Resubmissions
19-12-2024 08:32
241219-kfqvbsxmgl 1019-12-2024 08:29
241219-kd1azswrh1 1019-12-2024 08:22
241219-j9qkzsxkhl 1019-12-2024 08:18
241219-j7clcaxkbl 619-12-2024 08:10
241219-j2wf9swmgz 719-12-2024 07:51
241219-jqbbyswnbq 819-12-2024 07:51
241219-jp8aaswnbm 319-12-2024 07:46
241219-jmcqlswmcm 319-12-2024 07:46
241219-jl6bjavrby 319-12-2024 07:46
241219-jlylpavray 3Analysis
-
max time kernel
551s -
max time network
594s -
platform
windows11-21h2_x64 -
resource
win11-20240221-en -
resource tags
arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system -
submitted
08-04-2024 06:36
Static task
static1
Behavioral task
behavioral1
Sample
b28242123ed2cf6000f0aa036844bd29.dll
Resource
win11-20240221-en
General
-
Target
b28242123ed2cf6000f0aa036844bd29.dll
-
Size
87KB
-
MD5
b28242123ed2cf6000f0aa036844bd29
-
SHA1
915f41a6c59ed743803ea0ddde08927ffd623586
-
SHA256
fd563cf7c0c862ab910cf558b5a123354b616e84902d277edf09f378ff6f9786
-
SHA512
08e5966ca90f08c18c582e6c67d71186a6f9c025fc9f78020e1ce202814de094171111b7f3623d81f7371acdf92206446f7c0425e08e8f5f5b6fd969007d9fca
-
SSDEEP
1536:0A1KsVHBnVJ0T1rFTQHUPx+nVP7ZSRILMZoXyqqEbzPCAdt6rFTc:0A1rVIrFTOUsnVP7sRILgAPCvrFTc
Malware Config
Extracted
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
wannacry
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Signatures
-
Jigsaw Ransomware
Ransomware family first created in 2016. Named based on wallpaper set after infection in the early versions.
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (1480) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA4BA.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA4A3.tmp ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Executes dropped EXE 27 IoCs
pid Process 4788 drpbx.exe 4216 taskdl.exe 3048 @[email protected] 3948 @[email protected] 352 @[email protected] 1688 taskhsvc.exe 2940 @[email protected] 4684 taskse.exe 1452 taskdl.exe 2324 taskdl.exe 2668 taskse.exe 552 @[email protected] 4628 taskse.exe 2024 @[email protected] 3572 taskdl.exe 3256 @[email protected] 3688 taskse.exe 1568 taskdl.exe 1252 taskse.exe 4236 @[email protected] 4888 taskdl.exe 4036 taskse.exe 3944 @[email protected] 124 taskdl.exe 1580 taskse.exe 4564 @[email protected] 1252 taskdl.exe -
Loads dropped DLL 8 IoCs
pid Process 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe -
Modifies file permissions 1 TTPs 1 IoCs
pid Process 1536 icacls.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Software\Microsoft\Windows\CurrentVersion\Run\firefox.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Frfx\\firefox.exe" jigsaw.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\vfjxtaorfuauqli296 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_Ransomware.WannaCry.zip\\tasksche.exe\"" reg.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 6 IoCs
flow ioc 35 raw.githubusercontent.com 48 raw.githubusercontent.com 87 raw.githubusercontent.com 91 raw.githubusercontent.com 9 raw.githubusercontent.com 10 raw.githubusercontent.com -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" @[email protected] Set value (str) \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]" ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe -
Drops file in Program Files directory 64 IoCs
description ioc Process File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.2103.1172.0_x64__8wekyb3d8bbwe\Assets\Retail\Retail_Feedback_icon.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsNotepad_10.2102.13.0_x64__8wekyb3d8bbwe\Assets\contrast-black\NotepadAppList.targetsize-32_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\OrientationControlFrontIndicator.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\AppTiles\contrast-white\WeatherWideTile.scale-100_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-96_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxCalendarSmallTile.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\AppList.targetsize-20_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxA-Yahoo-Light.scale-250.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxMailLargeTile.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.Windows.Photos_21.21030.25003.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\ShareProvider_CopyFile24x24.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.GetHelp_10.2008.32311.0_x64__8wekyb3d8bbwe\Assets\contrast-black\GetHelpAppList.targetsize-256_altform-lightunplated_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-16_altform-unplated_contrast-white.png drpbx.exe File created C:\Program Files\7-Zip\Lang\yo.txt.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\LibrarySquare71x71Logo.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\AppIcon.targetsize-40_altform-unplated_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-white\HxA-Google.scale-400.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-36_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebMediaExtensions_1.0.40831.0_x64__8wekyb3d8bbwe\Assets\contrast-white\SmallTile.scale-200_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Getstarted_10.2.41172.0_x64__8wekyb3d8bbwe\Assets\TipsAppList.targetsize-80_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesStoreLogo.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppList.targetsize-96_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.40978.0_x64__8wekyb3d8bbwe\Assets\BadgeLogo.scale-100.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-black\AppList.targetsize-16_contrast-black.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\LogoImages\FirstRunLogo.contrast-white_scale-180.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_neutral_split.scale-100_8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File created C:\Program Files\Microsoft Office\root\rsod\officemuiset.msi.16.en-us.boot.tree.dat.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\HxCalendarAppList.targetsize-24_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\baseAltGr_rtl.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\WeatherMedTile.scale-200_contrast-black.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsMaps_1.0.22.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-white\MapsAppList.targetsize-24_contrast-white.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\AppList.scale-200.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_1.0.36.0_x64__8wekyb3d8bbwe\Assets\AlarmsAppList.targetsize-80_altform-unplated_contrast-black.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Office16\LogoImages\ExcelLogoSmall.contrast-black_scale-140.png.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PaintAppList.targetsize-60_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Tracker\form_responses.gif drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsStore_12104.1001.1.0_x64__8wekyb3d8bbwe\Assets\AppTiles\contrast-black\StoreAppList.targetsize-96.png drpbx.exe File created C:\Program Files\StartStop.pdf.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WindowsTerminal_1.6.10571.0_x64__8wekyb3d8bbwe\Images\LockScreenLogo.scale-150_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.42251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.targetsize-36_altform-unplated_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftSolitaireCollection_4.6.3102.0_x64__8wekyb3d8bbwe\Win10\contrast-white\MicrosoftSolitaireAppList.targetsize-36_altform-unplated_contrast-white.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-72.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\[email protected] drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\rsod\powerpointmui.msi.16.en-us.boot.tree.dat drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.Paint_10.2104.17.0_x64__8wekyb3d8bbwe\Assets\PaintAppList.targetsize-64_altform-lightunplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\images\contrast-black\ExchangeMediumTile.scale-150.png drpbx.exe File opened for modification C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Checkmark.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.MicrosoftStickyNotes_4.0.2.0_neutral_split.scale-125_8wekyb3d8bbwe\Assets\Icons\StickyNotesLargeTile.scale-125.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.41182.0_x64__8wekyb3d8bbwe\Assets\contrast-black\SmallTile.scale-150_contrast-black.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Office16\1033\QuickStyles\casual.dotx.fun drpbx.exe File opened for modification C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\images\Close.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.BingWeather_1.0.6.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherAppList.targetsize-96_altform-unplated.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.People_10.1909.12456.0_x64__8wekyb3d8bbwe\Assets\contrast-black\PeopleAppList.targetsize-256_altform-unplated.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.OSMUX.OSMUX.x-none.msi.16.x-none.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.WebpImageExtension_1.0.32731.0_x64__8wekyb3d8bbwe\Assets\contrast-white\WideTile.scale-150_contrast-white.png drpbx.exe File opened for modification C:\Program Files\VideoLAN\VLC\lua\http\css\ui-lightness\images\ui-icons_ffd27a_256x240.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.12827.20400.0_x64__8wekyb3d8bbwe\AppxManifest.xml drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneVideo_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\FileExtension.targetsize-129.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.YourPhone_0.19051.7.0_x64__8wekyb3d8bbwe\Assets\AppTiles\AppIcon.targetsize-40.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.21012.10511.0_x64__8wekyb3d8bbwe\Assets\contrast-white\LargeLogo.scale-200_contrast-white.png drpbx.exe File created C:\Program Files\Microsoft Office\root\Integration\C2RManifest.dcfmui.msi.16.en-us.xml.fun drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.PowerAutomateDesktop_1.0.65.0_x64__8wekyb3d8bbwe\Images\contrast-black\PowerAutomateSquare70x70Logo.scale-140.png drpbx.exe File opened for modification C:\Program Files\WindowsApps\Microsoft.ScreenSketch_11.2104.2.0_x64__8wekyb3d8bbwe\Assets\SnipSketchAppList.targetsize-60_altform-unplated.png drpbx.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 4884 4572 WerFault.exe 79 -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3852399462-405385529-394778097-1000\{7A7E224A-AD80-43B6-87AF-C7E9A8BEA837} msedge.exe Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3852399462-405385529-394778097-1000\{1BB414A8-47EC-4112-9C83-5BED354E8EFF} msedge.exe Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings msedge.exe Key created \REGISTRY\USER\S-1-5-21-3852399462-405385529-394778097-1000_Classes\Local Settings OpenWith.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 4396 reg.exe -
NTFS ADS 6 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe\:Zone.Identifier:$DATA jigsaw.exe File opened for modification C:\Users\Admin\Downloads\Ransomware.WannaCry_Plus.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Ransomware.WannaCry.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Ransomware.Petya.zip:Zone.Identifier msedge.exe File opened for modification C:\Users\Admin\Downloads\Ransomware.Jigsaw.zip:Zone.Identifier msedge.exe File created C:\Users\Admin\AppData\Roaming\Frfx\firefox.exe\:Zone.Identifier:$DATA jigsaw.exe -
Suspicious behavior: EnumeratesProcesses 42 IoCs
pid Process 1652 msedge.exe 1652 msedge.exe 1904 msedge.exe 1904 msedge.exe 444 msedge.exe 444 msedge.exe 1280 identity_helper.exe 1280 identity_helper.exe 4104 msedge.exe 4104 msedge.exe 1852 msedge.exe 1852 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 4212 msedge.exe 3200 msedge.exe 3200 msedge.exe 3132 msedge.exe 3132 msedge.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 1688 taskhsvc.exe 4908 msedge.exe 4908 msedge.exe 2544 msedge.exe 2544 msedge.exe 1476 msedge.exe 1476 msedge.exe 2552 identity_helper.exe 2552 identity_helper.exe 1608 msedge.exe 1608 msedge.exe 4036 msedge.exe 4036 msedge.exe 336 msedge.exe 336 msedge.exe 336 msedge.exe 336 msedge.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 352 @[email protected] -
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 29 IoCs
pid Process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3496 WMIC.exe Token: SeSecurityPrivilege 3496 WMIC.exe Token: SeTakeOwnershipPrivilege 3496 WMIC.exe Token: SeLoadDriverPrivilege 3496 WMIC.exe Token: SeSystemProfilePrivilege 3496 WMIC.exe Token: SeSystemtimePrivilege 3496 WMIC.exe Token: SeProfSingleProcessPrivilege 3496 WMIC.exe Token: SeIncBasePriorityPrivilege 3496 WMIC.exe Token: SeCreatePagefilePrivilege 3496 WMIC.exe Token: SeBackupPrivilege 3496 WMIC.exe Token: SeRestorePrivilege 3496 WMIC.exe Token: SeShutdownPrivilege 3496 WMIC.exe Token: SeDebugPrivilege 3496 WMIC.exe Token: SeSystemEnvironmentPrivilege 3496 WMIC.exe Token: SeRemoteShutdownPrivilege 3496 WMIC.exe Token: SeUndockPrivilege 3496 WMIC.exe Token: SeManageVolumePrivilege 3496 WMIC.exe Token: 33 3496 WMIC.exe Token: 34 3496 WMIC.exe Token: 35 3496 WMIC.exe Token: 36 3496 WMIC.exe Token: SeIncreaseQuotaPrivilege 3496 WMIC.exe Token: SeSecurityPrivilege 3496 WMIC.exe Token: SeTakeOwnershipPrivilege 3496 WMIC.exe Token: SeLoadDriverPrivilege 3496 WMIC.exe Token: SeSystemProfilePrivilege 3496 WMIC.exe Token: SeSystemtimePrivilege 3496 WMIC.exe Token: SeProfSingleProcessPrivilege 3496 WMIC.exe Token: SeIncBasePriorityPrivilege 3496 WMIC.exe Token: SeCreatePagefilePrivilege 3496 WMIC.exe Token: SeBackupPrivilege 3496 WMIC.exe Token: SeRestorePrivilege 3496 WMIC.exe Token: SeShutdownPrivilege 3496 WMIC.exe Token: SeDebugPrivilege 3496 WMIC.exe Token: SeSystemEnvironmentPrivilege 3496 WMIC.exe Token: SeRemoteShutdownPrivilege 3496 WMIC.exe Token: SeUndockPrivilege 3496 WMIC.exe Token: SeManageVolumePrivilege 3496 WMIC.exe Token: 33 3496 WMIC.exe Token: 34 3496 WMIC.exe Token: 35 3496 WMIC.exe Token: 36 3496 WMIC.exe Token: SeBackupPrivilege 2412 vssvc.exe Token: SeRestorePrivilege 2412 vssvc.exe Token: SeAuditPrivilege 2412 vssvc.exe Token: SeTcbPrivilege 4684 taskse.exe Token: SeTcbPrivilege 4684 taskse.exe Token: SeTcbPrivilege 2668 taskse.exe Token: SeTcbPrivilege 2668 taskse.exe Token: SeTcbPrivilege 4628 taskse.exe Token: SeTcbPrivilege 4628 taskse.exe Token: SeTcbPrivilege 3688 taskse.exe Token: SeTcbPrivilege 3688 taskse.exe Token: SeTcbPrivilege 1252 taskse.exe Token: SeTcbPrivilege 1252 taskse.exe Token: SeTcbPrivilege 4036 taskse.exe Token: SeTcbPrivilege 4036 taskse.exe Token: SeTcbPrivilege 1580 taskse.exe Token: SeTcbPrivilege 1580 taskse.exe Token: SeShutdownPrivilege 720 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of SendNotifyMessage 28 IoCs
pid Process 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 1904 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe 2544 msedge.exe -
Suspicious use of SetWindowsHookEx 16 IoCs
pid Process 3048 @[email protected] 3048 @[email protected] 3948 @[email protected] 3948 @[email protected] 352 @[email protected] 352 @[email protected] 2940 @[email protected] 552 @[email protected] 2024 @[email protected] 3256 @[email protected] 4236 @[email protected] 3944 @[email protected] 4420 OpenWith.exe 4564 @[email protected] 3364 4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe 720 26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1304 wrote to memory of 4572 1304 regsvr32.exe 79 PID 1304 wrote to memory of 4572 1304 regsvr32.exe 79 PID 1304 wrote to memory of 4572 1304 regsvr32.exe 79 PID 1904 wrote to memory of 4920 1904 msedge.exe 83 PID 1904 wrote to memory of 4920 1904 msedge.exe 83 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 2988 1904 msedge.exe 88 PID 1904 wrote to memory of 1652 1904 msedge.exe 89 PID 1904 wrote to memory of 1652 1904 msedge.exe 89 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 PID 1904 wrote to memory of 3216 1904 msedge.exe 90 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2420 attrib.exe 400 attrib.exe
Processes
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll1⤵
- Suspicious use of WriteProcessMemory
PID:1304 -
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\b28242123ed2cf6000f0aa036844bd29.dll2⤵PID:4572
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4572 -s 4603⤵
- Program crash
PID:4884
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6573cb8,0x7ff9e6573cc8,0x7ff9e6573cd82⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1892 /prefetch:22⤵PID:2988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:1652
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2528 /prefetch:82⤵PID:3216
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:12⤵PID:3468
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:12⤵PID:1824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:12⤵PID:1508
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4452 /prefetch:12⤵PID:940
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:444
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1280
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:12⤵PID:584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵PID:4944
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:12⤵PID:5048
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:12⤵PID:880
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:12⤵PID:1352
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1916 /prefetch:12⤵PID:4768
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:12⤵PID:3876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:12⤵PID:2916
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4532 /prefetch:82⤵PID:676
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5912 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:4104
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:12⤵PID:3688
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6484 /prefetch:12⤵PID:2516
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6472 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:1852
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5944 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:4212
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:12⤵PID:3436
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5544 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3200
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:12⤵PID:4548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1880,4148832169033650305,2247206537213259496,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3132
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4572 -ip 45721⤵PID:792
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:4080
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:860
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004D81⤵PID:2380
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3284
-
C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe"1⤵
- Adds Run key to start application
- NTFS ADS
PID:3156 -
C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe"C:\Users\Admin\AppData\Local\Drpbx\drpbx.exe" C:\Users\Admin\Downloads\Ransomware.Jigsaw\jigsaw.exe2⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4788
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
PID:2168 -
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
PID:2420
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
PID:1536
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4216
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 125111712558524.bat2⤵PID:3328
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵PID:1712
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
PID:400
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:3048
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\TaskData\Tor\taskhsvc.exeTaskData\Tor\taskhsvc.exe3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:1688
-
-
-
C:\Windows\SysWOW64\cmd.exePID:2564
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:3948
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵PID:3404
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
- Suspicious use of AdjustPrivilegeToken
PID:3496
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4684
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:2940
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfjxtaorfuauqli296" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f2⤵PID:4216
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "vfjxtaorfuauqli296" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\tasksche.exe\"" /f3⤵
- Adds Run key to start application
- Modifies registry key
PID:4396
-
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1452
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:2324
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2668
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:552
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4628
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:2024
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:3572
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:3256
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1568
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1252
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:4236
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:4888
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:3944
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:124
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskse.exetaskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1580
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]PID:4564
-
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
PID:1252
-
-
C:\Users\Admin\Desktop\@[email protected]"C:\Users\Admin\Desktop\@[email protected]"1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:352
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2412
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2544 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9e6573cb8,0x7ff9e6573cc8,0x7ff9e6573cd82⤵PID:3672
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1988 /prefetch:22⤵PID:3228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
PID:4908
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:82⤵PID:1480
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3644 /prefetch:12⤵PID:3232
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3664 /prefetch:12⤵PID:4576
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2140 /prefetch:12⤵PID:4396
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:12⤵PID:4988
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4284 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:1476
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:12⤵PID:4724
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5608 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2552
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:12⤵PID:2392
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:12⤵PID:5052
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:12⤵PID:4824
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:12⤵PID:4728
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5836 /prefetch:82⤵PID:2040
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5548 /prefetch:82⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
PID:1608
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:12⤵PID:3972
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:12⤵PID:1376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:12⤵PID:4684
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6356 /prefetch:82⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4036
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:12⤵PID:2952
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,17076439191870042075,4855333770680344620,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6772 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
PID:336
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:912
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵PID:2128
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4420
-
C:\Users\Admin\Downloads\Ransomware.Petya\4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe"C:\Users\Admin\Downloads\Ransomware.Petya\4c1dc737915d76b7ce579abddaba74ead6fdb5b519a1ea45308b8c49b950655c.exe"1⤵
- Suspicious use of SetWindowsHookEx
PID:3364
-
C:\Users\Admin\Downloads\Ransomware.Petya\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe"C:\Users\Admin\Downloads\Ransomware.Petya\26b4699a7b9eeb16e76305d843d4ab05e94d43f3201436927e13b3ebafa90739.exe"1⤵
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:720
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\Common Files\Adobe\Reader\DC\Linguistics\LanguageNames2\DisplayLanguageNames.en_US_POSIX.txt.fun
Filesize32KB
MD5829165ca0fd145de3c2c8051b321734f
SHA1f5cc3af85ab27c3ea2c2f7cbb8295b28a76a459e
SHA256a193ee2673e0ba5ebc5ea6e65665b8a28bd7611f06d2b0174ec2076e22d94356
SHA5127d380cda12b342a770def9d4e9c078c97874f3a30cd9f531355e3744a8fef2308f79878ffeb12ce26953325cb6a17bc7e54237dfdc2ee72b140ec295676adbcb
-
Filesize
160B
MD5580ee0344b7da2786da6a433a1e84893
SHA160f8c4dd5457e9834f5402cb326b1a2d3ca0ba7e
SHA25698b6c2ddfefc628d03ceaef9d69688674a6bc32eb707f9ed86bc8c75675c4513
SHA512356d2cdea3321e894b5b46ad1ea24c0e3c8be8e3c454b5bd300b7340cbb454e71fc89ca09ea0785b373b483e67c2f6f6bb408e489b0de4ff82d5ed69a75613ba
-
C:\ProgramData\Microsoft\AppV\Setup\@[email protected]
Filesize1KB
MD53d810c40e2d8756f360101a153a82c71
SHA1b20d74735a700f7aac2373bcfa2009ed67bf273d
SHA2566ecf29e6beeaf3fed3d3579dabf67da85649d0d4899ddf70f5daf397eb4082c1
SHA512acd460101a5bdb2d1b094b0fc2c9f0b47e39bf14adb5f47336e9da4c117817be7acd4c09b8eae7423281c6c7b1a028a2dc16ca091db9c11c2d0f846daa4babc5
-
Filesize
283KB
MD52773e3dc59472296cb0024ba7715a64e
SHA127d99fbca067f478bb91cdbcb92f13a828b00859
SHA2563ae96f73d805e1d3995253db4d910300d8442ea603737a1428b613061e7f61e7
SHA5126ef530b209f8ec459cca66dbf2c31ec96c5f7d609f17fa3b877d276968032fbc6132ea4a45ed1450fb6c5d730a7c9349bf4481e28befaea6b119ec0ded842262
-
Filesize
86B
MD51d726d00a7033a5dab753d6012eee269
SHA10eec68c618a8c4d44299dfb8415b9add0eb03863
SHA256fcce59c5531bcd9542bc0fcd0427669e9527e71384a83a31199d91f157a01928
SHA512c50f27a7ed7f26f928fe740d4086c863e7a3c5e86d85cd99ccb83534e6d58b662cd0e4608ac4729774d7028cd4b62e38349e94c67c80a8ecec9c5d637b1b0a3e
-
Filesize
152B
MD5341f6b71eb8fcb1e52a749a673b2819c
SHA16c81b6acb3ce5f64180cb58a6aae927b882f4109
SHA25657934852f04cef38bb4acbe4407f707f137fada0c36bab71b2cdfd58cc030a29
SHA51257ecaa087bc5626752f89501c635a2da8404dbda89260895910a9cc31203e15095eba2e1ce9eee1481f02a43d0df77b75cb9b0d77a3bc3b894fdd1cf0f6ce6f9
-
Filesize
152B
MD588e9aaca62aa2aed293699f139d7e7e1
SHA109d9ccfbdff9680366291d5d1bc311b0b56a05e9
SHA25627dcdb1cddab5d56ac53cff93489038de93f61b5504f8595b1eb2d3124bbc12c
SHA512d90dabe34504dde422f5f6dec87851af8f4849f521759a768dfa0a38f50827b099dfde256d8f8467460c289bdb168358b2678772b8b49418c23b882ba21d4793
-
Filesize
152B
MD5d60c083d8624e1cb5088f92e4112a662
SHA1e0793146cce75949ad54b1b5fc40f7213e1a0821
SHA256dd0ef671b17334606709bbdcb3eb2d3e5799f3db3fe868ed623bd40a977fb915
SHA512bac002fb9d8bdec22000a46ddf511a0cb21aed37891488b20e60da0e203225fb984d02cafba1a165b9a89a3186e1235602fb71240348ad1f00be7c08e2ad8413
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize3KB
MD5ad0842707505a216f6936d2edbc62284
SHA1a83b316156a4773af5e596e82ee3afbafeb620a6
SHA256b4c9f9867e8f663689ff019c4ce5368aed049b9a8040ff290c7ace847f254948
SHA512b373d647202c634b1707bd307370c9ebe47a538b543db95089f822a3d45875d0efbe6ccdf55eb1be21c8272cee7f0e2b8cedc2992590382648993d8d6f7f5c8a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD50f6c1eb531c90290ae6481c10c8519fe
SHA13a682606102879b2c91a9f8ebcab9cc8002efff6
SHA256c8737b100c8e0d603d8b397a22901552e5d4126da9623c8ea4ac28c04e52f7e5
SHA512242e738bbdbb527bbc359d2d366aa753bc988c98bbb9cc24272cb48ac8c7131ee8a4dc5743e85cbc6a61a290f262613494bb707701421e24744c816527020586
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize4KB
MD56bd7bfdc0f17a0ae8c53f94cc1efa5ba
SHA1616f3e1602601cfd03295679a335308483f1705b
SHA2569df815c47e5e8b643b3f8bf9200af374dbb115006d4ce69634348f4ea849b0bb
SHA512dc845571830f09be8cf0b547bc5984d854df1a39b90f5ef84ab6c31b13b29432cf75280055b67b13a2d8529aca0c9b2fe5e5c07097e76902aa1b3516c925770a
-
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5f2072.TMP
Filesize4KB
MD5240b025508d056b63c0dda8ee634d74e
SHA1139a3eedcd25a3ecea05aa49219e0caf291b893e
SHA25604dfacc38f0c33d15aaa7d6ef35c7a7b1d32f18e99ac1e5cfa681c35a58f4ad7
SHA51210b69c28b9c679e4e299f52b4ed7411faacefb13c66d19eba1a60fbd316ec130ec3d350948726311459238390f56f76b5bb7ef457668575dba82e0e5cbfb9ad7
-
Filesize
111B
MD5285252a2f6327d41eab203dc2f402c67
SHA1acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA2565dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
SHA51211ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
-
Filesize
1010B
MD5514f4cf075016aee831bf514c818ddc4
SHA1d1dd8c5c8b0afe3c848533b6690ab65b925301a8
SHA256ff685efd1953ea9107ef0c37d5355b83e25b120a7df7aeda913837768794a680
SHA5122d0c7e5e33e8c4e906da87f00ab9fc4dbb50a46abf619703a3559749ba62d824acfdd110cf40fc006cce853cef955c384a403bb1dcc9b20c7146b020a64c1776
-
Filesize
1KB
MD52c6623b533c984850864bf5c97027473
SHA1bf064c29607279128c992507c89026692d7d4f7d
SHA256caacd1cc5484b0acac96c15e0d6b01286d42f6194fe3dfb26c7f2867da304b2c
SHA512aa14aa62419dad79b1686e8ac712f14857aad08184be6b5376caef73e33d3bdb9aa0fccbaec68a9ff9ba478629864d0752ec7d91d0c1c6408c203244c7a83898
-
Filesize
1KB
MD59cd924256cdad5035a23041bbfa7cc53
SHA12f45937d7557e2a44ff515a344f88c90c234ca43
SHA256594876c74cd73672afac700f75c4aa37b2f351c11d5f1a55426767f050234ce2
SHA5128da2ab4f87bef81c7765b397db6677bf06e043be279816b4405c24bf7e1ffcf6c618b9b60ceb0460acaacc7630eea5c84c349f3046c5f74f4fc99fd7094cfa3c
-
Filesize
5KB
MD5ac6a49384adc1fd4b3cc900048ee9cfe
SHA125ab5c982f3b53001645017884a2714a58f024c5
SHA25615f305848f61b0255f0135a7103299f828e9926386367beeb0346e583ff9c2a0
SHA5126aaf4117afa39b94dcea7c45249f0dde576a183330e2878231aada7346195fb8018814c0f410690537bc2d95860b86f85821faa75b039c79b1f00cae3bf218bb
-
Filesize
7KB
MD5413e2433d5ccf9ed3d80f769ea212a46
SHA1603a770971dad654cd79ff6455bd4b4c9d81d3ce
SHA256a2aac065b322f5f3c880503d7b69a086488e68912f287447983c9978785fee34
SHA51220b66dc03cbad8c587216921618192c1009bf5becc2dc8ccc782346ff1bf2e4750446feadb2dda46141b25acef83326d1b0e56348c004b6d6858afe024a9984d
-
Filesize
6KB
MD562c32a027432b1eb01d71ab862841054
SHA1327e919d58f3c16390b0e9542bf92f0aed185aa1
SHA25643db9a7a069f3a35ac6db15c6ef30eba73a70a21393892f9843a14c9bbc8600c
SHA512923f5e936e1cd41210f23cbecc89fff53b74ffa951e4a28f9fd060e32e3c78a1e0412cd71b4d132e6dd54b2419f5405d8934e84179d819ed88ceb94e77599fe2
-
Filesize
7KB
MD53db7f73fbf92e2f3ab1a76749ffb3b19
SHA1546ce022c1a71b138e468956773e0e885bf4d828
SHA2565c25e512b133e7e90e281b034d758b764057badee9b1b5cb752659b8e350c1b5
SHA512d49686a57083fec228654c7c3c66720b95dbd5b1d5ac055876afb7ad7c0f6ddf1085bb47b82e0c2345ac70465735d2d49ce1f5457ac64305db210679eb53eb84
-
Filesize
6KB
MD5c14175c3ca831e6c34474cd93f39a9ee
SHA111bd40c962cd7aca530c70cb0b77bb2a1b3aa417
SHA25647c0e1c2c6e4f6e19fa9b259379c3650a57388872a31ae6fc0b9333815e2c9cd
SHA5123104b64ee1297929e3bb7fd88d8183087cfff9dd9944047e77e36d10bfa4ece244c26aba501b73817b7744db1190f9071ac0126f647912b820b31463cee23497
-
Filesize
7KB
MD5b826ffe09729cd7978a69fa2dd3a1d45
SHA1a2ab2e74c8fd7fa02a974bc21a45188d5005532d
SHA25605629dff5d1b607c8de83b2f79b59da94f051d7e8c2ba00a32ac6beb305467ba
SHA5127ad4f8a1cb32704c626424a8c2ea2cba63eab5f98cbc8eacc32baf7b395f314af195d3153d3c0c52ada477370139178a0ba5714b7125059f0ca010370f969b2d
-
Filesize
7KB
MD58d68b80027df592dc5574c1769eafbf9
SHA1a99aa0288fa185c4002f9c91536a3205721cc8d0
SHA256f4c87f6b91294510ca5b1d93600a8c8239034c25ba362f8748054f9ee6a36a5d
SHA5127a67b8133ca7738724dc3b21833d843c501608d3c2a9030dca513ea323288ea411cd6db239178f3519701523444c5d2cdb1fac459e62f8313056854e20463ce2
-
Filesize
6KB
MD5b0c169f925105a9f8d41ba3dd706fade
SHA10d951c81a3809e9eef2476aef245e7c89cba0280
SHA256958800d506a0916d036aeea9c69dd6229c8428f92a37462cdb5dd78346eb3fe5
SHA512031dbaa58156b6dca3c996c25603b68ffdcb64a19cbcab954a54b0e5e9aa89657fc9502a0515ceb0000a41f1e5a047997a2f17f8f84482d92ffdfc10f5600d9a
-
Filesize
1KB
MD5c75a8c67d368eec146382a1e434e17f5
SHA11163498f05201893be5a6a78656180cf0f237244
SHA25651e8e88e1bf1e72c714a55f3b3793d67cab72fc298c364407e591b680323f5a4
SHA51279a6a4174912f399ce15c62c448625359d52881c4d44a03f62b61cee30a5ce4fa12ff97ac2dc6df3027d03cc032ddc0e6ed6c98b3ea62c0323bbfe85aeaeb283
-
Filesize
1KB
MD5d15d2c69a332671e2330ae285a55823a
SHA1ddf833e77284ee0a6467ab55bf5ea4d3b572f039
SHA2564f191e4af238a581ea12ff68164066af141cbf1018b20de7549adfd546257209
SHA5129037291f5b0a12c8c207a80dfc1d868d559acbe397d74bb1db823d61c62f57dfbb17cc9c65d80235ec736536bb4fd22d584fa2c800456d70cc8919916a926ede
-
Filesize
1KB
MD527ccaffcb18cbdbb2705a32d1dc7bc5f
SHA1a6762d82b4143c8931ee3e26546911f717f49dfa
SHA2560766a4287c46ea94113825e6c9283b04b4b227678ea959b32d5be6337b4ec5b8
SHA5123dff9fe40cd72b6d46f62f4b591edcbc7f276b5f618b779600575a35a048097a6433fae7496ec9e4a16da1188d793a389f07e648ce89c5fcd472f4767ee83db5
-
Filesize
1KB
MD584dc822fe2849c8a27b3cdb04a2dc7bf
SHA1149a334953cc84d3e22c06e437d136e0e528f78f
SHA25693dd01e55e30e6c523e07f526722abad2f6eab8575931d8c845bf68db2331eeb
SHA5121a4b99b383d334d16d642cbd2fd28639747fffbfcf3659905b3da23653811bf6705e7e04ca885696a07d1573fec5d82839a8be6bc9cbc75e2bc3e14c5f2f86f7
-
Filesize
1KB
MD59274cba37c0175ddb0a123d9e107472b
SHA1406c1cf1cea3823db2a8f98742f37130f9396345
SHA256a3d4e905f4430d62a9a907442d6cb173fa7fb6485affa6c2395a2bc6bb1adc4e
SHA512d53798192584dcb4e7b63c4b821e7503acfb4f807fdd96e89f1a8c057ec00ba6b216ee3ca97d6164b9277d768bc4fc144e1d6df3c1723f2c827ffd20101f1cba
-
Filesize
1KB
MD5f32a0ebe46ea59dea43b499be45bfc38
SHA1c9748179828b104a83ff76e8828d13637e8dc8a9
SHA256ee7f7c79e49484e953600d2cc54c344d4de1a4e8db2d9b74eecc40fb55ac3024
SHA512b158ec7718b69e9bb234e868d56ed13d305dec397bf368178d681b99b31dc1a5251f861ba618adfccfaf3a4208b393b157a2623b56e9280434d6610709dfcb55
-
Filesize
1KB
MD5e85b5ed62df2fc07e5463b8e232c17bb
SHA14ce85fb81a8ff33e442a70c3b4803f325c383600
SHA2560971788fad7f7f89ecd7bfc7b680594eecb12c0e20a7f1336d2124e5f9b998e6
SHA512c12c23aa15670cc177e00208de5413b24bdf0022896522bf460f1ae57c2e82ebc79eda721bed1a7bebdb6abc955897318e26c5ca52bfacf22a62591c38c793ce
-
Filesize
1KB
MD5e81879375a2768602168e3754fcfe409
SHA13b1e9e266789ac49a368ae912e41d5e4b8a58a3b
SHA2563f79b2ad760cb51a6cd549a55b219732a680febff85d5552dfb6a26e329a1fa4
SHA51222027073f1fd2b698b4ceb6853479f87774ae37b50c0760b867096130657b35c078b2c1c90b2ca4fe75cba9e34f5094d33056aca97dfeead65548a254d1aa2fd
-
Filesize
1KB
MD54d60d152099fa94718c205ffdba51a6c
SHA1759a1efc85c1ffe3088f1c9dc51f4c15651f96ac
SHA2560f151d4818adbf67f1c02ed9df2edc6b7f080003862bd030bfae37b2d62390d2
SHA512596647d2bba0484f31278163dc75964ffedf60061e7b5376cabd4a7728e668f00ea3529907836da63073783ea046add72642d559b0d6171aee60167d1ae659cf
-
Filesize
1KB
MD56381a0f5afe89633251466fe62cc9af7
SHA10c05907698559b0d8befe2b2c967299983f7a891
SHA256b7ed22f2312ac0fa10c05efb319505e460b1a74deb4c2900152aa2f8cf9b6b83
SHA512040d5fd7e2279044221bdca1f9ed28b9f692e6769a022b9fa35ec3448ce3a4ecd17d7df65b43e447dc698e70fe45391b5a87581ad9a67a2f131e75f44532e1de
-
Filesize
16B
MD5aefd77f47fb84fae5ea194496b44c67a
SHA1dcfbb6a5b8d05662c4858664f81693bb7f803b82
SHA2564166bf17b2da789b0d0cc5c74203041d98005f5d4ef88c27e8281e00148cd611
SHA512b733d502138821948267a8b27401d7c0751e590e1298fda1428e663ccd02f55d0d2446ff4bc265bdcdc61f952d13c01524a5341bc86afc3c2cde1d8589b2e1c3
-
Filesize
16B
MD56752a1d65b201c13b62ea44016eb221f
SHA158ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA2560861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
SHA5129cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
-
Filesize
11KB
MD5035f82c61090d0f9ba18f456fc235da4
SHA1b0d5469b2a5e90a3aea5dc05378bfc7c7854f9fc
SHA25662a574bd80e0e453254b4227ca3c549b284ffc2685dfbe6b39cbdf3658828063
SHA512b5d6f985c64d348a191e724f91e5bbad7c188e78abd39fc7d0d9f4cf4515637b96ff2956053c32552c9f56bdc66532dd3bdc4e13231361bb5df7b54733cfd469
-
Filesize
11KB
MD5df267bbf572aed1ad90ebeb3d4826796
SHA10908f72314747985a80082db8c1d864a226b032f
SHA256efbd6afb6a17176ddda3ea0146064d5e971e9b5932cd9162f73b77e39873fb1d
SHA512c57091c38abf382412ad8288c79266a6d4aea0118c0ce1f8208dc477b8fe6fb9c7eee1ccd1be6cb7548f6d06174eb769ecf124220d90e17f93e6b139c295383f
-
Filesize
12KB
MD52bd39fce21997ca44e3ea1988b87bf83
SHA1a4f5911e6a415b7c1742b1ee6e825a97de642ca8
SHA256b65f3cf4a610bb084b8d6e3a00b9575f06db25cc19c7fe22b9e9d7e79b26eb3b
SHA51273f295eb1c563b055977ffecf07121260dd00be05caad042c795833d65ab67b660d658de0699a1bc5bb216ae6ed569196a9a45202a2df854c62c4ac85244fda5
-
Filesize
11KB
MD5fa111cb1f227c7e89542d54db67457b8
SHA109ab9c61b11ab3dfa579dbf6e4b75decc0ba3c8a
SHA2563d1195f208ea18e0f9c126faeb10d63d906b8243c1c316e9d280a97ca102ad79
SHA512c77bbcbec72d8f24529f665bc5355761537ea96967c449ded29dfed46e26f51f48041356f179cb24b589afae68f13fcbcd3271af8c750960df13eb31f8d3f59b
-
Filesize
11KB
MD5458974bc0e1b10218fd9dafb7b71f929
SHA13605c49da2f1dd275c785e7af39e094ba840b79c
SHA2569aa1c3f4ebb19c35b2242a07bb4bdbc17907b980842c28e542f60d5214a95d07
SHA512b264167a1bf59c500a59173d9a2f5f05f43088ea7e754e802b334460430da9d8f765b7b5d9cfd13beb5d25e7f9d4ae2d5f7bdb63184b2fbb7985a3b9dfcd013a
-
C:\Users\Admin\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.fun
Filesize8KB
MD5f22599af9343cac74a6c5412104d748c
SHA1e2ac4c57fa38f9d99f3d38c2f6582b4334331df5
SHA25636537e56d60910ab6aa548e64ca4adafdcabde9d60739013993e12ba061dfd65
SHA5125c8afc025e1d8342d93b7842dc7ef22eca61085857a80a08ba9b3f156ee3b814606bb32bc244bd525a7913e7915bdf3a86771d39577f4a1176ade04dc381c6d4
-
Filesize
53B
MD5ce90a9a0f18097e2a2963fd9f98205cf
SHA1bbf9d62657a85d8c9462fde40e52e3e234404a19
SHA256d3f454cbee408daa3498467ba1f8aa5243abf38baf85c3fcfbc66f942076b6d6
SHA5124aae2fcbfcf10f252eca40f7d1ca2e8e62b8b749eafc2f04d7604252427932b61fcdf30093f369d5755dc2ff4075b5d00259c467bbc20cf1b128ce26e28c8390
-
Filesize
16B
MD58ebcc5ca5ac09a09376801ecdd6f3792
SHA181187142b138e0245d5d0bc511f7c46c30df3e14
SHA256619e246fc0ac11320ff9e322a979948d949494b0c18217f4d794e1b398818880
SHA512cec50bfc6ad2f57f16da99459f40f2d424c6d5691685fa1053284f46c8c8c8a975d7bcb1f3521c4f3fbdc310cf4714e29404aa23be6021e2e267c97b090dc650
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
Filesize933B
MD5f97d2e6f8d820dbd3b66f21137de4f09
SHA1596799b75b5d60aa9cd45646f68e9c0bd06df252
SHA2560e5ece918132a2b1a190906e74becb8e4ced36eec9f9d1c70f5da72ac4c6b92a
SHA512efda21d83464a6a32fdeef93152ffd32a648130754fdd3635f7ff61cc1664f7fc050900f0f871b0ddd3a3846222bf62ab5df8eed42610a76be66fff5f7b4c4c0
-
C:\Users\Admin\AppData\Local\Temp\Temp1_Ransomware.WannaCry.zip\@[email protected]
Filesize240KB
MD57bf2b57f2a205768755c07f238fb32cc
SHA145356a9dd616ed7161a3b9192e2f318d0ab5ad10
SHA256b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25
SHA51291a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9
-
Filesize
3.0MB
MD5fe7eb54691ad6e6af77f8a9a0b6de26d
SHA153912d33bec3375153b7e4e68b78d66dab62671a
SHA256e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb
SHA5128ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f
-
Filesize
1.4MB
MD5c17170262312f3be7027bc2ca825bf0c
SHA1f19eceda82973239a1fdc5826bce7691e5dcb4fb
SHA256d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa
SHA512c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c
-
Filesize
780B
MD5383a85eab6ecda319bfddd82416fc6c2
SHA12a9324e1d02c3e41582bf5370043d8afeb02ba6f
SHA256079ce1041cbffe18ff62a2b4a33711eda40f680d0b1d3b551db47e39a6390b21
SHA512c661e0b3c175d31b365362e52d7b152267a15d59517a4bcc493329be20b23d0e4eb62d1ba80bb96447eeaf91a6901f4b34bf173b4ab6f90d4111ea97c87c1252
-
Filesize
46KB
MD595673b0f968c0f55b32204361940d184
SHA181e427d15a1a826b93e91c3d2fa65221c8ca9cff
SHA25640b37e7b80cf678d7dd302aaf41b88135ade6ddf44d89bdba19cf171564444bd
SHA5127601f1883edbb4150a9dc17084012323b3bfa66f6d19d3d0355cf82b6a1c9dce475d758da18b6d17a8b321bf6fca20915224dbaedcb3f4d16abfaf7a5fc21b92
-
Filesize
53KB
MD50252d45ca21c8e43c9742285c48e91ad
SHA15c14551d2736eef3a1c1970cc492206e531703c1
SHA256845d0e178aeebd6c7e2a2e9697b2bf6cf02028c50c288b3ba88fe2918ea2834a
SHA5121bfcf6c0e7c977d777f12bd20ac347630999c4d99bd706b40de7ff8f2f52e02560d68093142cc93722095657807a1480ce3fb6a2e000c488550548c497998755
-
Filesize
77KB
MD52efc3690d67cd073a9406a25005f7cea
SHA152c07f98870eabace6ec370b7eb562751e8067e9
SHA2565c7f6ad1ec4bc2c8e2c9c126633215daba7de731ac8b12be10ca157417c97f3a
SHA5120766c58e64d9cda5328e00b86f8482316e944aa2c26523a3c37289e22c34be4b70937033bebdb217f675e40db9fecdce0a0d516f9065a170e28286c2d218487c
-
Filesize
38KB
MD517194003fa70ce477326ce2f6deeb270
SHA1e325988f68d327743926ea317abb9882f347fa73
SHA2563f33734b2d34cce83936ce99c3494cd845f1d2c02d7f6da31d42dfc1ca15a171
SHA512dcf4ccf0b352a8b271827b3b8e181f7d6502ca0f8c9dda3dc6e53441bb4ae6e77b49c9c947cc3ede0bf323f09140a0c068a907f3c23ea2a8495d1ad96820051c
-
Filesize
39KB
MD5537efeecdfa94cc421e58fd82a58ba9e
SHA13609456e16bc16ba447979f3aa69221290ec17d0
SHA2565afa4753afa048c6d6c39327ce674f27f5f6e5d3f2a060b7a8aed61725481150
SHA512e007786ffa09ccd5a24e5c6504c8de444929a2faaafad3712367c05615b7e1b0fbf7fbfff7028ed3f832ce226957390d8bf54308870e9ed597948a838da1137b
-
Filesize
36KB
MD52c5a3b81d5c4715b7bea01033367fcb5
SHA1b548b45da8463e17199daafd34c23591f94e82cd
SHA256a75bb44284b9db8d702692f84909a7e23f21141866adf3db888042e9109a1cb6
SHA512490c5a892fac801b853c348477b1140755d4c53ca05726ac19d3649af4285c93523393a3667e209c71c80ac06ffd809f62dd69ae65012dcb00445d032f1277b3
-
Filesize
36KB
MD57a8d499407c6a647c03c4471a67eaad7
SHA1d573b6ac8e7e04a05cbbd6b7f6a9842f371d343b
SHA2562c95bef914da6c50d7bdedec601e589fbb4fda24c4863a7260f4f72bd025799c
SHA512608ef3ff0a517fe1e70ff41aeb277821565c5a9bee5103aa5e45c68d4763fce507c2a34d810f4cd242d163181f8341d9a69e93fe32aded6fbc7f544c55743f12
-
Filesize
36KB
MD5fe68c2dc0d2419b38f44d83f2fcf232e
SHA16c6e49949957215aa2f3dfb72207d249adf36283
SHA25626fd072fda6e12f8c2d3292086ef0390785efa2c556e2a88bd4673102af703e5
SHA512941fa0a1f6a5756ed54260994db6158a7ebeb9e18b5c8ca2f6530c579bc4455918df0b38c609f501ca466b3cc067b40e4b861ad6513373b483b36338ae20a810
-
Filesize
36KB
MD508b9e69b57e4c9b966664f8e1c27ab09
SHA12da1025bbbfb3cd308070765fc0893a48e5a85fa
SHA256d8489f8c16318e524b45de8b35d7e2c3cd8ed4821c136f12f5ef3c9fc3321324
SHA512966b5ed68be6b5ccd46e0de1fa868cfe5432d9bf82e1e2f6eb99b2aef3c92f88d96f4f4eec5e16381b9c6db80a68071e7124ca1474d664bdd77e1817ec600cb4
-
Filesize
37KB
MD535c2f97eea8819b1caebd23fee732d8f
SHA1e354d1cc43d6a39d9732adea5d3b0f57284255d2
SHA2561adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e
SHA512908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf
-
Filesize
37KB
MD54e57113a6bf6b88fdd32782a4a381274
SHA10fccbc91f0f94453d91670c6794f71348711061d
SHA2569bd38110e6523547aed50617ddc77d0920d408faeed2b7a21ab163fda22177bc
SHA5124f1918a12269c654d44e9d394bc209ef0bc32242be8833a2fba437b879125177e149f56f2fb0c302330dec328139b34982c04b3fefb045612b6cc9f83ec85aa9
-
Filesize
36KB
MD53d59bbb5553fe03a89f817819540f469
SHA126781d4b06ff704800b463d0f1fca3afd923a9fe
SHA2562adc900fafa9938d85ce53cb793271f37af40cf499bcc454f44975db533f0b61
SHA51295719ae80589f71209bb3cb953276538040e7111b994d757b0a24283aefe27aadbbe9eef3f1f823ce4cabc1090946d4a2a558607ac6cac6faca5971529b34dac
-
Filesize
47KB
MD5fb4e8718fea95bb7479727fde80cb424
SHA11088c7653cba385fe994e9ae34a6595898f20aeb
SHA256e13cc9b13aa5074dc45d50379eceb17ee39a0c2531ab617d93800fe236758ca9
SHA51224db377af1569e4e2b2ebccec42564cea95a30f1ff43bcaf25a692f99567e027bcef4aacef008ec5f64ea2eef0c04be88d2b30bcadabb3919b5f45a6633940cb
-
Filesize
36KB
MD53788f91c694dfc48e12417ce93356b0f
SHA1eb3b87f7f654b604daf3484da9e02ca6c4ea98b7
SHA25623e5e738aad10fb8ef89aa0285269aff728070080158fd3e7792fe9ed47c51f4
SHA512b7dd9e6dc7c2d023ff958caf132f0544c76fae3b2d8e49753257676cc541735807b4befdf483bcae94c2dcde3c878c783b4a89dca0fecbc78f5bbf7c356f35cd
-
Filesize
36KB
MD530a200f78498990095b36f574b6e8690
SHA1c4b1b3c087bd12b063e98bca464cd05f3f7b7882
SHA25649f2c739e7d9745c0834dc817a71bf6676ccc24a4c28dcddf8844093aab3df07
SHA512c0da2aae82c397f6943a0a7b838f60eeef8f57192c5f498f2ecf05db824cfeb6d6ca830bf3715da7ee400aa8362bd64dc835298f3f0085ae7a744e6e6c690511
-
Filesize
79KB
MD5b77e1221f7ecd0b5d696cb66cda1609e
SHA151eb7a254a33d05edf188ded653005dc82de8a46
SHA2567e491e7b48d6e34f916624c1cda9f024e86fcbec56acda35e27fa99d530d017e
SHA512f435fd67954787e6b87460db026759410fbd25b2f6ea758118749c113a50192446861a114358443a129be817020b50f21d27b1ebd3d22c7be62082e8b45223fc
-
Filesize
89KB
MD56735cb43fe44832b061eeb3f5956b099
SHA1d636daf64d524f81367ea92fdafa3726c909bee1
SHA256552aa0f82f37c9601114974228d4fc54f7434fe3ae7a276ef1ae98a0f608f1d0
SHA51260272801909dbba21578b22c49f6b0ba8cd0070f116476ff35b3ac8347b987790e4cc0334724244c4b13415a246e77a577230029e4561ae6f04a598c3f536c7e
-
Filesize
40KB
MD5c33afb4ecc04ee1bcc6975bea49abe40
SHA1fbea4f170507cde02b839527ef50b7ec74b4821f
SHA256a0356696877f2d94d645ae2df6ce6b370bd5c0d6db3d36def44e714525de0536
SHA5120d435f0836f61a5ff55b78c02fa47b191e5807a79d8a6e991f3115743df2141b3db42ba8bdad9ad259e12f5800828e9e72d7c94a6a5259312a447d669b03ec44
-
Filesize
36KB
MD5ff70cc7c00951084175d12128ce02399
SHA175ad3b1ad4fb14813882d88e952208c648f1fd18
SHA256cb5da96b3dfcf4394713623dbf3831b2a0b8be63987f563e1c32edeb74cb6c3a
SHA512f01df3256d49325e5ec49fd265aa3f176020c8ffec60eb1d828c75a3fa18ff8634e1de824d77dfdd833768acff1f547303104620c70066a2708654a07ef22e19
-
Filesize
38KB
MD5e79d7f2833a9c2e2553c7fe04a1b63f4
SHA13d9f56d2381b8fe16042aa7c4feb1b33f2baebff
SHA256519ad66009a6c127400c6c09e079903223bd82ecc18ad71b8e5cd79f5f9c053e
SHA512e0159c753491cac7606a7250f332e87bc6b14876bc7a1cf5625fa56ab4f09c485f7b231dd52e4ff0f5f3c29862afb1124c0efd0741613eb97a83cbe2668af5de
-
Filesize
37KB
MD5fa948f7d8dfb21ceddd6794f2d56b44f
SHA1ca915fbe020caa88dd776d89632d7866f660fc7a
SHA256bd9f4b3aedf4f81f37ec0a028aabcb0e9a900e6b4de04e9271c8db81432e2a66
SHA5120d211bfb0ae953081dca00cd07f8c908c174fd6c47a8001fadc614203f0e55d9fbb7fa9b87c735d57101341ab36af443918ee00737ed4c19ace0a2b85497f41a
-
Filesize
50KB
MD5313e0ececd24f4fa1504118a11bc7986
SHA1e1b9ae804c7fb1d27f39db18dc0647bb04e75e9d
SHA25670c0f32ed379ae899e5ac975e20bbbacd295cf7cd50c36174d2602420c770ac1
SHA512c7500363c61baf8b77fce796d750f8f5e6886ff0a10f81c3240ea3ad4e5f101b597490dea8ab6bd9193457d35d8fd579fce1b88a1c8d85ebe96c66d909630730
-
Filesize
46KB
MD5452615db2336d60af7e2057481e4cab5
SHA1442e31f6556b3d7de6eb85fbac3d2957b7f5eac6
SHA25602932052fafe97e6acaaf9f391738a3a826f5434b1a013abbfa7a6c1ade1e078
SHA5127613dc329abe7a3f32164c9a6b660f209a84b774ab9c008bf6503c76255b30ea9a743a6dc49a8de8df0bcb9aea5a33f7408ba27848d9562583ff51991910911f
-
Filesize
40KB
MD5c911aba4ab1da6c28cf86338ab2ab6cc
SHA1fee0fd58b8efe76077620d8abc7500dbfef7c5b0
SHA256e64178e339c8e10eac17a236a67b892d0447eb67b1dcd149763dad6fd9f72729
SHA5123491ed285a091a123a1a6d61aafbb8d5621ccc9e045a237a2f9c2cf6049e7420eb96ef30fdcea856b50454436e2ec468770f8d585752d73fafd676c4ef5e800a
-
Filesize
36KB
MD58d61648d34cba8ae9d1e2a219019add1
SHA12091e42fc17a0cc2f235650f7aad87abf8ba22c2
SHA25672f20024b2f69b45a1391f0a6474e9f6349625ce329f5444aec7401fe31f8de1
SHA51268489c33ba89edfe2e3aebaacf8ef848d2ea88dcbef9609c258662605e02d12cfa4ffdc1d266fc5878488e296d2848b2cb0bbd45f1e86ef959bab6162d284079
-
Filesize
37KB
MD5c7a19984eb9f37198652eaf2fd1ee25c
SHA106eafed025cf8c4d76966bf382ab0c5e1bd6a0ae
SHA256146f61db72297c9c0facffd560487f8d6a2846ecec92ecc7db19c8d618dbc3a4
SHA51243dd159f9c2eac147cbff1dda83f6a83dd0c59d2d7acac35ba8b407a04ec9a1110a6a8737535d060d100ede1cb75078cf742c383948c9d4037ef459d150f6020
-
Filesize
11.7MB
MD5d73fbaf39bce3aa5fcecb1a514ef74ab
SHA1638f39495ce1149354fb978c26b20bc0ecac21fb
SHA25682313c3e09ba55083728663d7c1b491423f5ffa13dcfd52c7ebd4807895effaa
SHA512cfd787d902fdab2f13fdcedaf6d54ffd5ea5c4b7ad20b8e426384fc448315aa24ab719239d69313914d7bc7378a8d881769f51cf9e1f63519bdfbd4b466f1453
-
Filesize
239KB
MD53ad6374a3558149d09d74e6af72344e3
SHA1e7be9f22578027fc0b6ddb94c09b245ee8ce1620
SHA25686a391fe7a237f4f17846c53d71e45820411d1a9a6e0c16f22a11ebc491ff9ff
SHA51221c21b36be200a195bfa648e228c64e52262b06d19d294446b8a544ff1d81f81eb2af74ddbdebc59915168db5dba76d0f0585e83471801d9ee37e59af0620720
-
Filesize
228B
MD5fa3374f52c14a969c628a0b9898935ba
SHA12125b2297e81491ff74004202a697fc560030f40
SHA256f4f781121f08d2b7264b09bb87c50a5afc0de6268856be4227d19de331d59cdc
SHA51293fb5d4d7bdb87aec0929d27032416eaab30dc300544cb845f292c2a216793ce724729e2c1327103277fdbe1d05edf8cfe016519213e1f79760c6faa1e829a82
-
Filesize
538KB
MD5e8fb95ebb7e0db4c68a32947a74b5ff9
SHA16f93f85342aa3ea7dcbe69cfb55d48e5027b296c
SHA25633ca487a65d38bad82dccfa0d076bad071466e4183562d0b1ad1a2e954667fe9
SHA512a2dea77b0283f4ed987c4de8860a9822bfd030be9c3096cda54f6159a89d461099e58efbc767bb8c04ae21ddd4289da578f8d938d78f30d40f9bca6567087320
-
Filesize
3.3MB
MD5efe76bf09daba2c594d2bc173d9b5cf0
SHA1ba5de52939cb809eae10fdbb7fac47095a9599a7
SHA256707a9f323556179571bc832e34fa592066b1d5f2cac4a7426fe163597e3e618a
SHA5124a1df71925cf2eb49c38f07c6a95bea17752b025f0114c6fd81bc0841c1d1f2965b5dda1469e454b9e8207c2e0dfd3df0959e57166620ccff86eeeb5cf855029
-
Filesize
26B
MD5fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1d59fc84cdd5217c6cf74785703655f78da6b582b
SHA256eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
SHA512aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
-
Filesize
2.3MB
MD55641d280a62b66943bf2d05a72a972c7
SHA1c857f1162c316a25eeff6116e249a97b59538585
SHA256ab14c3f5741c06ad40632447b2fc10662d151afb32066a507aab4ec866ffd488
SHA5120633bc32fa6d31b4c6f04171002ad5da6bb83571b9766e5c8d81002037b4bc96e86eb059d35cf5ce17a1a75767461ba5ac0a89267c3d0e5ce165719ca2af1752
-
Filesize
256B
MD5c5e12f7fc581af050446fcf5666b8068
SHA1958dd7e1dbd90e1fe1ad6078a4e418cceba5355a
SHA25655389b755e7cf5e979cfc99db3c29292e72ea8e70ee57e464999c7994997aef0
SHA51244c73fbd920bbd550d5a90c8d8425ed5028c5805e591532e1da9cd4cd046440bb3f8e3af70c0839c3a6eb23deabec9bd3c3be994b647e4b6c747be6cfa1df2a0