wannacry | be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

Resubmissions

13-08-2024 21:38

240813-1g27rasbkk 3

13-08-2024 21:04

240813-zwr5nawdld 10

13-08-2024 20:08

240813-ywzztstemc 10

Analysis

max time kernel
221s
max time network
187s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
13-08-2024 20:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

WannaCry.exe
Size

224KB
MD5

5c7fb0927db37372da25f270708103a2
SHA1

120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA256

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
SHA512

a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP

3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

Processes:

WannaCry.exe

description	ioc	process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBC08.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDBC1F.tmp	WannaCry.exe

Executes dropped EXE 5 IoCs

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exe

pid process

2512 !WannaDecryptor!.exe
3332 !WannaDecryptor!.exe
2708 !WannaDecryptor!.exe
1092 !WannaDecryptor!.exe
5728 !WannaDecryptor!.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

WannaCry.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r"	WannaCry.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

Processes:

!WannaDecryptor!.exe!WannaDecryptor!.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 22 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

cmd.execscript.exetaskkill.exeRdrCEF.exe!WannaDecryptor!.exetaskkill.exe!WannaDecryptor!.exeAcroRd32.exeRdrCEF.exe!WannaDecryptor!.execmd.exeRdrCEF.exeWannaCry.exetaskkill.exetaskkill.exe!WannaDecryptor!.exe!WannaDecryptor!.execmd.exeWMIC.exeRdrCEF.exeRdrCEF.exeRdrCEF.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RdrCEF.exe

Checks processor information in registry 2 TTPs 14 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

firefox.exefirefox.exeAcroRd32.exefirefox.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

996 taskkill.exe
4740 taskkill.exe
1692 taskkill.exe
1176 taskkill.exe

pid	process
996	taskkill.exe
4740	taskkill.exe
1692	taskkill.exe
1176	taskkill.exe

Modifies Internet Explorer settings 1 TTPs 1 IoCs

adware spyware

Modify Registry

T1112

Processes:

AcroRd32.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FeatureControl\FEATURE_BROWSER_EMULATION	AcroRd32.exe

Modifies registry class 4 IoCs

Processes:

MiniSearchHost.exeOpenWith.exefirefox.exeOpenWith.exe

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings\MuiCache	MiniSearchHost.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-970747758-134341002-3585657277-1000_Classes\Local Settings	OpenWith.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

!WannaDecryptor!.exe

pid process

1092 !WannaDecryptor!.exe

pid	process
1092	!WannaDecryptor!.exe

Suspicious use of AdjustPrivilegeToken 51 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exeWMIC.exevssvc.exefirefox.exe

description	pid	process
Token: SeDebugPrivilege	996	taskkill.exe
Token: SeDebugPrivilege	4740	taskkill.exe
Token: SeDebugPrivilege	1176	taskkill.exe
Token: SeDebugPrivilege	1692	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1096	WMIC.exe
Token: SeSecurityPrivilege	1096	WMIC.exe
Token: SeTakeOwnershipPrivilege	1096	WMIC.exe
Token: SeLoadDriverPrivilege	1096	WMIC.exe
Token: SeSystemProfilePrivilege	1096	WMIC.exe
Token: SeSystemtimePrivilege	1096	WMIC.exe
Token: SeProfSingleProcessPrivilege	1096	WMIC.exe
Token: SeIncBasePriorityPrivilege	1096	WMIC.exe
Token: SeCreatePagefilePrivilege	1096	WMIC.exe
Token: SeBackupPrivilege	1096	WMIC.exe
Token: SeRestorePrivilege	1096	WMIC.exe
Token: SeShutdownPrivilege	1096	WMIC.exe
Token: SeDebugPrivilege	1096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1096	WMIC.exe
Token: SeRemoteShutdownPrivilege	1096	WMIC.exe
Token: SeUndockPrivilege	1096	WMIC.exe
Token: SeManageVolumePrivilege	1096	WMIC.exe
Token: 33	1096	WMIC.exe
Token: 34	1096	WMIC.exe
Token: 35	1096	WMIC.exe
Token: 36	1096	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1096	WMIC.exe
Token: SeSecurityPrivilege	1096	WMIC.exe
Token: SeTakeOwnershipPrivilege	1096	WMIC.exe
Token: SeLoadDriverPrivilege	1096	WMIC.exe
Token: SeSystemProfilePrivilege	1096	WMIC.exe
Token: SeSystemtimePrivilege	1096	WMIC.exe
Token: SeProfSingleProcessPrivilege	1096	WMIC.exe
Token: SeIncBasePriorityPrivilege	1096	WMIC.exe
Token: SeCreatePagefilePrivilege	1096	WMIC.exe
Token: SeBackupPrivilege	1096	WMIC.exe
Token: SeRestorePrivilege	1096	WMIC.exe
Token: SeShutdownPrivilege	1096	WMIC.exe
Token: SeDebugPrivilege	1096	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1096	WMIC.exe
Token: SeRemoteShutdownPrivilege	1096	WMIC.exe
Token: SeUndockPrivilege	1096	WMIC.exe
Token: SeManageVolumePrivilege	1096	WMIC.exe
Token: 33	1096	WMIC.exe
Token: 34	1096	WMIC.exe
Token: 35	1096	WMIC.exe
Token: 36	1096	WMIC.exe
Token: SeBackupPrivilege	5000	vssvc.exe
Token: SeRestorePrivilege	5000	vssvc.exe
Token: SeAuditPrivilege	5000	vssvc.exe
Token: SeDebugPrivilege	2064	firefox.exe
Token: SeDebugPrivilege	2064	firefox.exe

Suspicious use of FindShellTrayWindow 21 IoCs

Processes:

firefox.exe

pid	process
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe
2064	firefox.exe

Suspicious use of SetWindowsHookEx 20 IoCs

Processes:

!WannaDecryptor!.exeMiniSearchHost.exe!WannaDecryptor!.exe!WannaDecryptor!.exe!WannaDecryptor!.exeOpenWith.exefirefox.exe!WannaDecryptor!.exeOpenWith.exeAcroRd32.exe

pid	process
2512	!WannaDecryptor!.exe
2512	!WannaDecryptor!.exe
3668	MiniSearchHost.exe
3332	!WannaDecryptor!.exe
3332	!WannaDecryptor!.exe
2708	!WannaDecryptor!.exe
2708	!WannaDecryptor!.exe
1092	!WannaDecryptor!.exe
1092	!WannaDecryptor!.exe
1980	OpenWith.exe
2064	firefox.exe
5728	!WannaDecryptor!.exe
5728	!WannaDecryptor!.exe
5544	OpenWith.exe
5544	OpenWith.exe
5544	OpenWith.exe
4048	AcroRd32.exe
4048	AcroRd32.exe
4048	AcroRd32.exe
4048	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

WannaCry.execmd.execmd.exe!WannaDecryptor!.execmd.exefirefox.exefirefox.exe

description	pid	process	target process
PID 4460 wrote to memory of 3880	4460	WannaCry.exe	cmd.exe
PID 4460 wrote to memory of 3880	4460	WannaCry.exe	cmd.exe
PID 4460 wrote to memory of 3880	4460	WannaCry.exe	cmd.exe
PID 3880 wrote to memory of 4824	3880	cmd.exe	cscript.exe
PID 3880 wrote to memory of 4824	3880	cmd.exe	cscript.exe
PID 3880 wrote to memory of 4824	3880	cmd.exe	cscript.exe
PID 4460 wrote to memory of 2512	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 2512	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 2512	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 996	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 996	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 996	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 4740	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 4740	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 4740	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1692	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1692	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1692	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1176	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1176	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 1176	4460	WannaCry.exe	taskkill.exe
PID 4460 wrote to memory of 3332	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 3332	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 3332	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 4640	4460	WannaCry.exe	cmd.exe
PID 4460 wrote to memory of 4640	4460	WannaCry.exe	cmd.exe
PID 4460 wrote to memory of 4640	4460	WannaCry.exe	cmd.exe
PID 4640 wrote to memory of 2708	4640	cmd.exe	!WannaDecryptor!.exe
PID 4640 wrote to memory of 2708	4640	cmd.exe	!WannaDecryptor!.exe
PID 4640 wrote to memory of 2708	4640	cmd.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 1092	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 1092	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 4460 wrote to memory of 1092	4460	WannaCry.exe	!WannaDecryptor!.exe
PID 2708 wrote to memory of 2092	2708	!WannaDecryptor!.exe	cmd.exe
PID 2708 wrote to memory of 2092	2708	!WannaDecryptor!.exe	cmd.exe
PID 2708 wrote to memory of 2092	2708	!WannaDecryptor!.exe	cmd.exe
PID 2092 wrote to memory of 1096	2092	cmd.exe	WMIC.exe
PID 2092 wrote to memory of 1096	2092	cmd.exe	WMIC.exe
PID 2092 wrote to memory of 1096	2092	cmd.exe	WMIC.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 3764 wrote to memory of 2064	3764	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe
PID 2064 wrote to memory of 4220	2064	firefox.exe	firefox.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4460

C:\Windows\SysWOW64\cmd.exe
C:\Windows\system32\cmd.exe /c 57961723579763.bat
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3880

C:\Windows\SysWOW64\cscript.exe
cscript //nologo c.vbs
3⤵
- System Location Discovery: System Language Discovery
PID:4824

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe f
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2512

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im MSExchange*
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:996

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im Microsoft.Exchange.*
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4740

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlserver.exe
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1692

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im sqlwriter.exe
2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1176

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe c
2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3332

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c start /b !WannaDecryptor!.exe v
2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe v
3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
4⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092

C:\Windows\SysWOW64\Wbem\WMIC.exe
wmic shadowcopy delete
5⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1096

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:1092

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
!WannaDecryptor!.exe
2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5728

C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
"C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3668

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:1176

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5000

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1980

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2064

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2020 -parentBuildID 20240401114208 -prefsHandle 2112 -prefMapHandle 2328 -prefsLen 21730 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {37877b8b-b242-4978-98b0-097bbb441ec3} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" gpu
3⤵
PID:4220

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2516 -parentBuildID 20240401114208 -prefsHandle 2508 -prefMapHandle 2504 -prefsLen 21730 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c5118408-694e-4227-bb53-27e3af1e868e} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" socket
3⤵
- Checks processor information in registry
PID:2088

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3536 -childID 1 -isForBrowser -prefsHandle 3528 -prefMapHandle 3524 -prefsLen 21285 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1509ec57-3c50-437e-926e-404a7949b12a} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:4080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3740 -childID 2 -isForBrowser -prefsHandle 3748 -prefMapHandle 3752 -prefsLen 22575 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {58cc299f-621c-44a4-b78e-6127ef7ffb49} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:1764

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4220 -childID 3 -isForBrowser -prefsHandle 4348 -prefMapHandle 4344 -prefsLen 29113 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c68061b1-5225-4e1d-bcdc-a16d1c1dfddd} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:404

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4552 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4344 -prefMapHandle 4916 -prefsLen 29801 -prefMapSize 243020 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2add9683-0e37-436e-97b2-f131e025d9f6} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" utility
3⤵
- Checks processor information in registry
PID:5644

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5124 -parentBuildID 20240401114208 -prefsHandle 5108 -prefMapHandle 5112 -prefsLen 29801 -prefMapSize 243020 -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a11dc8a-7b96-4b52-8888-ced6dbe14763} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" rdd
3⤵
PID:5840

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3624 -childID 4 -isForBrowser -prefsHandle 5300 -prefMapHandle 3372 -prefsLen 27869 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d953166-6cdc-4784-8b5e-fca2d0163407} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:6080

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3556 -childID 5 -isForBrowser -prefsHandle 5328 -prefMapHandle 3084 -prefsLen 27869 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {c08a9a8d-67f3-4be0-8333-2ac0fa761d5d} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:6092

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5556 -childID 6 -isForBrowser -prefsHandle 5564 -prefMapHandle 5568 -prefsLen 27869 -prefMapSize 243020 -jsInitHandle 1040 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {605208f7-021e-4125-a90c-41493bf735bd} 2064 "\\.\pipe\gecko-crash-server-pipe.2064" tab
3⤵
PID:1556

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\7eeb84248b0849a99c43d12cfe5c8c22 /t 2272 /p 1092
1⤵
PID:2560

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:5544

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\msedge_installer.log"
2⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:4048

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --backgroundcolor=16514043
3⤵
- System Location Discovery: System Language Discovery
PID:5444

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F7BA1C9B63346E04E942E6F173C23093 --mojo-platform-channel-handle=1776 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
- System Location Discovery: System Language Discovery
PID:3024

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=renderer --disable-browser-side-navigation --disable-gpu-compositing --service-pipe-token=BEA5BB9BF979A5C2BF52F1F8BD37A335 --lang=en-US --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --enable-pinch --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --enable-gpu-async-worker-context --content-image-texture-target=0,0,3553;0,1,3553;0,2,3553;0,3,3553;0,4,3553;0,5,3553;0,6,3553;0,7,3553;0,8,3553;0,9,3553;0,10,3553;0,11,3553;0,12,3553;0,13,3553;0,14,3553;0,15,3553;0,16,3553;0,17,3553;0,18,3553;1,0,3553;1,1,3553;1,2,3553;1,3,3553;1,4,3553;1,5,3553;1,6,3553;1,7,3553;1,8,3553;1,9,3553;1,10,3553;1,11,3553;1,12,3553;1,13,3553;1,14,3553;1,15,3553;1,16,3553;1,17,3553;1,18,3553;2,0,3553;2,1,3553;2,2,3553;2,3,3553;2,4,3553;2,5,3553;2,6,3553;2,7,3553;2,8,3553;2,9,3553;2,10,3553;2,11,3553;2,12,3553;2,13,3553;2,14,3553;2,15,3553;2,16,3553;2,17,3553;2,18,3553;3,0,3553;3,1,3553;3,2,3553;3,3,3553;3,4,3553;3,5,3553;3,6,3553;3,7,3553;3,8,3553;3,9,3553;3,10,3553;3,11,3553;3,12,3553;3,13,3553;3,14,3553;3,15,3553;3,16,3553;3,17,3553;3,18,3553;4,0,3553;4,1,3553;4,2,3553;4,3,3553;4,4,3553;4,5,3553;4,6,3553;4,7,3553;4,8,3553;4,9,3553;4,10,3553;4,11,3553;4,12,3553;4,13,3553;4,14,3553;4,15,3553;4,16,3553;4,17,3553;4,18,3553;5,0,3553;5,1,3553;5,2,3553;5,3,3553;5,4,3553;5,5,3553;5,6,3553;5,7,3553;5,8,3553;5,9,3553;5,10,3553;5,11,3553;5,12,3553;5,13,3553;5,14,3553;5,15,3553;5,16,3553;5,17,3553;5,18,3553;6,0,3553;6,1,3553;6,2,3553;6,3,3553;6,4,3553;6,5,3553;6,6,3553;6,7,3553;6,8,3553;6,9,3553;6,10,3553;6,11,3553;6,12,3553;6,13,3553;6,14,3553;6,15,3553;6,16,3553;6,17,3553;6,18,3553 --disable-accelerated-video-decode --service-request-channel-token=BEA5BB9BF979A5C2BF52F1F8BD37A335 --renderer-client-id=2 --mojo-platform-channel-handle=1788 --allow-no-sandbox-job /prefetch:1
4⤵
- System Location Discovery: System Language Discovery
PID:4592

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=02B727296F52933FFDC80B57D202B83D --mojo-platform-channel-handle=2336 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
- System Location Discovery: System Language Discovery
PID:6108

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=F8F079033C5EDDFBA4B1A023E16DFFC4 --mojo-platform-channel-handle=1952 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
- System Location Discovery: System Language Discovery
PID:5480

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\RdrCEF.exe" --type=gpu-process --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --gpu-preferences=GAAAAAAAAAAAB4AAAQAAAAAAAAAAAGAA --use-gl=swiftshader-webgl --gpu-vendor-id=0x1234 --gpu-device-id=0x1111 --gpu-driver-vendor="Google Inc." --gpu-driver-version=3.3.0.2 --gpu-driver-date=2017/04/07 --disable-pack-loading --lang=en-US --log-file="C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\debug.log" --log-severity=disable --product-version="ReaderServices/19.10.20064 Chrome/64.0.3282.119" --service-request-channel-token=E993F03987CD4D1A76AACC8C87D19A89 --mojo-platform-channel-handle=2340 --allow-no-sandbox-job --ignored=" --type=renderer " /prefetch:2
4⤵
- System Location Discovery: System Language Discovery
PID:3492

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Mozilla-1de4eec8-1241-4177-a864-e594e8d1fb38\updates\308046B0AF4A39CB\update-config.json

Filesize
102B

MD5
7d1d7e1db5d8d862de24415d9ec9aca4

SHA1
f4cdc5511c299005e775dc602e611b9c67a97c78

SHA256
ffad3b0fb11fc38ea243bf3f73e27a6034860709b39bf251ef3eca53d4c3afda

SHA512
1688c6725a3607c7b80dfcd6a8bea787f31c21e3368b31cb84635b727675f426b969899a378bd960bd3f27866023163b5460e7c681ae1fcb62f7829b03456477

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png.WCRY

Filesize
1KB

MD5
a924c4a7e9b8d404d2b5fda89296c571

SHA1
e06abb19392f620d470fd762a7788b0ffcd1c34e

SHA256
98744598ede499e938630b1110d0a12471156e550cf887bdadbb673a87cb2c93

SHA512
95e293adf9de30c9a7e43fc5904e82a5232beeedd5e8521daf25e1d4bd9973f33567dd912a49b3f1b2f055c16f8509eb4c2d7bca06bde37844ad2ab0d9c6c819

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\zgr882s2.default-release\activity-stream.discovery_stream.json.tmp

Filesize
18KB

MD5
5e42318a296d8bd6458e901a0516e54c

SHA1
412df2005e6bb586237c848e3109f3fef455a118

SHA256
8e55c45fbbee135b56dbd02f4f4788ed28b837acdbfd7ccb477cd7590be3da53

SHA512
00462d8f4365399a94308d6d685f7a03bc44f71194cd4e7d724e32b68049dbf69aa624b9dbe0b21477985c07d1767fe0cb01f735f35f959b3d001bb042ac597a

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\AC\INetCache\042YC842\RW1dYo2[1].png.WCRY

Filesize
1KB

MD5
b5ff5796678227f48ecae06cc84fd4af

SHA1
7c41e974586e80788a44b770fe8da701152d460e

SHA256
c24242663d5f42329388b1437d7041c46ca0c27498e19b73191f8718932307a0

SHA512
2b918cf4604f89b4fe151af3458adc83bc4d670a3da7d36f3880ee8a918d4631386d941002e5b3d876510b9e364cd4777c53e270d973f9b391a0fa8d16c0593a

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
bf9d506bc3ef115492702ab73476920b

SHA1
b5eef4d22ed88d8da0ffcf0b71ab6533378b6a4f

SHA256
76203097befb1239bd25e5a1d492a209cc461b5db423230937609ce84209cb0b

SHA512
1e77b56c16a0022818c24bdbe2448d98dfc3b87e8e9d6a5a3055a76543846dc28ae4e5a63e393ef853c032450d9963f7cd50eb6fe54e7aaa462dd14e3c12c9ee

Download Submit
C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat

Filesize
10KB

MD5
cd6829f53a60318a54648f4ff9d694c2

SHA1
eda672c23f219a9cdbe740079412f5fbe04a157d

SHA256
5410184dfd5ef071de14c78cc7e9488049a85e313a3454250d53e974251ac906

SHA512
25a54ac013419868211b704a9b1f4cbc7c0a5b1a0e10cec09cd8eee3fbde7497e36c8e35f0506622eb9a47939c2c6b9590bf9bbf8d43508be13d7f85f7838ec9

Download Submit
C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

Filesize
1KB

MD5
51b6750d5771b6946934b1bcd85e9b40

SHA1
4a6f8ebcef8017e41f897df617082c74e359534a

SHA256
2f251131349bb018a09118cba283443b7c541f6cbee83dfe36cca6011e200693

SHA512
d2bc6d52b0480b7e6342439804c5dd9ecdda33433b81254ebecb85f36ddd31893b89c184f9edc5f07471256c31b74387d4784cf590afd61bebdd7676344050b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
0f9fe535dbb305d5feb80ad7eb1213b3

SHA1
ea817ebc8862453474940da47c9556cb1ad0ffb8

SHA256
676a5fe6661862353dc21938bd1fb963a4a74f5351ebd540590ab25756da4818

SHA512
81858cff071e70041297475bf633b0506c53ef7303ed7a2a72f7fc259964aec71725c500876af399bf8570cc56837073abb93f34ae251a6d4f68fdc60009d8e2

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
7b047098f931e9137c1cd597c7de4368

SHA1
5c449b3dc052403af13d6009710560b8fb48dde5

SHA256
63f5cd5a8c7ec7592044412b84c10128c41eac3deac9194746b9a21e82646b76

SHA512
fc46595af44c31829f5f77f9f799834d60968b96679f86d29e31aded96f81a1cb81f4c5751bf8231bbceb1c119648dd496ddbe3fb43ab792afbc296b5677d5ee

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
b25c4d0b3124081adf5955b06e0a4665

SHA1
56222628bb1c1680f28ad66aea0fa2933ca39061

SHA256
56c3cf76fb9157862044bf9467b7ba30465ffb85cfa14b22937c0e5579774586

SHA512
483da9f5fe0a6d166fad0be6b2ce4e2acc9424bc7a34852faf55209a274024012891b8b68fc1d41da72b17ac88532a14aab3ba453601d47dda019595d0d00ff0

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
855c3affd0dcc318c0da5873d27a6390

SHA1
5acace68b2fbaf1d38ab0d13f97e8609aa2e608d

SHA256
cb6e41887cdd9b0ef36c4bca6d3f5073ba871433b45f76787fceb7d807157fa3

SHA512
34d8a97e0dc5f09e42072d280e85ba84c90730a409d3533aa48434e0d5db54d74f05597f7097d8a2ca8e7c82445d2255b063031bb64c414615852acf629768e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
f666f6519367b7b537392ea8b683dd06

SHA1
b33fbd0096d4675275df9cdd6a666decc2553f13

SHA256
6d14858d3d4f4ee8e33258f58e643a88a57cdc66166ea7331314f39b54baea2e

SHA512
d7d0173c048f98e339a745162f345b778f70079109031c6f251d842198d42f7f5be2bafdedf0df1800bcf2847a6365891171adf5b2b616199be373a49cb3b9ba

Download Submit
C:\Users\Admin\AppData\Local\Temp\57961723579763.bat

Filesize
336B

MD5
3540e056349c6972905dc9706cd49418

SHA1
492c20442d34d45a6d6790c720349b11ec591cde

SHA256
73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

SHA512
c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.vbs

Filesize
219B

MD5
5f6d40ca3c34b470113ed04d06a88ff4

SHA1
50629e7211ae43e32060686d6be17ebd492fd7aa

SHA256
0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

SHA512
4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wry

Filesize
628B

MD5
859b82f5fc94352100f4a03874acd90d

SHA1
360242bde84e84cd59f78cc303a727a852213b3c

SHA256
8565b029fc77aa029e1b94b88bdb97e735e8db3fc3ed7a599b1bf85ff5ba0a56

SHA512
5afa018de733c0ca1fbad8940e80fd7f8c1b1ecb102c7a1cc41eddb50c63ed65bfb8da4ba1a84a1bece8c2ffe6ec9c2d129e612033b5184cbac784cedf77b5c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\f.wry

Filesize
379B

MD5
f964f5f4466a434aff660669ecb48602

SHA1
2a47f2c94be7c72bd79ae6a63d874753608c6773

SHA256
c3afd493160a6039ac57e6d3ad5e8ba1537968627ffeef3860a06843ea0e86dd

SHA512
09f4367fb352a0ca8a321f47c23f5cb14a9320b19f9d855b2083d200922c75f627ab76dfca1328d783fdbfcfcde2c1f06c39e5ce2069d9eed150d25b4ada6ea4

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\AppData\Local\Temp\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
15c71c19dd8db2deca68903511ca05a2

SHA1
5a74abf67fd8ebfd5f1a4b253d3df1ebaee117df

SHA256
f0cbab1e2dbc3b7e6c1b55291722d53314776b369aa009138c4c67d72d20e3c2

SHA512
e88762bff2636afb43f9dcf6aaa737552a10b863714f6b1129c153b1e3c31a1ae6db3250739dd511b276875f7baea1a09db857bc32b8cac08ad00b59725724f4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\32a818a6-807d-4f38-9d95-d7d8973ac9e3

Filesize
23KB

MD5
ab1f977560bd2d1f6b94a26984e0ba37

SHA1
8f28342159a03d7a63496062025f97adc1cfdd24

SHA256
010ebbbcc8e960bf675efd921495bc173565857d196c2aba7782b24ada4cb328

SHA512
547bb64b099b6ce3df4ccf3077022e7941c3d8a584488772d75fb56628b5536aee3b664026b9d79f1908bd860d9f09e9ca61fe5e4a21a429f2ef927da0534be6

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\7d2a14de-198a-4660-b9d3-44a4d8fd9424

Filesize
982B

MD5
fc87b214b4016d555f3398c188925b33

SHA1
f83db1d8635f23c54d7a3a8db3cc427ea60a0e5d

SHA256
f9b7711620ed98deb16c4123cf6e087fa497fe2b3ccfd467dd7ca6c2276d9f61

SHA512
6444a4857a7ae001f0aede5d82e802fa07064419c7119a5cb67110240c47ffe5fc8a8777f6c7b7519f291ac261454dc2f6bc022af7c82f769f9832a59360067f

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\datareporting\glean\pending_pings\bf853ee8-c529-4d22-9bf7-5c9aa46c9690

Filesize
671B

MD5
0634669c0115a0e72e918a107188a78c

SHA1
1397012b65340e4c7d2c79e4ae41967721be8fc2

SHA256
8e67596cd62cce7b1130b1371b0d1fa34bcd76f5eacefe0e116a5676c5402b1e

SHA512
0cd18021803c4e6beb932f5922da536f47a5aee983f89f3cdaa0dfc89ce73176b0361d1ebd1dcea2b1d90dbdf6b510eaf7437f3b79c23226d3cd2463da3b3b91

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

Filesize
2KB

MD5
31b2179eb2cc0595a3a164d966a8284c

SHA1
fd56f0e3b8091f501436a4cea9aa9add13d79ced

SHA256
98aa1b870d6138fbb0f97baf001b58f0e289ba99b66431d4f165540edb493591

SHA512
de2405bbfa467460840433eb880d30c1774246cce01c50d1c47051b432f76f8c253dde952055ac374f15cdcd0524241808fc4cfdb744a502324a913dff36cb34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\zgr882s2.default-release\prefs.js

Filesize
5KB

MD5
e6ad5756f9465657dca990abd57f44f8

SHA1
9df2084ba57573fb73c0cdeb1fe1026a1fa5eae4

SHA256
c5cb49e5aca2d7605c2575132c59b6ce1674a2ce87c3f90dfbaac19e27a20efd

SHA512
5d3531bef979630df46a9f9ba01040670c33ce90d8760d15486c497d758b9fa176775f7a57eb4f3ea77a6e9f067d24a16c2a8a9b702513c094908e0571b96f5c

Download Submit
C:\Users\Admin\Documents\ExpandRestore.xlsx.WCRY

Filesize
14KB

MD5
9a68a97124dfbefca05a5bfacd9670f1

SHA1
a93d9a09e5ba7b0fec74bec26685e8316b72ca10

SHA256
ca8d34a339c95788bf17906be8c837e5251cd8612b88ecd540897596f06a4e06

SHA512
0653e1c0433c5dc5664e28cb5e0b6801e285117c44739dc7fa5b98568f4fcaa68034cfebea034cc2e5e62f7b81d8dcc86e48300d0f207ed02057061f0195ff22

Download Submit
C:\Users\Admin\Downloads\PingAdd.dot.WCRY

Filesize
804KB

MD5
7d33948c2c4db9f794caa6b344ce91ed

SHA1
ed69a882c4671c5ddb84af88b7a49c7780204b6b

SHA256
ded4b803cf4bee6b43cadafe9fb3cc488abe3df0b6ec33b024bd94ad6f7f4377

SHA512
2b2acf1cf4a9789deb775a32172b93ce8a39925d1ca519adb1955331d6f2c9a6acb4f2a0632d50cee9cb0e46d6147d9924266fc93f8cbeb2338ca21cc10ca274

Download Submit
memory/4460-6-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/4460-1877-0x0000000000400000-0x0000000000438000-memory.dmp

Filesize
224KB

Download