wannacry | hxxps://robux-2019-win-free-robux[.]soft112[.]com

Analysis

max time kernel
701s
max time network
703s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-08-2024 05:33

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

https://robux-2019-win-free-robux.soft112.com

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

WannaCry.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDEE8E.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDEEA5.tmp	WannaCry.exe

Executes dropped EXE 4 IoCs

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid process

388 !WannaDecryptor!.exe
3292 !WannaDecryptor!.exe
2704 !WannaDecryptor!.exe
5384 !WannaDecryptor!.exe

pid	process
388	!WannaDecryptor!.exe
3292	!WannaDecryptor!.exe
2704	!WannaDecryptor!.exe
5384	!WannaDecryptor!.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WannaCry.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service
T1102

Processes:

flow ioc

761 raw.githubusercontent.com
762 raw.githubusercontent.com
763 raw.githubusercontent.com

flow	ioc
761	raw.githubusercontent.com
762	raw.githubusercontent.com
763	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.execscript.execmd.exeWMIC.exetaskkill.exe!WannaDecryptor!.execmd.exe!WannaDecryptor!.execmd.exetaskkill.exetaskkill.exetaskkill.exeWannaCry.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe

Checks processor information in registry 2 TTPs 36 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exefirefox.exefirefox.exedw20.exedw20.exedw20.exefirefox.exefirefox.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

dw20.exedw20.exedw20.exedw20.exedw20.exedw20.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

2688 taskkill.exe
944 taskkill.exe
1408 taskkill.exe
4644 taskkill.exe

pid	process
2688	taskkill.exe
944	taskkill.exe
1408	taskkill.exe
4644	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

Processes:

LogonUI.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "66"	LogonUI.exe

Modifies registry class 10 IoCs

Processes:

OpenWith.exefirefox.exemsedge.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\apk_auto_file	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\apk_auto_file\shell\open\command	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\apk_auto_file\shell\open\command\ = "\"C:\\Program Files\\Mozilla Firefox\\firefox.exe\" -osint -url \"%1\""	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\apk_auto_file\shell\open	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\apk_auto_file\shell	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{C09470E1-ADD8-4806-ABCE-86A0AFB675D6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\.apk	OpenWith.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000_Classes\.apk\ = "apk_auto_file"	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

OpenWith.exe

pid process

544 OpenWith.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

AUDIODG.EXEfirefox.exeWave Browser.exedw20.exedw20.exedw20.exedw20.exedw20.exedw20.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exe

description	pid	process
Token: 33	2416	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2416	AUDIODG.EXE
Token: SeDebugPrivilege	1008	firefox.exe
Token: SeDebugPrivilege	1008	firefox.exe
Token: SeDebugPrivilege	1008	firefox.exe
Token: SeDebugPrivilege	5484	Wave Browser.exe
Token: SeBackupPrivilege	5488	dw20.exe
Token: SeBackupPrivilege	5488	dw20.exe
Token: SeBackupPrivilege	6132	dw20.exe
Token: SeBackupPrivilege	6132	dw20.exe
Token: SeBackupPrivilege	5588	dw20.exe
Token: SeBackupPrivilege	5588	dw20.exe
Token: SeBackupPrivilege	4088	dw20.exe
Token: SeBackupPrivilege	4088	dw20.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	5416	dw20.exe
Token: SeBackupPrivilege	6124	dw20.exe
Token: SeBackupPrivilege	6124	dw20.exe
Token: SeDebugPrivilege	944	taskkill.exe
Token: SeDebugPrivilege	2688	taskkill.exe
Token: SeDebugPrivilege	1408	taskkill.exe
Token: SeDebugPrivilege	4644	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1516	WMIC.exe
Token: SeSecurityPrivilege	1516	WMIC.exe
Token: SeTakeOwnershipPrivilege	1516	WMIC.exe
Token: SeLoadDriverPrivilege	1516	WMIC.exe
Token: SeSystemProfilePrivilege	1516	WMIC.exe
Token: SeSystemtimePrivilege	1516	WMIC.exe
Token: SeProfSingleProcessPrivilege	1516	WMIC.exe
Token: SeIncBasePriorityPrivilege	1516	WMIC.exe
Token: SeCreatePagefilePrivilege	1516	WMIC.exe
Token: SeBackupPrivilege	1516	WMIC.exe
Token: SeRestorePrivilege	1516	WMIC.exe
Token: SeShutdownPrivilege	1516	WMIC.exe
Token: SeDebugPrivilege	1516	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1516	WMIC.exe
Token: SeRemoteShutdownPrivilege	1516	WMIC.exe
Token: SeUndockPrivilege	1516	WMIC.exe
Token: SeManageVolumePrivilege	1516	WMIC.exe
Token: 33	1516	WMIC.exe
Token: 34	1516	WMIC.exe
Token: 35	1516	WMIC.exe
Token: 36	1516	WMIC.exe

Suspicious use of FindShellTrayWindow 22 IoCs

Processes:

firefox.exe!WannaDecryptor!.exe

pid	process
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
5384	!WannaDecryptor!.exe

Suspicious use of SendNotifyMessage 20 IoCs

Processes:

firefox.exe

pid	process
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe

Suspicious use of SetWindowsHookEx 30 IoCs

Processes:

OpenWith.exefirefox.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeLogonUI.exe

pid	process
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
544	OpenWith.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
1008	firefox.exe
388	!WannaDecryptor!.exe
388	!WannaDecryptor!.exe
3292	!WannaDecryptor!.exe
3292	!WannaDecryptor!.exe
2704	!WannaDecryptor!.exe
2704	!WannaDecryptor!.exe
5384	!WannaDecryptor!.exe
5384	!WannaDecryptor!.exe
5360	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

OpenWith.exefirefox.exefirefox.exe

description	pid	process	target process
PID 544 wrote to memory of 3680	544	OpenWith.exe	firefox.exe
PID 544 wrote to memory of 3680	544	OpenWith.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 3680 wrote to memory of 1008	3680	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3944	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe
PID 1008 wrote to memory of 3728	1008	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://robux-2019-win-free-robux.soft112.com
1⤵
PID:4028

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=3048,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
1⤵
PID:2888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=4972,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=4988 /prefetch:1
1⤵
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=5348,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
1⤵
PID:2736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5512,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
1⤵
PID:4968

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5520,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
1⤵
PID:4724

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=15 --field-trial-handle=5524,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:1
1⤵
PID:4444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6056,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
1⤵
PID:2104

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=17 --field-trial-handle=6220,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6248 /prefetch:1
1⤵
PID:4820

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=6504,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
1⤵
PID:5068

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=19 --field-trial-handle=6664,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:1
1⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6032,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
1⤵
PID:540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=21 --field-trial-handle=7060,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
1⤵
PID:4928

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=7064,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:1
1⤵
PID:5040

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --field-trial-handle=7032,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:8
1⤵
PID:4616

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --field-trial-handle=6980,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
1⤵
- Modifies registry class
PID:3416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=25 --field-trial-handle=7280,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7184 /prefetch:1
1⤵
PID:1796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=7208,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
1⤵
PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=27 --field-trial-handle=7072,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:1
1⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=28 --field-trial-handle=7536,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
1⤵
PID:1468

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x300 0x4a4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2416

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7664,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7524 /prefetch:1
1⤵
PID:3536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7840,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8504 /prefetch:8
1⤵
PID:3736

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=31 --field-trial-handle=5852,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:1
1⤵
PID:3344

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=32 --field-trial-handle=7372,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7792 /prefetch:1
1⤵
PID:3112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=33 --field-trial-handle=7284,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7852 /prefetch:1
1⤵
PID:632

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=34 --field-trial-handle=6868,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7392 /prefetch:1
1⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=35 --field-trial-handle=8432,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:1
1⤵
PID:396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7236,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7616 /prefetch:8
1⤵
PID:5024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=37 --field-trial-handle=8364,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8652 /prefetch:1
1⤵
PID:2452

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=5764,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:8
1⤵
PID:1224

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\android-compromocodesrocashrblxgetfreerobuxfreewinspinrobux2k19-0.apk"
2⤵
- Suspicious use of WriteProcessMemory
PID:3680

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\android-compromocodesrocashrblxgetfreerobuxfreewinspinrobux2k19-0.apk
3⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1008

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2004 -parentBuildID 20240401114208 -prefsHandle 1888 -prefMapHandle 1880 -prefsLen 23680 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {43b0286a-8547-440f-979e-e2ede1685489} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" gpu
4⤵
PID:3944

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2436 -parentBuildID 20240401114208 -prefsHandle 2428 -prefMapHandle 2424 -prefsLen 24600 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c4aebff3-375f-4bfc-a130-656f7e465dfe} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" socket
4⤵
- Checks processor information in registry
PID:3728

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3156 -childID 1 -isForBrowser -prefsHandle 3148 -prefMapHandle 3144 -prefsLen 24741 -prefMapSize 244658 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {ecb3f742-cdaf-40f1-bac7-b351fee483ed} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" tab
4⤵
PID:1780

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3888 -childID 2 -isForBrowser -prefsHandle 3884 -prefMapHandle 3880 -prefsLen 29090 -prefMapSize 244658 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {4e605854-8b28-4823-b098-345710100b42} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" tab
4⤵
PID:640

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4976 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4980 -prefMapHandle 4988 -prefsLen 29144 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {326f6110-bf57-4982-8d0b-ff9d83048879} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" utility
4⤵
- Checks processor information in registry
PID:5828

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4972 -childID 3 -isForBrowser -prefsHandle 4936 -prefMapHandle 5204 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8f9ddb4-31b1-4a3e-aafc-777f70d97e4a} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" tab
4⤵
PID:5388

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5424 -childID 4 -isForBrowser -prefsHandle 5432 -prefMapHandle 5436 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {dbc26181-e8a2-4c93-a3d5-4939d8f20ac4} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" tab
4⤵
PID:5376

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5616 -childID 5 -isForBrowser -prefsHandle 5624 -prefMapHandle 5628 -prefsLen 27051 -prefMapSize 244658 -jsInitHandle 876 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5c3550ff-02ae-425d-b3a9-b5f28283dbdd} 1008 "\\.\pipe\gecko-crash-server-pipe.1008" tab
4⤵
PID:5544

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "C:\Users\Admin\Downloads\android-compromocodesrocashrblxgetfreerobuxfreewinspinrobux2k19-0.apk"
1⤵
PID:5732

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url C:\Users\Admin\Downloads\android-compromocodesrocashrblxgetfreerobuxfreewinspinrobux2k19-0.apk
2⤵
- Checks processor information in registry
PID:5748

C:\Users\Admin\Downloads\Wave Browser.exe
"C:\Users\Admin\Downloads\Wave Browser.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6268,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8556 /prefetch:8
1⤵
PID:5720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=40 --field-trial-handle=6284,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
1⤵
PID:5772

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=41 --field-trial-handle=7784,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8508 /prefetch:1
1⤵
PID:5840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=42 --field-trial-handle=7780,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=7404 /prefetch:1
1⤵
PID:4312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=43 --field-trial-handle=7672,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8580 /prefetch:1
1⤵
PID:2340

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=44 --field-trial-handle=6656,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:1
1⤵
PID:5916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=45 --field-trial-handle=7812,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:1
1⤵
PID:6116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=46 --field-trial-handle=7544,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8760 /prefetch:1
1⤵
PID:6080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=47 --field-trial-handle=8712,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
1⤵
PID:5268

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=48 --field-trial-handle=8448,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8220 /prefetch:1
1⤵
PID:5568

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=49 --field-trial-handle=8788,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9096 /prefetch:1
1⤵
PID:5576

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=50 --field-trial-handle=8656,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8936 /prefetch:1
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=51 --field-trial-handle=5740,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
1⤵
PID:5444

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=52 --field-trial-handle=9016,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8884 /prefetch:1
1⤵
PID:5372

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=53 --field-trial-handle=6400,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9140 /prefetch:1
1⤵
PID:4376

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=7104,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:8
1⤵
PID:4284

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=55 --field-trial-handle=7452,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8744 /prefetch:1
1⤵
PID:408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=56 --field-trial-handle=9196,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9252 /prefetch:1
1⤵
PID:5744

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=9492,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9472 /prefetch:8
1⤵
PID:5872

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:3984

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 836
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5488

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:5616

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 820
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:6132

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:5160

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 824
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5588

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2732

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:4028

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 820
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4088

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:5400

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 816
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:5416

C:\Users\Admin\Downloads\Rensenware.exe
"C:\Users\Admin\Downloads\Rensenware.exe"
1⤵
PID:2768

C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
dw20.exe -x -s 816
2⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:6124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=58 --field-trial-handle=8872,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9460 /prefetch:1
1⤵
PID:2468

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=59 --field-trial-handle=9328,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=9220 /prefetch:1
1⤵
PID:5080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=8844,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8736 /prefetch:8
1⤵
PID:1580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --lang=en-US --service-sandbox-type=icon_reader --field-trial-handle=9440,i,15436195446242760253,4000484513008731869,262144 --variations-seed-version --mojo-platform-channel-handle=8464 /prefetch:8
1⤵
PID:2456

C:\Users\Admin\Downloads\WannaCry.exe
"C:\Users\Admin\Downloads\WannaCry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2980

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 85531722922949.bat
2⤵
- System Location Discovery: System Language Discovery
PID:3944

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
- System Location Discovery: System Language Discovery
PID:5872

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:388

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2688

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:944

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4644

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1408

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3292

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
- System Location Discovery: System Language Discovery
PID:4472

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2704

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- System Location Discovery: System Language Discovery
PID:6016

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1516

C:\Users\Admin\Downloads\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5384

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:5452

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
PID:5760

C:\Windows\system32\NOTEPAD.EXE
"C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\Desktop\!Please Read Me!.txt
1⤵
PID:5256

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa38f1855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:5360

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Comms\UnistoreDB\store.jfm

Filesize
16KB

MD5
20edc7be5db49a4c26cc7f4ad8337a02

SHA1
dce8625418ccde22d20baa87069f3c986ebb120c

SHA256
f671b8c8f14d04c15b30d21f09f793c35529d35abda46c4dde72a2beff9bc7d4

SHA512
d6af82f5f3f4f2bdde9ecd06768d687df691eef437eeeb19e509a1babba5380f008064795413f4866b6271042a1240482cdbc18cee8a6b03401932975d86cf91

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\activity-stream.discovery_stream.json

Filesize
21KB

MD5
19fc00968dd35f9b5a269188efa05b4d

SHA1
fd896513cd578fcd112509cc93176a3481270e9f

SHA256
9a34536b44d4d678e2f4756c07655335fb590448d0650169e26d5d269e21111d

SHA512
2a2c7ea8150a7f38e7d943ef611a88319092e9393f6e845d353575a55f82c8c88266387c3d7651ace3fe8db037113988cf73bc2e86129cfefc92e4e555b8b729

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
e3bbc51d3f72fc3b63f202477bc40790

SHA1
0efd86c5b55ce7fcb964568b54d7deebdc3e26f7

SHA256
b3d4a2a998656be3279d29b2076856411e4c8c01d5e452ea21668d6eeb1809f1

SHA512
270c443927290fdd11504ec1db5dd40bf08c32bc5a6bcdaa4ef3937c62e4442d2517978694cf70ff2a0df9b134c587942759f9ba163a3f7b9bb2ab2819f71e57

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\xmd08l7e.default-release\settings\main\ms-language-packs\browser\newtab\asrouter.ftl

Filesize
7KB

MD5
c460716b62456449360b23cf5663f275

SHA1
06573a83d88286153066bae7062cc9300e567d92

SHA256
0ec0f16f92d876a9c1140d4c11e2b346a9292984d9a854360e54e99fdcd99cc0

SHA512
476bc3a333aace4c75d9a971ef202d5889561e10d237792ca89f8d379280262ce98cf3d4728460696f8d7ff429a508237764bf4a9ccb59fd615aee07bdcadf30

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\AlternateServices.bin

Filesize
6KB

MD5
cb3bd05d3f66f09f8b629090f4f95b98

SHA1
c13615318191960b64c7acb9e289e77fbdc35a45

SHA256
9d3e311582dbde11e7f8cd0f023d02acd8a362f8463e0b503b2d30a9bc8190d9

SHA512
e79eb819a239f565ba2fcd3428a4bfc3a3f04395d1a62ba3fd6707e90ad2fe66f294d612516b18f5b2333634ec3354db94b5659963016570b770db82d0569b73

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
e2b1b05a4c76df989498bd249d5bdb7c

SHA1
83c96db9a3a9995742961191041bbeb6de50adf4

SHA256
7bc448e60065e5a548a7393e2e451c6b2128cbb00db2cac5de61e528cbd85e51

SHA512
fe847c1887f3c5c3dee2582ebc4c3ee11efe1959997ba11951fa7e960d792b866f33a607a0d4eee9f3b078dfb1e27e00454aec6e1262343b441b01b4e5c6c21b

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a556216fa0cdf6db184449caec3cd1a2

SHA1
9a764b94f7f9be1b3fe373457e453cd42469d6e1

SHA256
69d55cba023abc2da12cf54597954de6fdd68d0bacfa3a73baec6c39f36ff114

SHA512
4139e060fc9d798761737958080cc0f62afb5b1064874324ce22513ec2e35a44482687509adef412fc13172567310e8afa874111406d87f0ab0a257abd42925d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\0eebf164-e7a3-4a24-8e74-5c0ddedda95d

Filesize
671B

MD5
622db4f9afec1f4d868ff53a2576af6c

SHA1
c39a631dbeb8360b68265667520bdc279c3a0769

SHA256
f405a92d199c49f80befac52129834ac0366222d50e112411b8443780ee04bc6

SHA512
5182344d62752a5d8ced94936b4774b187801bbc6a698499ee295684aa48dac8901e298d3655871cdd2b6ceea1751077eeaff54a07cea1cc8da7fa5096af0bac

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\bfb86aaf-457a-450b-a995-bf1429e89c01

Filesize
982B

MD5
5675db883837e9236df28d49a7546fea

SHA1
354bde3cded31fe016bf4a00dc74bd82d62f1c63

SHA256
e4724c64927627db365f8816cc3c260e8977242df25e2b239b7608ee77e30498

SHA512
057dc2ab6c68e6ecece1fed55ac10619a6b13dcdba9ed9362640f2d0683b179bd71b89729669dbbe8cedf0605befb7e67dff179e3443258cad27eaf8f13a28b3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\datareporting\glean\pending_pings\fadd1384-0f42-4eb7-9ce1-3710a4f5cb63

Filesize
27KB

MD5
ff3d1feea074f136c76bbffa6a362aec

SHA1
bb2ff1919009c77a6cc14926de1a99f5ed85f1dd

SHA256
0fa0ab1eba6f1cbedaa7182a1d8906e24681c309af384e3934440c3b05d04303

SHA512
06540ff8fb327b5258b5a18349daf729243c9978becd7e9c7b5ebed9d6535204103d356c6ff6240109828f6adfce7b13f3a846de6f856f9c4406227da8a883cf

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs-1.js

Filesize
11KB

MD5
a26816e330c66bfa80f53fa972be2ebf

SHA1
13bc7789ae4ce40cb421f980e31126010ae6f814

SHA256
d0c87cfee6ff2e4865239e8c922ae4e98daf9c6c00a2a8812e55eb0d177436b0

SHA512
73a8fa06c23848cf52f29aa3ba2d029027e5af5f8ae58461e476b70a0d210e420048e91240f35118423eb09801d65eff2963574da0a29eb0f2fa1fcb6949e2f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
68c64dfccffc9814d4c50404b741412d

SHA1
374fd79e126ad01873f701d28746ee381a0c47c8

SHA256
99f1ae739cb4efe4a275d14d8077d79cade794793922b1d660be9e285b1c237b

SHA512
36bf97c03d024b56876ce9de7eb35fa5c7266606b1ee534a06f5dc51cd809ce0d73fe38555b51ed1b2a7fcfc1b00d827b3c3adf1632a092f8a0258426746e8ad

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\xmd08l7e.default-release\prefs.js

Filesize
11KB

MD5
c083a21bcc2ae5d027329ec474b66c8e

SHA1
e387f7c82dbe5543808a839bfc2a9e7690e86875

SHA256
6d328eace0ffcb03f2b035e5c07ff1d7af06b1fa2f3b854ed2fc82c0205165c8

SHA512
4353b053987693f6acf3b298ef0286523ebb923981af2b94f7a0b2a0676e779e4b7726f5e9f141322b707e34cfaedf3a32ce14c525bd916ca2530fd91154eca4

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
608c1e6785e9ff8a4782c10b0931b760

SHA1
2b2e59ddc7f7aa8fb75c0663134d6a11b83fa950

SHA256
8957f7c34d2c63a547472ea7db364bac88cd45f12a8b28ca7ed9adab973fc3aa

SHA512
51b1e03defad48c4d6d37374d327dd8e4d5a64fa7ae80e854b2b85923361861991d95693352dcf8358e1f37ec451e57d9d57543d9bdcf63e90cb9a409e10684e

Download Submit
C:\Users\Admin\Downloads\-1uFdAVe.apk.part

Filesize
6.9MB

MD5
7ea7ec990cb125d5e7e9009fbb6c0337

SHA1
db0b1001a4ded7eb77ac4fce6532f2fb89d62ebe

SHA256
45955f3293dc620ba21eede75c40c30b9c01010e9698608d4080238eaa2e7239

SHA512
efe8ab9345912fafc8216efbdefcfaaa08e7fb0756322fac98d12bf41263d7cef8dfec35dd2001419ac1ff1cbe2e685cfad4363fcf002d720c0216d691ef2bb3

Download Submit
C:\Users\Admin\Downloads\00000000.eky

Filesize
1KB

MD5
2e7f7e443d3192878ad8df34d9c3268c

SHA1
c5a758906bfd45a5183612f8dfebe6702b8b8a51

SHA256
4aa091df5100f722dc4d8554196a9fbdd1615c508544893d086eba5662c2b90f

SHA512
9695ab795cb07d083021c54ce4de7121eecb688517cc2023ad05e1292a7e4dd6061d54aded97ee052bc43ea3955508b7832d2e52518472b2833aa98fde739ea0

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
8b8483f9675caf4adf074e062d7b3008

SHA1
94b3181584f99319a1bbe68570defec7b66fdbd0

SHA256
dc47b7bc12f60a744f5ad637cd7270b83298e9da761e6c702c811ef8de2830d5

SHA512
5088f4386c0a7b79ba69fbe43ac31a9b7c691338434acfbb5b00495b9af2019a473a7d99b08918bee24a69d7d25f9055121079d00e51e90c78eaca0ee6a9dcaa

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
d2cea089b4849bd706258bf5141ab176

SHA1
b2bf50abb4323e301ad1cd68ee75f0f4d59b107f

SHA256
810495b91acd906bc51935d75f2b4c3d04d59f6dc5f2c8cfd89b6c9fa7956b11

SHA512
a5a69fe0931bf599a28b306ca80ee6cf73c7d6c75e1b9ff28e5fbe0f0f554dcaa63e67007c21f90e8720c08dd197b6e3ce4c59efa042208ff2695e8f235ff00e

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
853a6a41084e25dc13d31bbcf22bade9

SHA1
e933cca38098ae77c2389d7289b0cf0a2dc1e243

SHA256
1fb7a45da2d6f5a75db12c04643afaa57f93184220131836e8dd9c51fabb4c47

SHA512
62ac93403ccd8ceec973f4f141caa2f7995a909424fcc20720478bc2d2e40d8fee86ba738479f37d3e18f9ec333af35eec821691f4ba5ed41b9466c03b287a07

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
ef8909cc87454ca96cd02f691e23111c

SHA1
f87067591412202dccd68126e7fb520e3acd7d9a

SHA256
4aa6671aad34213c9cff178c9a03998639782ebb41d074b251ec6bd3a1cf0252

SHA512
63769b60a787c35d53a9824918828c2095afce83403887659581cfb0e4c92bd2d1dd95bc40bc51147604728aa620f32df9d725564831d521ae5ed53f6959d51b

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2a770254e78b277d7b3e37be83143871

SHA1
5f755c093abc366a79cf04f43afa258126cea82d

SHA256
aff0b1fd6ca573c89085b819eff889733fc014cc17eab9587e96bcb0f8c327f3

SHA512
d51de737828af187467bed9a108cb41cc0ae53d8285dd953e7b329903e0b51f41ad01380f45c84cc7bf4bf5686fd312a9e0332da4a15b739ded18eed3330e6b9

Download Submit
C:\Users\Admin\Downloads\85531722922949.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
aaa7f1e4cb84cfa8957a2da48156201c

SHA1
f2e6b808d7bd405c6262f669a83588b59601b40a

SHA256
95b01736c769db47403dc4bd9071844bb6e4413e8adc774ecda2d61ec2a892b6

SHA512
c5a4cc20f28070c32ea9e17cf382c4b469e2cdad92ac0fcfed37b4e7307c6ef8d4b9db02e22f497f272ca0560c8e483fbd4abb7d453d5b6f370a6ba4d945d021

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/2980-449-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3984-388-0x000000001C2F0000-0x000000001C38C000-memory.dmp

Filesize
624KB

Download
memory/3984-387-0x000000001BD80000-0x000000001C24E000-memory.dmp

Filesize
4.8MB

Download
memory/5484-384-0x000000001F8D0000-0x000000001F908000-memory.dmp

Filesize
224KB

Download
memory/5484-385-0x000000001F8A0000-0x000000001F8AE000-memory.dmp

Filesize
56KB

Download
memory/5484-382-0x00000000005A0000-0x00000000006DA000-memory.dmp

Filesize
1.2MB

Download
memory/5484-383-0x000000001F850000-0x000000001F858000-memory.dmp

Filesize
32KB

Download
memory/5760-1860-0x000002520AC60000-0x000002520AC61000-memory.dmp

Filesize
4KB

Download
memory/5760-1865-0x000002520AC60000-0x000002520AC61000-memory.dmp

Filesize
4KB

Download
memory/5760-1853-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1854-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1855-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1856-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1857-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1858-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1859-0x000002520AC70000-0x000002520AC71000-memory.dmp

Filesize
4KB

Download
memory/5760-1848-0x000002520C020000-0x000002520C021000-memory.dmp

Filesize
4KB

Download
memory/5760-1862-0x000002520AC70000-0x000002520AC71000-memory.dmp

Filesize
4KB

Download
memory/5760-1852-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1868-0x000002520ABA0000-0x000002520ABA1000-memory.dmp

Filesize
4KB

Download
memory/5760-1884-0x000002520AEC0000-0x000002520AEC1000-memory.dmp

Filesize
4KB

Download
memory/5760-1883-0x000002520ADB0000-0x000002520ADB1000-memory.dmp

Filesize
4KB

Download
memory/5760-1882-0x000002520ADB0000-0x000002520ADB1000-memory.dmp

Filesize
4KB

Download
memory/5760-1880-0x000002520ADA0000-0x000002520ADA1000-memory.dmp

Filesize
4KB

Download
memory/5760-1832-0x0000025202A40000-0x0000025202A50000-memory.dmp

Filesize
64KB

Download
memory/5760-1816-0x0000025202940000-0x0000025202950000-memory.dmp

Filesize
64KB

Download
memory/5760-1851-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1850-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download
memory/5760-1849-0x000002520C050000-0x000002520C051000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads