wannacry | 2e67d5e7d96aec62a9dda4c0259167a44908af863c2b3af2a019723205abba9e

Processes:

reg.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\qyrzxkvzsxw219 = "\"C:\\Users\\Admin\\Videos\\Ransomware.WannaCry\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service
T1102

Processes:

flow ioc

201 raw.githubusercontent.com
202 raw.githubusercontent.com
203 raw.githubusercontent.com
204 raw.githubusercontent.com

flow	ioc
201	raw.githubusercontent.com
202	raw.githubusercontent.com
203	raw.githubusercontent.com
204	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 2 IoCs

Processes:

taskmgr.exe

description	ioc	process
File created	C:\Windows\rescache\_merged\4183903823\2290032291.pri	taskmgr.exe
File created	C:\Windows\rescache\_merged\1601268389\715946058.pri	taskmgr.exe

Detects Pyinstaller 1 IoCs

pyinstaller

Processes:

resource	yara_rule
C:\Users\Admin\Videos\Skibidi Potty download\Skibidi Potty\main.exe	pyinstaller

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 7 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

Peripheral Device Discovery

T1120

System Information Discovery

Processes:

main.exetaskmgr.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_QEMU&PROD_QEMU_DVD-ROM\4&215468A5&0&010000	main.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_QEMU&Prod_QEMU_DVD-ROM\4&215468a5&0&010000\ConfigFlags	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_QEMU&PROD_HARDDISK\4&215468A5&0&000000	main.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	main.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_QEMU&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Checks processor information in registry 2 TTPs 22 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

firefox.exefirefox.exefirefox.exefirefox.exePOWERPNT.EXEPOWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

System Information Discovery

Processes:

POWERPNT.EXEPOWERPNT.EXE

description	ioc	process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	POWERPNT.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	POWERPNT.EXE

Interacts with shadow copies 3 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1070.004

Inhibit System Recovery
T1490

Direct Volume Access
T1006

Processes:

vssadmin.exe

pid process

3352 vssadmin.exe

pid	process
3352	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 32 IoCs

adware spyware

Modify Registry

Processes:

iexplore.exeIEXPLORE.EXE

description	ioc	process
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "31118919"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = 906d355f47d6da01	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d020475f47d6da01	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "1572461269"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "31118919"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048d228bcd8e80943b4eaf07d679acce50000000002000000000010660000000100002000000054b5cadbd057f46cf9844afe22fd114b2176f383b336940f96cac240f01520d9000000000e8000000002000020000000f2393d862aaa607db1cd6adac2488dd7510c0c974b4e8e5556dec3183a6fa5f8200000003ec26041da6d89baa0f4a886abecc500c68e876d3f686dc9901d3e13b0cbc14e400000006240c48a5f440a48e2457ec896a18fbe07e9bed88e41c60ef1732cfca0a87cfe362879469268985115504606ab4f014bd492be1f0922c76ee44e8ca50974b74f	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "1"	iexplore.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main	IEXPLORE.EXE
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU	IEXPLORE.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\GPU\AdapterInfo = "vendorId=\"0x10de\",deviceID=\"0x8c\",subSysID=\"0x0\",revision=\"0x0\",version=\"10.0.15063.0\"hypervisor=\"No Hypervisor (No SLAT)\""	IEXPLORE.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "1572461269"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{895F51B7-423A-11EF-8A80-7ACE63468C9D} = "0"	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MINIE\TabBandWidth = "500"	iexplore.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50"	iexplore.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb0100000048d228bcd8e80943b4eaf07d679acce50000000002000000000010660000000100002000000084f0e4feca6708b5a043e13b0e841f2699a7d25f20f01aacc4b5f79a24cbfb38000000000e8000000002000020000000ee4d386a9fd0c3f24e076d325d6e06a6b2a174bf59cb7997d3405ad9d564d67c20000000a17743fd419686f675df7a25d18f1bdd6b7aaf1f6fb10367c02bd97aea4a5c0e400000009fb770000545d2f773fe190cc8c492e94eaa1eb372757ca1cfd3df3b3949ac3e014886c4d04afa748cbf6bd24daea6b8d303cab82ed8354a4a29ebba9d5c83b5	iexplore.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000\Software\Microsoft\Internet Explorer\MINIE	iexplore.exe

Modifies registry class 3 IoCs

Processes:

firefox.exefirefox.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3968772205-1713802336-1776639840-1000_Classes\Local Settings	OpenWith.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

3700 reg.exe

pid	process
3700	reg.exe

NTFS ADS 2 IoCs

Processes:

firefox.exefirefox.exe

description	ioc	process
File created	C:\Users\Admin\Downloads\Skibidi Potty download.zip:Zone.Identifier	firefox.exe
File created	C:\Users\Admin\Downloads\Ransomware.WannaCry.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

Processes:

POWERPNT.EXEPOWERPNT.EXE

pid process

3164 POWERPNT.EXE
6104 POWERPNT.EXE

pid	process
3164	POWERPNT.EXE
6104	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 22 IoCs

Processes:

taskhsvc.exetaskmgr.exe

pid	process
2308	taskhsvc.exe
2308	taskhsvc.exe
2308	taskhsvc.exe
2308	taskhsvc.exe
2308	taskhsvc.exe
2308	taskhsvc.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

5976 OpenWith.exe

pid	process
5976	OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

firefox.exe7zG.exeAUDIODG.EXEfirefox.exe7zG.exevssvc.exeWMIC.exetaskse.exetaskse.exe

description	pid	process
Token: SeDebugPrivilege	168	firefox.exe
Token: SeDebugPrivilege	168	firefox.exe
Token: SeDebugPrivilege	168	firefox.exe
Token: SeRestorePrivilege	32	7zG.exe
Token: 35	32	7zG.exe
Token: SeSecurityPrivilege	32	7zG.exe
Token: SeSecurityPrivilege	32	7zG.exe
Token: 33	2916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2916	AUDIODG.EXE
Token: SeDebugPrivilege	4708	firefox.exe
Token: SeDebugPrivilege	4708	firefox.exe
Token: SeDebugPrivilege	4708	firefox.exe
Token: SeRestorePrivilege	2628	7zG.exe
Token: 35	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeSecurityPrivilege	2628	7zG.exe
Token: SeBackupPrivilege	1124	vssvc.exe
Token: SeRestorePrivilege	1124	vssvc.exe
Token: SeAuditPrivilege	1124	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe
Token: SeSecurityPrivilege	4564	WMIC.exe
Token: SeTakeOwnershipPrivilege	4564	WMIC.exe
Token: SeLoadDriverPrivilege	4564	WMIC.exe
Token: SeSystemProfilePrivilege	4564	WMIC.exe
Token: SeSystemtimePrivilege	4564	WMIC.exe
Token: SeProfSingleProcessPrivilege	4564	WMIC.exe
Token: SeIncBasePriorityPrivilege	4564	WMIC.exe
Token: SeCreatePagefilePrivilege	4564	WMIC.exe
Token: SeBackupPrivilege	4564	WMIC.exe
Token: SeRestorePrivilege	4564	WMIC.exe
Token: SeShutdownPrivilege	4564	WMIC.exe
Token: SeDebugPrivilege	4564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4564	WMIC.exe
Token: SeRemoteShutdownPrivilege	4564	WMIC.exe
Token: SeUndockPrivilege	4564	WMIC.exe
Token: SeManageVolumePrivilege	4564	WMIC.exe
Token: 33	4564	WMIC.exe
Token: 34	4564	WMIC.exe
Token: 35	4564	WMIC.exe
Token: 36	4564	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4564	WMIC.exe
Token: SeSecurityPrivilege	4564	WMIC.exe
Token: SeTakeOwnershipPrivilege	4564	WMIC.exe
Token: SeLoadDriverPrivilege	4564	WMIC.exe
Token: SeSystemProfilePrivilege	4564	WMIC.exe
Token: SeSystemtimePrivilege	4564	WMIC.exe
Token: SeProfSingleProcessPrivilege	4564	WMIC.exe
Token: SeIncBasePriorityPrivilege	4564	WMIC.exe
Token: SeCreatePagefilePrivilege	4564	WMIC.exe
Token: SeBackupPrivilege	4564	WMIC.exe
Token: SeRestorePrivilege	4564	WMIC.exe
Token: SeShutdownPrivilege	4564	WMIC.exe
Token: SeDebugPrivilege	4564	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4564	WMIC.exe
Token: SeRemoteShutdownPrivilege	4564	WMIC.exe
Token: SeUndockPrivilege	4564	WMIC.exe
Token: SeManageVolumePrivilege	4564	WMIC.exe
Token: 33	4564	WMIC.exe
Token: 34	4564	WMIC.exe
Token: 35	4564	WMIC.exe
Token: 36	4564	WMIC.exe
Token: SeTcbPrivilege	3352	taskse.exe
Token: SeTcbPrivilege	3352	taskse.exe
Token: SeTcbPrivilege	6004	taskse.exe

Suspicious use of FindShellTrayWindow 61 IoCs

Processes:

firefox.exe7zG.exefirefox.exe7zG.exeiexplore.exe@[email protected]taskmgr.exe

pid	process
168	firefox.exe
168	firefox.exe
168	firefox.exe
168	firefox.exe
32	7zG.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
2628	7zG.exe
5680	iexplore.exe
4884	@[email protected]
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe

Suspicious use of SendNotifyMessage 55 IoCs

Processes:

firefox.exefirefox.exetaskmgr.exe

pid	process
168	firefox.exe
168	firefox.exe
168	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
5452	taskmgr.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe

Suspicious use of SetWindowsHookEx 35 IoCs

Processes:

firefox.exemain.exefirefox.exe@[email protected]@[email protected]@[email protected]POWERPNT.EXEiexplore.exeIEXPLORE.EXEPOWERPNT.EXE@[email protected]@[email protected]OpenWith.exe@[email protected]

pid	process
168	firefox.exe
168	firefox.exe
168	firefox.exe
168	firefox.exe
2724	main.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4708	firefox.exe
4492	@[email protected]
4492	@[email protected]
2028	@[email protected]
2028	@[email protected]
4884	@[email protected]
4884	@[email protected]
3164	POWERPNT.EXE
3164	POWERPNT.EXE
3164	POWERPNT.EXE
3164	POWERPNT.EXE
5680	iexplore.exe
5680	iexplore.exe
5732	IEXPLORE.EXE
5732	IEXPLORE.EXE
5732	IEXPLORE.EXE
6104	POWERPNT.EXE
6104	POWERPNT.EXE
6104	POWERPNT.EXE
6104	POWERPNT.EXE
3380	@[email protected]
5800	@[email protected]
5976	OpenWith.exe
6020	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

firefox.exefirefox.exe

description	pid	process	target process
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 2432 wrote to memory of 168	2432	firefox.exe	firefox.exe
PID 168 wrote to memory of 2396	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 2396	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4712	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4252	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4252	168	firefox.exe	firefox.exe
PID 168 wrote to memory of 4252	168	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

3560 attrib.exe
4816 attrib.exe

pid	process
3560	attrib.exe
4816	attrib.exe

C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe
"C:\Users\Admin\AppData\Local\Temp\AutoClicker-3.0.exe"
1⤵
PID:220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2432

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:168

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.0.1390752681\1833914688" -parentBuildID 20221007134813 -prefsHandle 1656 -prefMapHandle 1696 -prefsLen 20747 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {002fbd13-e0b8-464b-a4a2-08b033af4954} 168 "\\.\pipe\gecko-crash-server-pipe.168" 1780 24c1e8d5858 gpu
3⤵
PID:2396

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.1.1528297826\287416048" -parentBuildID 20221007134813 -prefsHandle 2108 -prefMapHandle 2104 -prefsLen 20828 -prefMapSize 233444 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d883323c-2a15-4e6f-a8a7-aaf0c37ecf47} 168 "\\.\pipe\gecko-crash-server-pipe.168" 2120 24c0c46f558 socket
3⤵
- Checks processor information in registry
PID:4712

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.2.688368421\266884137" -childID 1 -isForBrowser -prefsHandle 2896 -prefMapHandle 2792 -prefsLen 20931 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {819cdd32-844a-4920-bfca-64cd26deab7d} 168 "\\.\pipe\gecko-crash-server-pipe.168" 2740 24c22b9ab58 tab
3⤵
PID:4252

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.3.7484687\1301088879" -childID 2 -isForBrowser -prefsHandle 3492 -prefMapHandle 3496 -prefsLen 26109 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {75118ced-ce4f-46b8-a831-3bcf5b8c56b1} 168 "\\.\pipe\gecko-crash-server-pipe.168" 3516 24c210e0758 tab
3⤵
PID:4856

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.4.1878449739\1434146371" -childID 3 -isForBrowser -prefsHandle 4136 -prefMapHandle 4128 -prefsLen 26168 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {994f7c05-6a2d-40a4-a949-c36dd12053ef} 168 "\\.\pipe\gecko-crash-server-pipe.168" 4140 24c24958858 tab
3⤵
PID:768

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.5.1186959436\1790211099" -childID 4 -isForBrowser -prefsHandle 4792 -prefMapHandle 4804 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8c92d161-3a21-426a-a731-078bad4ed082} 168 "\\.\pipe\gecko-crash-server-pipe.168" 4856 24c25035558 tab
3⤵
PID:1920

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.6.772722308\1104491343" -childID 5 -isForBrowser -prefsHandle 4992 -prefMapHandle 4996 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {17df066b-055c-4cba-ab3a-92eabdc2759c} 168 "\\.\pipe\gecko-crash-server-pipe.168" 4984 24c25034f58 tab
3⤵
PID:4300

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.7.1124954304\1426583766" -childID 6 -isForBrowser -prefsHandle 5188 -prefMapHandle 5192 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {07a6fcdd-9b1b-4122-9778-f463d2643e34} 168 "\\.\pipe\gecko-crash-server-pipe.168" 5272 24c255b2a58 tab
3⤵
PID:3388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.8.1967949394\126685161" -childID 7 -isForBrowser -prefsHandle 5576 -prefMapHandle 5572 -prefsLen 26249 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {919f1e6f-3969-48d1-a237-cdebec432268} 168 "\\.\pipe\gecko-crash-server-pipe.168" 5588 24c27169b58 tab
3⤵
PID:3672

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="168.9.731903841\482561555" -childID 8 -isForBrowser -prefsHandle 4960 -prefMapHandle 3092 -prefsLen 26689 -prefMapSize 233444 -jsInitHandle 1320 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1824d68e-9460-4682-9ae1-9b5f0a0e2f9a} 168 "\\.\pipe\gecko-crash-server-pipe.168" 4944 24c2710f558 tab
3⤵
PID:2640

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2388

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Videos\Skibidi Potty download\" -ad -an -ai#7zMap31042:100:7zEvent24202
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:32

C:\Users\Admin\Videos\Skibidi Potty download\Skibidi Potty\main.exe
"C:\Users\Admin\Videos\Skibidi Potty download\Skibidi Potty\main.exe"
1⤵
- Executes dropped EXE
PID:208

C:\Users\Admin\Videos\Skibidi Potty download\Skibidi Potty\main.exe
"C:\Users\Admin\Videos\Skibidi Potty download\Skibidi Potty\main.exe"
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious use of SetWindowsHookEx
PID:2724

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2e0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2916

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4708

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.0.2143375915\1741871530" -parentBuildID 20221007134813 -prefsHandle 1604 -prefMapHandle 1596 -prefsLen 21136 -prefMapSize 233536 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4464acc9-da0c-4dce-aa61-b5c7e6e1807f} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 1684 140192fbc58 gpu
3⤵
PID:4084

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.1.1713498910\28211005" -parentBuildID 20221007134813 -prefsHandle 1984 -prefMapHandle 1980 -prefsLen 21181 -prefMapSize 233536 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {8568b5db-b0e9-4d20-9b60-d357f40c592c} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 2004 14018f3a658 socket
3⤵
- Checks processor information in registry
PID:1388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.2.455038734\472764708" -childID 1 -isForBrowser -prefsHandle 2712 -prefMapHandle 2708 -prefsLen 21642 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fc70c856-f111-45f0-8411-534f92605e09} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 2724 1401ce43658 tab
3⤵
PID:2352

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.3.1177385084\1582133335" -childID 2 -isForBrowser -prefsHandle 3432 -prefMapHandle 3428 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a30fb620-9bf4-49e6-ae79-c034a8b58475} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3448 1401e210058 tab
3⤵
PID:1736

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.4.1392636856\2102661403" -childID 3 -isForBrowser -prefsHandle 3680 -prefMapHandle 3684 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d5bd646b-13d6-484f-8f62-9bc4a3782576} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3668 1401e210f58 tab
3⤵
PID:2436

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.5.998256649\2059483176" -childID 4 -isForBrowser -prefsHandle 4552 -prefMapHandle 4548 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f78f731e-46bd-4ace-9d3c-fc1b2898b92c} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 4564 1400e366858 tab
3⤵
PID:4688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.6.1597047583\817567447" -childID 5 -isForBrowser -prefsHandle 4700 -prefMapHandle 4704 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {a195c29b-1687-4cef-8bd2-ea536af9c45a} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 4692 1401f4c2c58 tab
3⤵
PID:2608

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.7.830734872\1871054306" -childID 6 -isForBrowser -prefsHandle 4892 -prefMapHandle 4896 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1683c3a1-b1d4-4913-b31f-55853bb632b4} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 4884 14020236c58 tab
3⤵
PID:1840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.8.920809263\1610715815" -childID 7 -isForBrowser -prefsHandle 3916 -prefMapHandle 3912 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4039e5fc-4d14-49d8-ab74-a41b61ea7b28} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 3936 1401e61bc58 tab
3⤵
PID:2688

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="4708.9.62709269\492481484" -childID 8 -isForBrowser -prefsHandle 5172 -prefMapHandle 4676 -prefsLen 26820 -prefMapSize 233536 -jsInitHandle 1308 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {619eead8-8bf8-4b18-8b35-07d33b41e783} 4708 "\\.\pipe\gecko-crash-server-pipe.4708" 5180 14020e75458 tab
3⤵
PID:1256

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Videos\Ransomware.WannaCry\" -ad -an -ai#7zMap488:94:7zEvent18473
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2628

C:\Users\Admin\Videos\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Videos\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:1280

C:\Windows\SysWOW64\attrib.exe
attrib +h .
2⤵
- Views/modifies file attributes
PID:3560

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
2⤵
- Modifies file permissions
PID:592

C:\Users\Admin\Videos\Ransomware.WannaCry\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:356

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 282981721000416.bat
2⤵
PID:348

C:\Windows\SysWOW64\cscript.exe
cscript.exe //nologo m.vbs
3⤵
PID:4320

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
2⤵
- Views/modifies file attributes
PID:4816

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected] co
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:4492

C:\Users\Admin\Videos\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:2308

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
2⤵
PID:2112

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected] vs
3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2028

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
PID:3700

C:\Windows\SysWOW64\vssadmin.exe
vssadmin delete shadows /all /quiet
5⤵
- Interacts with shadow copies
PID:3352

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- Suspicious use of AdjustPrivilegeToken
PID:4564

C:\Users\Admin\Videos\Ransomware.WannaCry\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:1728

C:\Users\Admin\Videos\Ransomware.WannaCry\taskse.exe
taskse.exe C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3352

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4884

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\Videos\Ransomware.WannaCry\tasksche.exe\"" /f
2⤵
PID:820

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "qyrzxkvzsxw219" /t REG_SZ /d "\"C:\Users\Admin\Videos\Ransomware.WannaCry\tasksche.exe\"" /f
3⤵
- Adds Run key to start application
- Modifies registry key
PID:3700

C:\Users\Admin\Videos\Ransomware.WannaCry\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5992

C:\Users\Admin\Videos\Ransomware.WannaCry\taskse.exe
taskse.exe C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:6004

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:3380

C:\Users\Admin\Videos\Ransomware.WannaCry\taskse.exe
taskse.exe C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
2⤵
- Executes dropped EXE
PID:5808

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5800

C:\Users\Admin\Videos\Ransomware.WannaCry\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:5876

C:\Users\Admin\Videos\Ransomware.WannaCry\taskse.exe
taskse.exe C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
2⤵
- Executes dropped EXE
PID:2964

C:\Users\Admin\Videos\Ransomware.WannaCry\@[email protected]
@[email protected]
2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:6020

C:\Users\Admin\Videos\Ransomware.WannaCry\taskdl.exe
taskdl.exe
2⤵
- Executes dropped EXE
PID:6032

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1124

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\CopySync.odp" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:3164

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" -nohome
1⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5680

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:5680 CREDAT:82945 /prefetch:2
2⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:5732

C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE
"C:\Program Files\Microsoft Office\Root\Office16\POWERPNT.EXE" "C:\Users\Admin\Desktop\CopySync.odp" /ou ""
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:6104

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /4
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:5452

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Peripheral Device Discovery

T1120

Query Registry

System Information Discovery