chaos | 24266d8af5e54a179ca62fe8ba586a9bced5e39565ad05f33583a3fc8f509613

pid	Process
1020	bcdedit.exe
1316	bcdedit.exe

Renames multiple (185) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Deletes backup catalog 3 TTPs 1 IoCs

Uses wbadmin.exe to inhibit system recovery.

Command and Scripting Interpreter

T1059

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
4624	wbadmin.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\International\Geo\Nation	svchost.exe

Drops startup file 6 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\meleaicara.txt	svchost.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\desktop.ini.cursodfir	taskmgr.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\meleaicara.txt	taskmgr.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\svchost.url	taskmgr.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
3752	svchost.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

UPX packed file 24 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1916-1636-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-1642-0x000000000B2E0000-0x000000000B316000-memory.dmp	upx
behavioral1/memory/1916-1639-0x000000000B2E0000-0x000000000B316000-memory.dmp	upx
behavioral1/memory/1916-1643-0x000000000B2E0000-0x000000000B316000-memory.dmp	upx
behavioral1/memory/1916-1645-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-1651-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-1652-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-1947-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-11389-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-16957-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-33779-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-43264-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-59039-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-59073-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-66831-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-78126-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-78158-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-84226-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-91871-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-99405-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-99410-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-99427-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-99429-0x0000000000400000-0x0000000000692000-memory.dmp	upx
behavioral1/memory/1916-99470-0x0000000000400000-0x0000000000692000-memory.dmp	upx

Drops desktop.ini file(s) 34 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	svchost.exe
File opened for modification	F:\$RECYCLE.BIN\S-1-5-21-3270530367-132075249-2153716227-1000\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\System Tools\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessibility\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Libraries\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\AccountPictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Administrative Tools\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\SendTo\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Maintenance\Desktop.ini	svchost.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	svchost.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	svchost.exe

Enumerates connected drives 3 TTPs 13 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
File opened (read-only)	\??\M:	avz.exe
File opened (read-only)	\??\O:	avz.exe
File opened (read-only)	\??\P:	avz.exe
File opened (read-only)	\??\E:	avz.exe
File opened (read-only)	\??\H:	avz.exe
File opened (read-only)	\??\I:	avz.exe
File opened (read-only)	\??\L:	avz.exe
File opened (read-only)	\??\G:	avz.exe
File opened (read-only)	\??\J:	avz.exe
File opened (read-only)	\??\K:	avz.exe
File opened (read-only)	\??\N:	avz.exe
File opened (read-only)	\??\Q:	avz.exe
File opened (read-only)	\??\R:	avz.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\mog0op56g.jpg"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	vds.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\FriendlyName	vds.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	vds.exe

Checks processor information in registry 2 TTPs 13 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Interacts with shadow copies 2 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

File Deletion

T1070.004

Inhibit System Recovery

pid	Process
4768	vssadmin.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "54"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe

Modifies registry class 12 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	svchost.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\cursoDFIR_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\cursoDFIR_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\.cursoDFIR	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\cursoDFIR_auto_file	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\.cursoDFIR\ = "cursoDFIR_auto_file"	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\cursoDFIR_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\cursoDFIR_auto_file\shell\open\command	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	firefox.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\simpleunlocker_release.zip:Zone.Identifier	firefox.exe

Opens file in notepad (likely ransom note) 1 IoCs

pid	Process
2672	NOTEPAD.EXE

Runs net.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
3752	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
3752	svchost.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2096	SU.exe
1916	avz.exe
1648	SU.exe

Suspicious behavior: LoadsDriver 64 IoCs

pid	Process
1796	Process not Found
3620	Process not Found
4060	Process not Found
4064	Process not Found
5868	Process not Found
1028	Process not Found
3076	Process not Found
2004	Process not Found
4288	Process not Found
3772	Process not Found
5796	Process not Found
3780	Process not Found
2364	Process not Found
4164	Process not Found
5740	Process not Found
5304	Process not Found
5804	Process not Found
1328	Process not Found
1628	Process not Found
628	Process not Found
112	Process not Found
3632	Process not Found
4500	Process not Found
4508	Process not Found
1760	Process not Found
2248	Process not Found
520	Process not Found
2108	Process not Found
3080	Process not Found
5872	Process not Found
6060	Process not Found
2316	Process not Found
3200	Process not Found
3608	Process not Found
2252	Process not Found
3508	Process not Found
2012	Process not Found
3032	Process not Found
2152	Process not Found
4784	Process not Found
1800	Process not Found
3696	Process not Found
3864	Process not Found
412	Process not Found
1188	Process not Found
6032	Process not Found
2516	Process not Found
5508	Process not Found
5916	Process not Found
3444	Process not Found
5036	Process not Found
5768	Process not Found
3304	Process not Found
5040	Process not Found
4876	Process not Found
64	Process not Found
3116	Process not Found
1848	Process not Found
4516	Process not Found
4768	Process not Found
4344	Process not Found
5500	Process not Found
5048	Process not Found
5448	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
Token: SeDebugPrivilege	3752	svchost.exe
Token: SeBackupPrivilege	3560	vssvc.exe
Token: SeRestorePrivilege	3560	vssvc.exe
Token: SeAuditPrivilege	3560	vssvc.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: 36	1488	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1488	WMIC.exe
Token: SeSecurityPrivilege	1488	WMIC.exe
Token: SeTakeOwnershipPrivilege	1488	WMIC.exe
Token: SeLoadDriverPrivilege	1488	WMIC.exe
Token: SeSystemProfilePrivilege	1488	WMIC.exe
Token: SeSystemtimePrivilege	1488	WMIC.exe
Token: SeProfSingleProcessPrivilege	1488	WMIC.exe
Token: SeIncBasePriorityPrivilege	1488	WMIC.exe
Token: SeCreatePagefilePrivilege	1488	WMIC.exe
Token: SeBackupPrivilege	1488	WMIC.exe
Token: SeRestorePrivilege	1488	WMIC.exe
Token: SeShutdownPrivilege	1488	WMIC.exe
Token: SeDebugPrivilege	1488	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1488	WMIC.exe
Token: SeRemoteShutdownPrivilege	1488	WMIC.exe
Token: SeUndockPrivilege	1488	WMIC.exe
Token: SeManageVolumePrivilege	1488	WMIC.exe
Token: 33	1488	WMIC.exe
Token: 34	1488	WMIC.exe
Token: 35	1488	WMIC.exe
Token: 36	1488	WMIC.exe
Token: SeBackupPrivilege	4032	wbengine.exe
Token: SeRestorePrivilege	4032	wbengine.exe
Token: SeSecurityPrivilege	4032	wbengine.exe
Token: SeDebugPrivilege	3496	firefox.exe
Token: SeDebugPrivilege	3496	firefox.exe
Token: SeDebugPrivilege	5448	taskmgr.exe
Token: SeSystemProfilePrivilege	5448	taskmgr.exe
Token: SeCreateGlobalPrivilege	5448	taskmgr.exe
Token: 33	5448	taskmgr.exe
Token: SeIncBasePriorityPrivilege	5448	taskmgr.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	1456	firefox.exe
Token: SeDebugPrivilege	2096	SU.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
3496	firefox.exe
3496	firefox.exe
3496	firefox.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
5448	taskmgr.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe

Suspicious use of SetWindowsHookEx 44 IoCs

pid	Process
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
1952	OpenWith.exe
3496	firefox.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
5236	OpenWith.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1456	firefox.exe
1976	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 3752	4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe	89
PID 4676 wrote to memory of 3752	4676	2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe	89
PID 3752 wrote to memory of 1576	3752	svchost.exe	95
PID 3752 wrote to memory of 1576	3752	svchost.exe	95
PID 1576 wrote to memory of 4768	1576	cmd.exe	97
PID 1576 wrote to memory of 4768	1576	cmd.exe	97
PID 1576 wrote to memory of 1488	1576	cmd.exe	100
PID 1576 wrote to memory of 1488	1576	cmd.exe	100
PID 3752 wrote to memory of 1616	3752	svchost.exe	102
PID 3752 wrote to memory of 1616	3752	svchost.exe	102
PID 1616 wrote to memory of 1020	1616	cmd.exe	104
PID 1616 wrote to memory of 1020	1616	cmd.exe	104
PID 1616 wrote to memory of 1316	1616	cmd.exe	105
PID 1616 wrote to memory of 1316	1616	cmd.exe	105
PID 3752 wrote to memory of 5104	3752	svchost.exe	106
PID 3752 wrote to memory of 5104	3752	svchost.exe	106
PID 5104 wrote to memory of 4624	5104	cmd.exe	108
PID 5104 wrote to memory of 4624	5104	cmd.exe	108
PID 3752 wrote to memory of 2672	3752	svchost.exe	112
PID 3752 wrote to memory of 2672	3752	svchost.exe	112
PID 1952 wrote to memory of 4396	1952	OpenWith.exe	116
PID 1952 wrote to memory of 4396	1952	OpenWith.exe	116
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 4396 wrote to memory of 3496	4396	firefox.exe	118
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119
PID 3496 wrote to memory of 872	3496	firefox.exe	119

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-20_1b2fdf47aaaccaf622e33cb4dd63e8e2_wannacry.exe"
1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Users\Admin\AppData\Roaming\svchost.exe
  "C:\Users\Admin\AppData\Roaming\svchost.exe"
  2⤵
  - Checks computer location settings
  - Drops startup file
  - Executes dropped EXE
  - Drops desktop.ini file(s)
  - Sets desktop wallpaper using registry
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3752
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C vssadmin delete shadows /all /quiet & wmic shadowcopy delete
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1576
  - - C:\Windows\system32\vssadmin.exe
      vssadmin delete shadows /all /quiet
      4⤵
      Interacts with shadow copies
      PID:4768
  - - C:\Windows\System32\Wbem\WMIC.exe
      wmic shadowcopy delete
      4⤵
      Suspicious use of AdjustPrivilegeToken
      PID:1488
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1616
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} bootstatuspolicy ignoreallfailures
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1020
  - - C:\Windows\system32\bcdedit.exe
      bcdedit /set {default} recoveryenabled no
      4⤵
      Modifies boot configuration data using bcdedit
      PID:1316
- - C:\Windows\System32\cmd.exe
    "C:\Windows\System32\cmd.exe" /C wbadmin delete catalog -quiet
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:5104
  - - C:\Windows\system32\wbadmin.exe
      wbadmin delete catalog -quiet
      4⤵
      Deletes backup catalog
      PID:4624
- - C:\Windows\system32\NOTEPAD.EXE
    "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Roaming\meleaicara.txt
    3⤵
    - Opens file in notepad (likely ransom note)
    PID:2672

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3560

C:\Windows\system32\wbengine.exe
"C:\Windows\system32\wbengine.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4032

C:\Windows\System32\vdsldr.exe
C:\Windows\System32\vdsldr.exe -Embedding
1⤵
PID:1336

C:\Windows\System32\vds.exe
C:\Windows\System32\vds.exe
1⤵
- Checks SCSI registry key(s)
PID:1816

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1952
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.cursoDFIR"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4396
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\File Explorer.lnk.cursoDFIR"
    3⤵
    - Checks processor information in registry
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:3496
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.0.500341941\958433472" -parentBuildID 20221007134813 -prefsHandle 1704 -prefMapHandle 1716 -prefsLen 18084 -prefMapSize 231738 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6f93f6fa-5b2e-438b-8aa6-247d796ffabc} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 1580 2c7cc4f0c58 socket
      4⤵
      Checks processor information in registry
      PID:872
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.1.696496270\374941479" -parentBuildID 20221007134813 -prefsHandle 2396 -prefMapHandle 2380 -prefsLen 18674 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f2495ab2-b524-4a31-af24-6db1cbe9ba32} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 2416 2c7cd266f58 gpu
      4⤵
      PID:2780
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.2.844357347\1395556144" -childID 1 -isForBrowser -prefsHandle 3032 -prefMapHandle 2892 -prefsLen 20415 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1cbc25ee-a314-4f6c-9e70-a651ec8e002c} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 2828 2c7cd267e58 tab
      4⤵
      PID:3808
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.3.240343517\1364595557" -childID 2 -isForBrowser -prefsHandle 3520 -prefMapHandle 3104 -prefsLen 20571 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2694853f-2725-4d64-8591-1ed5c541e568} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 3532 2c7d103bb58 tab
      4⤵
      PID:1004
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.4.1193462989\1399094393" -childID 3 -isForBrowser -prefsHandle 4040 -prefMapHandle 3704 -prefsLen 20648 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {44ba0d74-efe4-4ec2-9542-dcc9497a16a7} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 4020 2c7d13ea358 tab
      4⤵
      PID:1692
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.5.845299077\1343426001" -parentBuildID 20221007134813 -prefsHandle 4356 -prefMapHandle 4352 -prefsLen 21582 -prefMapSize 231738 -appDir "C:\Program Files\Mozilla Firefox\browser" - {adb42448-d317-413e-a6f1-6827710948ac} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 3512 2c7d20ed958 rdd
      4⤵
      PID:4360
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.6.765411667\2043091722" -childID 4 -isForBrowser -prefsHandle 4812 -prefMapHandle 5044 -prefsLen 27247 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {56557ff6-2eaa-4527-919c-326a3f023274} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5064 2c7d1753f58 tab
      4⤵
      PID:6032
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.7.293109283\2088358717" -childID 5 -isForBrowser -prefsHandle 5172 -prefMapHandle 5176 -prefsLen 27595 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77fac601-d261-4b77-badd-96265d94649d} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5180 2c7d4d6c558 tab
      4⤵
      PID:6072
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3496.8.2075311104\564756945" -childID 6 -isForBrowser -prefsHandle 5424 -prefMapHandle 5180 -prefsLen 27630 -prefMapSize 231738 -jsInitHandle 1272 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bffed23a-e59a-422e-9bf9-e3f633c06daf} 3496 "\\.\pipe\gecko-crash-server-pipe.3496" 5428 2c7d4d6e058 tab
      4⤵
      PID:6104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5448

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5236
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk.cursoDFIR"
  2⤵
  PID:5740
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\Firefox.lnk.cursoDFIR"
    3⤵
    - Checks processor information in registry
    - Modifies registry class
    - NTFS ADS
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of SetWindowsHookEx
    PID:1456
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.0.538563172\511107807" -parentBuildID 20221007134813 -prefsHandle 1884 -prefMapHandle 1876 -prefsLen 20804 -prefMapSize 233466 -appDir "C:\Program Files\Mozilla Firefox\browser" - {e2838163-5b58-442d-8d8c-4a6a4671c84b} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 1976 249d4313b58 gpu
      4⤵
      PID:5204
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.1.1460654797\358681706" -parentBuildID 20221007134813 -prefsHandle 2420 -prefMapHandle 2416 -prefsLen 21620 -prefMapSize 233466 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc669536-105c-478b-9cbe-6ebe1cd41b65} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 2444 249d2840358 socket
      4⤵
      PID:2540
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.2.1146108419\1557945912" -childID 1 -isForBrowser -prefsHandle 2968 -prefMapHandle 3140 -prefsLen 21768 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {e9a8a253-7758-4360-bc6d-2473a89e1010} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3320 249d6903858 tab
      4⤵
      PID:5976
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.3.2037622442\1256670691" -childID 2 -isForBrowser -prefsHandle 3572 -prefMapHandle 3568 -prefsLen 26194 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {bd81962b-0747-4233-8ebf-fa3305dbc57b} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3584 249c645b258 tab
      4⤵
      PID:2144
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.4.1111661799\1670656074" -childID 3 -isForBrowser -prefsHandle 4968 -prefMapHandle 4908 -prefsLen 26253 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fbc6ccd2-f4cb-4c91-b8ed-c9ee172b2a06} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 4980 249c642fb58 tab
      4⤵
      PID:4876
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.5.1141946459\900591701" -childID 4 -isForBrowser -prefsHandle 5132 -prefMapHandle 5136 -prefsLen 26253 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0f56f0ad-2206-45d8-ad1f-aad3e0d645f9} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5000 249d9299c58 tab
      4⤵
      PID:5332
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.6.2147104247\1558254938" -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 5332 -prefsLen 26253 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dab80648-150d-44f7-997d-0c49d78c1941} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5320 249d9571c58 tab
      4⤵
      PID:5416
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.7.2132526004\1882626725" -childID 6 -isForBrowser -prefsHandle 4244 -prefMapHandle 4240 -prefsLen 26491 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {31b5159e-02f1-4e1b-b6ce-f8327ba1cabc} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5640 249da2bc658 tab
      4⤵
      PID:5100
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.8.1235485640\2033380030" -parentBuildID 20221007134813 -prefsHandle 6048 -prefMapHandle 4752 -prefsLen 26782 -prefMapSize 233466 -appDir "C:\Program Files\Mozilla Firefox\browser" - {74ac7938-c1a2-46ad-b4bb-57bed952f0c8} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 4108 249d2ca4c58 rdd
      4⤵
      PID:3460
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.9.190633089\1096724542" -childID 7 -isForBrowser -prefsHandle 1620 -prefMapHandle 1672 -prefsLen 26782 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a488b3c-500e-45fd-834f-bd08b8918847} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 5360 249d2c5e158 tab
      4⤵
      PID:4796
  - - C:\Program Files\Mozilla Firefox\firefox.exe
      "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1456.10.921237321\1618221497" -childID 8 -isForBrowser -prefsHandle 5576 -prefMapHandle 3468 -prefsLen 26782 -prefMapSize 233466 -jsInitHandle 1292 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a2a0932-6b5f-441c-aedb-07a3112c4858} 1456 "\\.\pipe\gecko-crash-server-pipe.1456" 3360 249db74c258 tab
      4⤵
      PID:2444

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5496

C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe
"C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2096

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4308
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell
  2⤵
  PID:2032
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user admin 1
    3⤵
    PID:4696
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user admin 1
      4⤵
      PID:1932
- - C:\Windows\system32\net.exe
    "C:\Windows\system32\net.exe" user
    3⤵
    PID:6048
  - - C:\Windows\system32\net1.exe
      C:\Windows\system32\net1 user
      4⤵
      PID:3304

C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe
"C:\Users\Admin\Desktop\simpleunlocker_release\SU.exe"
1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1648
- C:\Users\Admin\Desktop\simpleunlocker_release\othersoftware\avz4\avz.exe
  "C:\Users\Admin\Desktop\simpleunlocker_release\othersoftware\avz4\avz.exe"
  2⤵
  - Enumerates connected drives
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1916

C:\Windows\explorer.exe
"C:\Windows\explorer.exe" shell:::{52205fd8-5dfb-447d-801a-d0b52f2e83e1}
1⤵
PID:628

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
PID:5056

C:\Windows\system32\wbem\WmiApSrv.exe
C:\Windows\system32\wbem\WmiApSrv.exe
1⤵
PID:5420

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3917855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery