troldesh | hxxps://github[.]com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r[.]zip

Modify Registry

Processes:

unregmp2.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\Software\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\DontAsk = "2"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Version = "12,0,19041,1266"	unregmp2.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\IsInstalled = "0"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\>{22d6f312-b0f6-11d0-94ab-0080c74c7e95}\Stubpath = "%SystemRoot%\\system32\\unregmp2.exe /ShowWMP"	unregmp2.exe

Drops startup file 4 IoCs

Processes:

[email protected][email protected]taskmgr.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD262.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD278.tmp	[email protected]
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LOGON.exe	[email protected]
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\logon.exe	taskmgr.exe

Executes dropped EXE 54 IoCs

Processes:

pid	process
6120	taskdl.exe
1348	@[email protected]
5876	@[email protected]
6136	taskhsvc.exe
5308	taskdl.exe
4416	taskse.exe
64	@[email protected]
5100	@[email protected]
5232	taskdl.exe
3164	taskse.exe
3260	@[email protected]
3732	@[email protected]
5724	@[email protected]
5572	taskdl.exe
4552	taskse.exe
860	@[email protected]
5720	taskse.exe
2544	@[email protected]
4732	taskdl.exe
2320	taskse.exe
4792	@[email protected]
2460	taskdl.exe
5852	taskse.exe
5720	@[email protected]
5364	taskdl.exe
1104	taskse.exe
5620	@[email protected]
3956	taskdl.exe
1000	taskse.exe
1624	@[email protected]
3352	taskdl.exe
4236	taskse.exe
5560	@[email protected]
5844	taskdl.exe
4900	taskse.exe
452	@[email protected]
3596	taskdl.exe
4544	taskse.exe
3516	@[email protected]
1604	taskdl.exe
3164	taskse.exe
3104	@[email protected]
2488	taskdl.exe
1836	taskse.exe
1900	@[email protected]
4376	taskdl.exe
4172	taskse.exe
116	@[email protected]
3476	taskdl.exe
3388	taskse.exe
5416	@[email protected]
3724	taskdl.exe
1908	@[email protected]
5072	@[email protected]

Loads dropped DLL 6 IoCs

Processes:

taskhsvc.exe

pid process

6136 taskhsvc.exe
6136 taskhsvc.exe
6136 taskhsvc.exe
6136 taskhsvc.exe
6136 taskhsvc.exe
6136 taskhsvc.exe
Modifies file permissions 1 TTPs 1 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

icacls.exe

pid process

5740 icacls.exe

pid	process
5740	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

Modify Registry

Processes:

reg.exe[email protected]

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\taapvrhdejs190 = "\"C:\\Users\\Admin\\Downloads\\WannaCrypt0r\\tasksche.exe\""	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client Server Runtime Subsystem = "\"C:\\ProgramData\\Windows\\csrss.exe\""	[email protected]

Drops desktop.ini file(s) 8 IoCs

Processes:

unregmp2.exewmplayer.exe

description	ioc	process
File opened for modification	C:\ProgramData\Microsoft\Windows\Start Menu\Programs\desktop.ini	unregmp2.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	wmplayer.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	wmplayer.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

unregmp2.exewmplayer.exe

description	ioc	process
File opened (read-only)	\??\V:	unregmp2.exe
File opened (read-only)	\??\Y:	unregmp2.exe
File opened (read-only)	\??\P:	wmplayer.exe
File opened (read-only)	\??\V:	wmplayer.exe
File opened (read-only)	\??\H:	unregmp2.exe
File opened (read-only)	\??\K:	unregmp2.exe
File opened (read-only)	\??\B:	wmplayer.exe
File opened (read-only)	\??\J:	wmplayer.exe
File opened (read-only)	\??\A:	unregmp2.exe
File opened (read-only)	\??\Z:	unregmp2.exe
File opened (read-only)	\??\R:	unregmp2.exe
File opened (read-only)	\??\S:	wmplayer.exe
File opened (read-only)	\??\W:	wmplayer.exe
File opened (read-only)	\??\B:	unregmp2.exe
File opened (read-only)	\??\G:	unregmp2.exe
File opened (read-only)	\??\M:	unregmp2.exe
File opened (read-only)	\??\I:	wmplayer.exe
File opened (read-only)	\??\Z:	wmplayer.exe
File opened (read-only)	\??\I:	unregmp2.exe
File opened (read-only)	\??\L:	unregmp2.exe
File opened (read-only)	\??\T:	unregmp2.exe
File opened (read-only)	\??\X:	unregmp2.exe
File opened (read-only)	\??\E:	wmplayer.exe
File opened (read-only)	\??\H:	wmplayer.exe
File opened (read-only)	\??\N:	unregmp2.exe
File opened (read-only)	\??\S:	unregmp2.exe
File opened (read-only)	\??\P:	unregmp2.exe
File opened (read-only)	\??\A:	wmplayer.exe
File opened (read-only)	\??\K:	wmplayer.exe
File opened (read-only)	\??\R:	wmplayer.exe
File opened (read-only)	\??\X:	wmplayer.exe
File opened (read-only)	\??\E:	unregmp2.exe
File opened (read-only)	\??\J:	unregmp2.exe
File opened (read-only)	\??\M:	wmplayer.exe
File opened (read-only)	\??\N:	wmplayer.exe
File opened (read-only)	\??\O:	unregmp2.exe
File opened (read-only)	\??\G:	wmplayer.exe
File opened (read-only)	\??\W:	unregmp2.exe
File opened (read-only)	\??\L:	wmplayer.exe
File opened (read-only)	\??\O:	wmplayer.exe
File opened (read-only)	\??\Q:	wmplayer.exe
File opened (read-only)	\??\T:	wmplayer.exe
File opened (read-only)	\??\U:	wmplayer.exe
File opened (read-only)	\??\Q:	unregmp2.exe
File opened (read-only)	\??\U:	unregmp2.exe
File opened (read-only)	\??\Y:	wmplayer.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 12 IoCs

Web Service

T1102

Processes:

flow	ioc
261	camo.githubusercontent.com
281	raw.githubusercontent.com
282	raw.githubusercontent.com
283	raw.githubusercontent.com
43	raw.githubusercontent.com
44	raw.githubusercontent.com
45	raw.githubusercontent.com
262	camo.githubusercontent.com
266	camo.githubusercontent.com
286	raw.githubusercontent.com
293	raw.githubusercontent.com
42	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

[email protected]@[email protected]@[email protected]

Processes:

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 1 IoCs

Processes:

unregmp2.exe

description ioc process

File opened for modification C:\Program Files\Windows Media Player\wmplayer.exe unregmp2.exe

description	ioc	process
File opened for modification	C:\Program Files\Windows Media Player\wmplayer.exe	unregmp2.exe

Drops file in Windows directory 4 IoCs

Processes:

mspaint.exemspaint.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe
File opened for modification	C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\Microsoft\UPnP Device Host\upnphost\udhisapi.dll	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

taskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Modifies Internet Explorer settings 1 TTPs 34 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXEAcroRd32.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "3712377748"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000516244317b44ad49b8c99564e34e94d300000000020000000000106600000001000020000000a97b889641449e4c56d29737c702d0e3ecd9846c6aa78f19ae1952a23854358f000000000e8000000002000020000000ad932442d7d00bb108d800ec4e42c338052186c2707c680256032c2fca4336012000000090dea2585a311089cd407b5852091d61acd27e31824dae988b395eb83787e23c4000000077d22fd54e3414b0e8597928b592a4a1d12eeb2f90d0743d9116813ceb607a531b154a19d33930c7757fe08c31a380772980ec25768b0bc1807b49f2a4ca71bc	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\IESettingSync\SlowSettingTypesChanged = "2"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31097982"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{08C72E46-F072-11EE-BC8C-E6EAA244CDA6} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\IESettingSync	IEXPLORE.EXE
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = a031d1e17e84da01	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "3712377748"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000516244317b44ad49b8c99564e34e94d30000000002000000000010660000000100002000000073cc86724126c8eef75e6571ae0ee875105b497a80b12055fa4b45f02eea13f5000000000e8000000002000020000000ec710ba7dcbf06ab07545c2bbd0ef83262d0abaae4fbf16f7003e062fae8021220000000c49ecd009fcf622c856f06bf481e71725222a951973bbd1853b86adef2ab9187400000006cf4c9002a0b93bb367be19c34d811ccc9261b3fec8ab0a7fd55c3d2d9a4a48187bd85500f3295b35fc7066cac1f7cd2f84cc1ba41159b270eaddff7b4d7fa00	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 30fbeae17e84da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.19041.546\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31097982"	iexplore.exe

Modifies registry class 64 IoCs

Processes:

unregmp2.exevlc.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 010000000200000000000000ffffffff	vlc.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-817259280-2658881748-983986378-1000\{61C00781-2D87-4D80-B0EE-F33250315997}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByKey:FMTID = "{00000000-0000-0000-0000-000000000000}"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1092616193"	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{17FC1A80-140E-4290-A64F-4A29A951A867}\ = "Open Media Sharing Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Sort = 000000000000000000000000000000000100000030f125b7ef471a10a5f102608c9eebac0a00000001000000	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupByKey:PID = "14"	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo\ = "{7AD84985-87B4-4a16-BE58-8B72A5B390F7}"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\GroupView = "4294967295"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\FFlags = "1"	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\NeverDefault	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\NeverDefault	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\1	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Enqueue\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\command	unregmp2.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\command	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\KnownFolderDerivedFolderType = "{885A186E-A440-4ADA-812B-DB871B942259}"	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\command\DelegateExecute = "{45597c98-80f6-4549-84ff-752cf55e2d29}"	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\GroupByDirection = "1"	vlc.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\NetworkExplorerPlugins\urn:schemas-upnp-org:device:MediaRenderer:1\ShellEx\ContextMenuHandlers\{A45AEC2B-549E-405F-AF3E-C6B03C4FDFBF}\ = "Toggle DMR Authorization Handler"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\ = "&Add to Windows Media Player list"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Enqueue	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Key created	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Play\command\DelegateExecute = "{ed1d0fdf-4414-470a-a56d-cfb68623fc58}"	unregmp2.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\Shell\SniffedFolderType = "Documents"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02020202	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play	unregmp2.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 020000000100000000000000ffffffff	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Audio\shell\Play\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9801"	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\IconSize = "16"	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\image\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Audio\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Image\shell\Enqueue\MUIVerb = "@%SystemRoot%\\system32\\unregmp2.exe,-9800"	unregmp2.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\NodeSlot = "3"	vlc.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\Shell\SniffedFolderType = "Downloads"	vlc.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\2\MRUListEx = ffffffff	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\Mode = "4"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\3\ComDlg\{7D49D726-3C21-4F05-99AA-FDC2C9474656}\FFlags = "1092616193"	vlc.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-817259280-2658881748-983986378-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\Bags\4\ComDlg\{885A186E-A440-4ADA-812B-DB871B942259}\LogicalViewMode = "1"	vlc.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Stack.Video\shellex\ContextMenuHandlers\PlayTo	unregmp2.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SystemFileAssociations\Directory.Image\shell\Play\ = "&Play with Windows Media Player"	unregmp2.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

2308 reg.exe
Runs .reg file with regedit 1 IoCs

Processes:

regedit.exe

pid process

3304 regedit.exe
Suspicious behavior: AddClipboardFormatListener 1 IoCs

Processes:

vlc.exe

pid process

5568 vlc.exe

pid	process
2308	reg.exe

pid	process
3304	regedit.exe

pid	process
5568	vlc.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

taskhsvc.exetaskmgr.exe

pid	process
6136	taskhsvc.exe
6136	taskhsvc.exe
6136	taskhsvc.exe
6136	taskhsvc.exe
6136	taskhsvc.exe
6136	taskhsvc.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

Processes:

taskmgr.exevlc.exe

pid process

1596 taskmgr.exe
5568 vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

taskse.exeWMIC.exetaskmgr.exevssvc.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exetaskse.exe

description	pid	process
Token: SeTcbPrivilege	4416	taskse.exe
Token: SeTcbPrivilege	4416	taskse.exe
Token: SeIncreaseQuotaPrivilege	2060	WMIC.exe
Token: SeSecurityPrivilege	2060	WMIC.exe
Token: SeTakeOwnershipPrivilege	2060	WMIC.exe
Token: SeLoadDriverPrivilege	2060	WMIC.exe
Token: SeSystemProfilePrivilege	2060	WMIC.exe
Token: SeSystemtimePrivilege	2060	WMIC.exe
Token: SeProfSingleProcessPrivilege	2060	WMIC.exe
Token: SeIncBasePriorityPrivilege	2060	WMIC.exe
Token: SeCreatePagefilePrivilege	2060	WMIC.exe
Token: SeBackupPrivilege	2060	WMIC.exe
Token: SeRestorePrivilege	2060	WMIC.exe
Token: SeShutdownPrivilege	2060	WMIC.exe
Token: SeDebugPrivilege	2060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2060	WMIC.exe
Token: SeRemoteShutdownPrivilege	2060	WMIC.exe
Token: SeUndockPrivilege	2060	WMIC.exe
Token: SeManageVolumePrivilege	2060	WMIC.exe
Token: 33	2060	WMIC.exe
Token: 34	2060	WMIC.exe
Token: 35	2060	WMIC.exe
Token: 36	2060	WMIC.exe
Token: SeIncreaseQuotaPrivilege	2060	WMIC.exe
Token: SeSecurityPrivilege	2060	WMIC.exe
Token: SeTakeOwnershipPrivilege	2060	WMIC.exe
Token: SeLoadDriverPrivilege	2060	WMIC.exe
Token: SeSystemProfilePrivilege	2060	WMIC.exe
Token: SeSystemtimePrivilege	2060	WMIC.exe
Token: SeProfSingleProcessPrivilege	2060	WMIC.exe
Token: SeIncBasePriorityPrivilege	2060	WMIC.exe
Token: SeCreatePagefilePrivilege	2060	WMIC.exe
Token: SeBackupPrivilege	2060	WMIC.exe
Token: SeRestorePrivilege	2060	WMIC.exe
Token: SeShutdownPrivilege	2060	WMIC.exe
Token: SeDebugPrivilege	2060	WMIC.exe
Token: SeSystemEnvironmentPrivilege	2060	WMIC.exe
Token: SeRemoteShutdownPrivilege	2060	WMIC.exe
Token: SeUndockPrivilege	2060	WMIC.exe
Token: SeManageVolumePrivilege	2060	WMIC.exe
Token: 33	2060	WMIC.exe
Token: 34	2060	WMIC.exe
Token: 35	2060	WMIC.exe
Token: 36	2060	WMIC.exe
Token: SeDebugPrivilege	1596	taskmgr.exe
Token: SeSystemProfilePrivilege	1596	taskmgr.exe
Token: SeCreateGlobalPrivilege	1596	taskmgr.exe
Token: SeBackupPrivilege	4436	vssvc.exe
Token: SeRestorePrivilege	4436	vssvc.exe
Token: SeAuditPrivilege	4436	vssvc.exe
Token: SeTcbPrivilege	3164	taskse.exe
Token: SeTcbPrivilege	3164	taskse.exe
Token: SeTcbPrivilege	4552	taskse.exe
Token: SeTcbPrivilege	4552	taskse.exe
Token: SeTcbPrivilege	5720	taskse.exe
Token: SeTcbPrivilege	5720	taskse.exe
Token: SeTcbPrivilege	2320	taskse.exe
Token: SeTcbPrivilege	2320	taskse.exe
Token: SeTcbPrivilege	5852	taskse.exe
Token: SeTcbPrivilege	5852	taskse.exe
Token: SeTcbPrivilege	1104	taskse.exe
Token: SeTcbPrivilege	1104	taskse.exe
Token: SeTcbPrivilege	1000	taskse.exe
Token: SeTcbPrivilege	1000	taskse.exe

Suspicious use of FindShellTrayWindow 64 IoCs

Processes:

taskmgr.exe@[email protected]

pid	process
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
64	@[email protected]
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

Processes:

taskmgr.exe

pid	process
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe
1596	taskmgr.exe

Suspicious use of SetWindowsHookEx 47 IoCs

Processes:

@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]AcroRd32.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]iexplore.exeIEXPLORE.EXEvlc.exe@[email protected]@[email protected]mspaint.exemspaint.exeOpenWith.exe@[email protected]@[email protected]@[email protected]@[email protected]@[email protected]

pid	process
1348	@[email protected]
1348	@[email protected]
5876	@[email protected]
5876	@[email protected]
64	@[email protected]
64	@[email protected]
5100	@[email protected]
3260	@[email protected]
3732	@[email protected]
5724	@[email protected]
5864	AcroRd32.exe
5864	AcroRd32.exe
5864	AcroRd32.exe
5864	AcroRd32.exe
860	@[email protected]
5864	AcroRd32.exe
2544	@[email protected]
4792	@[email protected]
5720	@[email protected]
5720	@[email protected]
5620	@[email protected]
1624	@[email protected]
5560	@[email protected]
452	@[email protected]
3388	iexplore.exe
3388	iexplore.exe
4736	IEXPLORE.EXE
4736	IEXPLORE.EXE
4736	IEXPLORE.EXE
5568	vlc.exe
3516	@[email protected]
5568	vlc.exe
3104	@[email protected]
1968	mspaint.exe
1968	mspaint.exe
1968	mspaint.exe
1968	mspaint.exe
5116	mspaint.exe
5116	mspaint.exe
5116	mspaint.exe
5116	mspaint.exe
2404	OpenWith.exe
1900	@[email protected]
116	@[email protected]
5416	@[email protected]
1908	@[email protected]
5072	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

[email protected]cmd.execmd.exe@[email protected]cmd.exe@[email protected]cmd.exeAcroRd32.exeRdrCEF.exe

description	pid	process	target process
PID 5508 wrote to memory of 5732	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 5732	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 5732	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 5740	5508	[email protected]	icacls.exe
PID 5508 wrote to memory of 5740	5508	[email protected]	icacls.exe
PID 5508 wrote to memory of 5740	5508	[email protected]	icacls.exe
PID 5508 wrote to memory of 6120	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 6120	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 6120	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 4792	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 4792	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 4792	5508	[email protected]	cmd.exe
PID 4792 wrote to memory of 5248	4792	cmd.exe	cscript.exe
PID 4792 wrote to memory of 5248	4792	cmd.exe	cscript.exe
PID 4792 wrote to memory of 5248	4792	cmd.exe	cscript.exe
PID 5508 wrote to memory of 5964	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 5964	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 5964	5508	[email protected]	attrib.exe
PID 5508 wrote to memory of 1348	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 1348	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 1348	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 5680	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 5680	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 5680	5508	[email protected]	cmd.exe
PID 5680 wrote to memory of 5876	5680	cmd.exe	@[email protected]
PID 5680 wrote to memory of 5876	5680	cmd.exe	@[email protected]
PID 5680 wrote to memory of 5876	5680	cmd.exe	@[email protected]
PID 1348 wrote to memory of 6136	1348	@[email protected]	taskhsvc.exe
PID 1348 wrote to memory of 6136	1348	@[email protected]	taskhsvc.exe
PID 1348 wrote to memory of 6136	1348	@[email protected]	taskhsvc.exe
PID 5508 wrote to memory of 5308	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 5308	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 5308	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 4416	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 4416	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 4416	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 64	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 64	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 64	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 1448	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 1448	5508	[email protected]	cmd.exe
PID 5508 wrote to memory of 1448	5508	[email protected]	cmd.exe
PID 1448 wrote to memory of 2308	1448	cmd.exe	reg.exe
PID 1448 wrote to memory of 2308	1448	cmd.exe	reg.exe
PID 1448 wrote to memory of 2308	1448	cmd.exe	reg.exe
PID 5876 wrote to memory of 2628	5876	@[email protected]	cmd.exe
PID 5876 wrote to memory of 2628	5876	@[email protected]	cmd.exe
PID 5876 wrote to memory of 2628	5876	@[email protected]	cmd.exe
PID 2628 wrote to memory of 2060	2628	cmd.exe	WMIC.exe
PID 2628 wrote to memory of 2060	2628	cmd.exe	WMIC.exe
PID 2628 wrote to memory of 2060	2628	cmd.exe	WMIC.exe
PID 5508 wrote to memory of 5232	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 5232	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 5232	5508	[email protected]	taskdl.exe
PID 5508 wrote to memory of 3164	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 3164	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 3164	5508	[email protected]	taskse.exe
PID 5508 wrote to memory of 3260	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 3260	5508	[email protected]	@[email protected]
PID 5508 wrote to memory of 3260	5508	[email protected]	@[email protected]
PID 5864 wrote to memory of 4884	5864	AcroRd32.exe	RdrCEF.exe
PID 5864 wrote to memory of 4884	5864	AcroRd32.exe	RdrCEF.exe
PID 5864 wrote to memory of 4884	5864	AcroRd32.exe	RdrCEF.exe
PID 4884 wrote to memory of 4632	4884	RdrCEF.exe	RdrCEF.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

5732 attrib.exe
5964 attrib.exe

pid	process
5732	attrib.exe
5964	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/raw/master/ransomwares/WannaCrypt0r.zip
1⤵
PID:2624

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --mojo-platform-channel-handle=4536 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --mojo-platform-channel-handle=5348 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=5680 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=20 --mojo-platform-channel-handle=6040 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:2024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --no-appcompat-clear --mojo-platform-channel-handle=6148 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:1096

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --mojo-platform-channel-handle=6284 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:1436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6544 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:4976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6724 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:2216

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6740 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:1172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --no-appcompat-clear --mojo-platform-channel-handle=6552 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:4408

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x31c 0x4c8
1⤵
PID:1216

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:216

C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- Suspicious use of WriteProcessMemory
PID:5508

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:5732

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:5740

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6120

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 149711712007994.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:4792

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:5248

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:5964

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1348

C:\Users\Admin\Downloads\WannaCrypt0r\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:6136

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
- Suspicious use of WriteProcessMemory
PID:5680

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5876

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- Suspicious use of WriteProcessMemory
PID:2628

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:2060

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5308

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4416

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:64

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "taapvrhdejs190" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
2⤵
- Suspicious use of WriteProcessMemory
PID:1448

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "taapvrhdejs190" /t REG_SZ /d "\"C:\Users\Admin\Downloads\WannaCrypt0r\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:2308

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5232

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3164

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3260

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5572

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4552

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:860

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5720

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2544

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4732

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2320

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4792

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2460

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5852

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:5720

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5364

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5620

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3956

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1000

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1624

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3352

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:4236

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5560

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5844

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:4900

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:452

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3596

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:4544

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3516

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1604

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:3164

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3104

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:2488

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:1836

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1900

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:4376

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:4172

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:116

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3476

C:\Users\Admin\Downloads\WannaCrypt0r\taskse.exe
taskse.exe C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
2⤵
- Executes dropped EXE
PID:3388

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5416

C:\Users\Admin\Downloads\WannaCrypt0r\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:3724

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:1908

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5072

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
1⤵
PID:5608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --no-appcompat-clear --mojo-platform-channel-handle=2688 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:5656

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1596

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4436

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5100

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3732

C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]
"C:\Users\Admin\Downloads\WannaCrypt0r\@[email protected]"
1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5724

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5864

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:4884

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=DAB716C790C174A9033712132250E45E --mojo-platform-channel-handle=1760 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4632

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=A6216E1D13B37DF041999024057FC71F --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=A6216E1D13B37DF041999024057FC71F --renderer-client-id=2 --mojo-platform-channel-handle=1768 --allow-no-sandbox-job /prefetch:1
3⤵
PID:6076

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=7AC8F2B624487CE0A172FDF9D8FD3740 --mojo-platform-channel-handle=2308 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5532

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4CA9C342EFD54B56C6BD5ECC348D5644 --mojo-platform-channel-handle=2428 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3236

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=1335479B92F2F34D471D01E60343AC2D --mojo-platform-channel-handle=2488 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:5332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:6012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=6468 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:2308

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --mojo-platform-channel-handle=6020 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:5064

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=30 --mojo-platform-channel-handle=3820 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:6020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=6128 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
- Modifies registry class
PID:5712

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --mojo-platform-channel-handle=7084 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:5312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --mojo-platform-channel-handle=7112 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:532

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\74f68da551774d7fb6cd86e470359469 /t 1836 /p 64
1⤵
PID:5816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --mojo-platform-channel-handle=5800 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:2976

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --mojo-platform-channel-handle=7128 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:3032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=36 --mojo-platform-channel-handle=7296 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:5940

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=5588 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:6024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7592 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:1616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --no-appcompat-clear --disable-gpu-compositing --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=39 --mojo-platform-channel-handle=3100 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:1
1⤵
PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --mojo-platform-channel-handle=7756 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:5344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --no-appcompat-clear --mojo-platform-channel-handle=7776 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:5936

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
1⤵
PID:736

C:\Program Files (x86)\Windows Media Player\setup_wm.exe
"C:\Program Files (x86)\Windows Media Player\setup_wm.exe" /RunOnce:"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Play -Embedding
2⤵
PID:3388

C:\Windows\SysWOW64\unregmp2.exe
C:\Windows\system32\unregmp2.exe /ShowWMP /SetShowState /CreateMediaLibrary
3⤵
PID:4004

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /ShowWMP /SetShowState /CreateMediaLibrary /REENTRANT
4⤵
- Modifies Installed Components in the registry
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Modifies registry class
PID:2320

C:\Program Files (x86)\Windows Media Player\wmplayer.exe
"C:\Program Files (x86)\Windows Media Player\wmplayer.exe" /Relaunch /Play C:\Users\Admin\Desktop\SuspendDeny.wmx
3⤵
- Drops desktop.ini file(s)
- Enumerates connected drives
PID:4396

C:\Windows\SysWOW64\unregmp2.exe
"C:\Windows\System32\unregmp2.exe" /AsyncFirstLogon
2⤵
PID:5420

C:\Windows\system32\unregmp2.exe
"C:\Windows\SysNative\unregmp2.exe" /AsyncFirstLogon /REENTRANT
3⤵
- Enumerates connected drives
PID:1092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation -p -s upnphost
1⤵
- Drops file in Windows directory
PID:4924

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3388

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:3388 CREDAT:17410 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4736

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe"
1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5568

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConvertToApprove.emf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:1968

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:5560

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\ConvertToApprove.emf"
1⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
PID:5116

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2404

C:\Windows\regedit.exe
"regedit.exe" "C:\Users\Admin\Desktop\ExportMeasure.reg"
1⤵
- Runs .reg file with regedit
PID:3304

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=7372 --field-trial-handle=2256,i,5035714022000286426,16259316383734940314,262144 --variations-seed-version /prefetch:8
1⤵
PID:5832

C:\Users\Admin\Downloads\DeriaLock\[email protected]
"C:\Users\Admin\Downloads\DeriaLock\[email protected]"
1⤵
- Drops startup file
PID:1000

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
- Adds Run key to start application
PID:4108

C:\Users\Admin\Downloads\NoMoreRansom\[email protected]
"C:\Users\Admin\Downloads\NoMoreRansom\[email protected]"
1⤵
PID:5524

C:\Windows\explorer.exe
explorer.exe
1⤵
PID:4212

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

Defense Evasion

File and Directory Permissions Modification

T1222

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery