFIR"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1380
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Windows Explorer.lnk.cursoDFIR"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.0.1046664796\1583614084" -parentBuildID 20221007134813 -prefsHandle 1384 -prefMapHandle 1516 -prefsLen 18084 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74225a2d-8a3a-44c5-a4a2-50d9aeb94d4c} 780 "\\.\pipe\gecko-crash-server-pipe.780" 1412 f5eec58 socket
      4⤵
      Checks processor information in registry
      PID:2656
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.1.1601989058\1115634708" -parentBuildID 20221007134813 -prefsHandle 1576 -prefMapHandle 1560 -prefsLen 18674 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eff806d6-c496-4341-a6ff-d3ac7f901ede} 780 "\\.\pipe\gecko-crash-server-pipe.780" 1608 13a6cd58 gpu
      4⤵
      PID:3032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.2.502564822\711807374" -childID 1 -isForBrowser -prefsHandle 2332 -prefMapHandle 1948 -prefsLen 20508 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bbcfb029-f1f9-4ac3-83cf-a6eaed604797} 780 "\\.\pipe\gecko-crash-server-pipe.780" 2352 1808d258 tab
      4⤵
      PID:1672
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.3.2091218554\1641418166" -childID 2 -isForBrowser -prefsHandle 2792 -prefMapHandle 2520 -prefsLen 20615 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f24645b2-7f96-4067-a4b2-2edf79c82ecc} 780 "\\.\pipe\gecko-crash-server-pipe.780" 2640 1b703558 tab
      4⤵
      PID:2020
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.4.1948653173\1257622670" -childID 3 -isForBrowser -prefsHandle 2844 -prefMapHandle 2840 -prefsLen 20692 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {b7e542ca-3b0c-4b05-b4f8-187bdfa2c8eb} 780 "\\.\pipe\gecko-crash-server-pipe.780" 3080 1bb81558 tab
      4⤵
      PID:2132
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.5.245674310\2139562577" -parentBuildID 20221007134813 -prefsHandle 3052 -prefMapHandle 2744 -prefsLen 21627 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {db8ddccf-673f-40c7-bbd6-6d827970b1e4} 780 "\\.\pipe\gecko-crash-server-pipe.780" 3108 1d0d7658 rdd
      4⤵
      PID:2004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.6.748069679\1092184462" -childID 4 -isForBrowser -prefsHandle 1076 -prefMapHandle 3512 -prefsLen 27895 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {be265d91-c9f1-49ae-b7fa-28f43af77d4b} 780 "\\.\pipe\gecko-crash-server-pipe.780" 952 1c3ac258 tab
      4⤵
      PID:2680
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.7.1749288035\1773537972" -childID 5 -isForBrowser -prefsHandle 3796 -prefMapHandle 3792 -prefsLen 27895 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {85907a5f-c39e-46fe-8233-baad05e29613} 780 "\\.\pipe\gecko-crash-server-pipe.780" 3808 1fd1ca58 tab
      4⤵
      PID:1240
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.8.989285524\1917635000" -childID 6 -isForBrowser -prefsHandle 3740 -prefMapHandle 3736 -prefsLen 27895 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {9a3ae372-cde4-4546-a057-ac0ed71b4c17} 780 "\\.\pipe\gecko-crash-server-pipe.780" 3764 217fb558 tab
      4⤵
      PID:3044
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="780.9.404268204\433675358" -childID 7 -isForBrowser -prefsHandle 3148 -prefMapHandle 1504 -prefsLen 28089 -prefMapSize 231738 -jsInitHandle 848 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {907f8611-051f-4ad4-bd4a-6d4b0fe10806} 780 "\\.\pipe\gecko-crash-server-pipe.780" 3480 22ea4258 tab
      4⤵
      PID:2364

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\UseWatch.vbe"
1⤵
PID:1576

C:\Windows\System32\Notepad.exe
"C:\Windows\System32\Notepad.exe" C:\Users\Admin\Desktop\UseWatch.vbe
1⤵
- Opens file in notepad (likely ransom note)
PID:208

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\PushRegister.bat" "
1⤵
PID:2036

C:\Windows\system32\cmd.exe
cmd /c ""C:\Users\Admin\Desktop\PushRegister.bat" "
1⤵
PID:1664

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Desktop\PushRegister.bat
1⤵
- Opens file in notepad (likely ransom note)
PID:1360

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1532
- C:\Windows\System32\perfmon.exe
  "C:\Windows\System32\perfmon.exe" /res
  2⤵
  - Enumerates connected drives
  - Checks processor information in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:308

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x51c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2748

C:\Windows\system32\msconfig.exe
"C:\Windows\system32\msconfig.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1684

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:992

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Enumerates system info in registry
PID:668

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Modifies data under HKEY_USERS
PID:2520
- C:\Windows\system32\LogonUI.exe
  "LogonUI.exe" /flags:0x0
  2⤵
  PID:1272
- C:\Windows\system32\utilman.exe
  utilman.exe /debug
  2⤵
  - Modifies data under HKEY_USERS
  PID:2108
- C:\Windows\system32\utilman.exe
  utilman.exe /debug
  2⤵
  PID:2444

C:\Windows\SysWOW64\DllHost.exe
C:\Windows\SysWOW64\DllHost.exe /Processid:{3F6B5E16-092A-41ED-930B-0B4125D91D4E}
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery