wannacry | hxxps://github[.]com/Endermanch/MalwareDatabase/blob/master/ransomwares/PowerPoint[.]zip

Resubmissions

08-07-2024 19:27

240708-x55q1avdnk 8

07-07-2024 21:20

240707-z6stya1blf 10

Analysis

max time kernel
137s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20240704-en
resource tags

arch:x64arch:x86image:win11-20240704-enlocale:en-usos:windows11-21h2-x64system
submitted
07-07-2024 21:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/PowerPoint.zip

Score

10^/10

wannacry defense_evasion discovery ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94 Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

13AM4VW2dhxYgXeQepoHkHSQuy6NgaEb94

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD8805.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD882B.tmp	[email protected]

Executes dropped EXE 2 IoCs

pid	Process
2116	taskdl.exe
1372	@[email protected]

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1464	icacls.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 9 IoCs

Web Service

T1102

flow	ioc
3	camo.githubusercontent.com
5	camo.githubusercontent.com
12	camo.githubusercontent.com
12	raw.githubusercontent.com
34	camo.githubusercontent.com
36	raw.githubusercontent.com
2	raw.githubusercontent.com
5	raw.githubusercontent.com
58	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 20 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-1300643590-245460719-3687711119-1000_Classes\Local Settings	firefox.exe

NTFS ADS 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCrypt0r.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\AdAvenger.zip:Zone.Identifier	firefox.exe

Suspicious use of AdjustPrivilegeToken 6 IoCs

description	pid	Process
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	1572	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe
Token: SeDebugPrivilege	4140	firefox.exe

Suspicious use of FindShellTrayWindow 9 IoCs

pid	Process
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe

Suspicious use of SendNotifyMessage 7 IoCs

pid	Process
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe

Suspicious use of SetWindowsHookEx 13 IoCs

pid	Process
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
1572	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
4140	firefox.exe
1372	@[email protected]
1372	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 2068 wrote to memory of 1572	2068	firefox.exe	80
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 2816	1572	firefox.exe	82
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83
PID 1572 wrote to memory of 4828	1572	firefox.exe	83

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
5020	attrib.exe
4840	attrib.exe

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/PowerPoint.zip"
1⤵
- Suspicious use of WriteProcessMemory
PID:2068
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Endermanch/MalwareDatabase/blob/master/ransomwares/PowerPoint.zip
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1572
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.0.1310273726\2130250367" -parentBuildID 20230214051806 -prefsHandle 1740 -prefMapHandle 1732 -prefsLen 22074 -prefMapSize 235121 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df36c93b-eb28-403d-af8a-e0d8dfda7474} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 1832 1cafbdef458 gpu
    3⤵
    PID:2816
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.1.1091662015\971278438" -parentBuildID 20230214051806 -prefsHandle 2364 -prefMapHandle 2360 -prefsLen 22925 -prefMapSize 235121 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {3a6f0dc9-d681-4667-bf00-0ac51e7843a7} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 2376 1caf008ab58 socket
    3⤵
    - Checks processor information in registry
    PID:4828
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.2.1684326777\1938648546" -childID 1 -isForBrowser -prefsHandle 2836 -prefMapHandle 2980 -prefsLen 23028 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5385ae16-abdf-474e-99c2-5fd40c82d1d1} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 2824 1caffe31b58 tab
    3⤵
    PID:1304
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.3.475329515\868402237" -childID 2 -isForBrowser -prefsHandle 3776 -prefMapHandle 3772 -prefsLen 27614 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {22278fde-0e91-42a9-91f6-d2458c3ada8d} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 3788 1cb0274fb58 tab
    3⤵
    PID:2296
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.4.529614455\1665569839" -childID 3 -isForBrowser -prefsHandle 5008 -prefMapHandle 5288 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b95db3da-7e23-43ae-9974-ee2f24694876} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 5328 1caff878f58 tab
    3⤵
    PID:764
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.5.106003937\2111044019" -childID 4 -isForBrowser -prefsHandle 5356 -prefMapHandle 5352 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6cd3e1fa-f29f-42e6-9c6d-bdb450aa7d8d} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 5364 1cb02751058 tab
    3⤵
    PID:3724
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="1572.6.1389677008\1044898674" -childID 5 -isForBrowser -prefsHandle 5468 -prefMapHandle 5364 -prefsLen 27695 -prefMapSize 235121 -jsInitHandle 1360 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {da883a97-07eb-4da7-afa1-06ef0bdaf4b0} 1572 "\\.\pipe\gecko-crash-server-pipe.1572" 5548 1cb03040658 tab
    3⤵
    PID:5076

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1072

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:4124
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:4140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.0.2142611635\1891714724" -parentBuildID 20230214051806 -prefsHandle 1656 -prefMapHandle 1648 -prefsLen 22475 -prefMapSize 235161 -appDir "C:\Program Files\Mozilla Firefox\browser" - {def1fac7-58ee-40d5-a99f-a0cabe4cfe8f} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 1764 1631ef28858 gpu
    3⤵
    PID:2100
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.1.1039828475\1008974836" -parentBuildID 20230214051806 -prefsHandle 2200 -prefMapHandle 2196 -prefsLen 22475 -prefMapSize 235161 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2ff2a864-9f82-4050-bfb7-ceaab00aa0bd} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 2212 16312c89658 socket
    3⤵
    - Checks processor information in registry
    PID:4824
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.2.1509346519\687117998" -childID 1 -isForBrowser -prefsHandle 3056 -prefMapHandle 2788 -prefsLen 22871 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {0b2a9765-a4d5-42e1-97f5-c908d2d57d86} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 2712 16322e2f858 tab
    3⤵
    PID:3276
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.3.1640496727\1329996510" -childID 2 -isForBrowser -prefsHandle 3624 -prefMapHandle 3640 -prefsLen 28337 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fec924f2-5918-4577-a96c-407e28e1c44e} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 3020 16312c7ae58 tab
    3⤵
    PID:3388
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.4.2064356629\940225358" -childID 3 -isForBrowser -prefsHandle 5060 -prefMapHandle 5064 -prefsLen 28337 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {53e77c9f-3536-4d04-8d0c-1b6ef9927b4a} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 5072 16328bbbd58 tab
    3⤵
    PID:4116
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.5.1577738187\293693550" -childID 4 -isForBrowser -prefsHandle 5256 -prefMapHandle 5260 -prefsLen 28337 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {7dc966e7-881a-45c5-8972-7f4d877e2b65} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 5248 16328bbc058 tab
    3⤵
    PID:2580
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.6.848065428\735714836" -childID 5 -isForBrowser -prefsHandle 5456 -prefMapHandle 5460 -prefsLen 28337 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b8fb0522-f960-4a7b-99d6-02beee903907} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 5444 16328bbae58 tab
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4140.7.664411929\1521524566" -childID 6 -isForBrowser -prefsHandle 5756 -prefMapHandle 5668 -prefsLen 28337 -prefMapSize 235161 -jsInitHandle 1296 -jsInitLen 246560 -a11yResourceId 64 -parentBuildID 20230214051806 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {95ae3ef7-fb84-4650-a948-12cf07a71f5c} 4140 "\\.\pipe\gecko-crash-server-pipe.4140" 5752 16329809358 tab
    3⤵
    PID:1828

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
1⤵
- Drops startup file
PID:1872
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - Views/modifies file attributes
  PID:5020
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  PID:1464
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 97151720387382.bat
  2⤵
  PID:3296
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    PID:3976
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - Views/modifies file attributes
  PID:4840

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:1372

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control