wannacry | hxxps://github[.]com/kh4sh3i/Ransomware-Samples

Analysis

max time kernel
340s
max time network
350s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/kh4sh3i/Ransomware-Samples

Score

10^/10

wannacry defense_evasion discovery execution impact ransomware worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Process spawned unexpected child process 2 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\sysWOW64\wbem\wmiprvse.exe is not expected to spawn this process	4628	5748	notepad.exe	223
Parent C:\Windows\sysWOW64\wbem\wmiprvse.exe is not expected to spawn this process	3592	5748	WerFault.exe	223

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 8 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	Ransomware.Unnamed_0.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	cursed.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	cursed.exe
File opened for modification	\??\c:\users\admin\appdata\roaming\microsoft\windows\start menu\programs\startup\rterod.url	taskmgr.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	cursed.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD14CF.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD14D6.tmp	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url	cursed.exe

Executes dropped EXE 8 IoCs

pid	Process
4952	taskdl.exe
3148	@[email protected]
5488	@[email protected]
5144	taskhsvc.exe
4444	@[email protected]
3520	@[email protected]
5212	@[email protected]
5324	@[email protected]

Loads dropped DLL 8 IoCs

pid	Process
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe
5144	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5688	icacls.exe

Uses the VBS compiler for execution 1 TTPs

Scripting
T1064
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
37	raw.githubusercontent.com
38	raw.githubusercontent.com
87	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 5 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe

Suspicious use of SetThreadContext 6 IoCs

description	pid	Process	procid_target
PID 2044 set thread context of 4280	2044	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe	119
PID 3976 set thread context of 4420	3976	Ransomware.Unnamed_0.exe	135
PID 5076 set thread context of 956	5076	cursed.exe	144
PID 2104 set thread context of 3588	2104	cursed.exe	150
PID 1920 set thread context of 4012	1920	cursed.exe	162
PID 2900 set thread context of 5676	2900	cursed.exe	212

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 9 IoCs

pid	pid_target	Process	procid_target
4584	4280	WerFault.exe	119
5076	4740	WerFault.exe	161
5680	5524	WerFault.exe	189
2756	3148	WerFault.exe	201
6072	5144	WerFault.exe	206
3592	5748	WerFault.exe	223
6040	4444	WerFault.exe	231
5416	3520	WerFault.exe	235
5392	5212	WerFault.exe	239

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Ransomware.Unnamed_0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cursed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cursed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cursed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cursed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cursed.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	csc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cvtres.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vbc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe

Enumerates system info in registry 2 TTPs 6 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe
4600	msedge.exe
4600	msedge.exe
780	identity_helper.exe
780	identity_helper.exe
4100	msedge.exe
4100	msedge.exe
4168	msedge.exe
4168	msedge.exe
3976	Ransomware.Unnamed_0.exe
3976	Ransomware.Unnamed_0.exe
3976	Ransomware.Unnamed_0.exe
4420	vbc.exe
4420	vbc.exe
4420	vbc.exe
4420	vbc.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
4612	msedge.exe
5076	cursed.exe
5076	cursed.exe
5076	cursed.exe
956	vbc.exe
956	vbc.exe
956	vbc.exe
956	vbc.exe
2104	cursed.exe
2104	cursed.exe
2104	cursed.exe
3588	vbc.exe
3588	vbc.exe
3588	vbc.exe
3588	vbc.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
1920	cursed.exe
1920	cursed.exe
1920	cursed.exe
4012	vbc.exe
4012	vbc.exe
4012	vbc.exe
4012	vbc.exe
4012	vbc.exe
4012	vbc.exe
4012	vbc.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 18 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4248	chrome.exe
4248	chrome.exe
4248	chrome.exe
4600	msedge.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	3976	Ransomware.Unnamed_0.exe
Token: SeDebugPrivilege	4420	vbc.exe
Token: SeDebugPrivilege	5076	cursed.exe
Token: SeDebugPrivilege	956	vbc.exe
Token: SeDebugPrivilege	2104	cursed.exe
Token: SeDebugPrivilege	3588	vbc.exe
Token: SeDebugPrivilege	3356	taskmgr.exe
Token: SeSystemProfilePrivilege	3356	taskmgr.exe
Token: SeCreateGlobalPrivilege	3356	taskmgr.exe
Token: 33	3356	taskmgr.exe
Token: SeIncBasePriorityPrivilege	3356	taskmgr.exe
Token: SeDebugPrivilege	1920	cursed.exe
Token: SeDebugPrivilege	4012	vbc.exe
Token: SeDebugPrivilege	4012	vbc.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeShutdownPrivilege	4248	chrome.exe
Token: SeCreatePagefilePrivilege	4248	chrome.exe
Token: SeBackupPrivilege	5812	svchost.exe
Token: SeRestorePrivilege	5812	svchost.exe
Token: SeSecurityPrivilege	5812	svchost.exe
Token: SeTakeOwnershipPrivilege	5812	svchost.exe
Token: 35	5812	svchost.exe
Token: SeDebugPrivilege	2900	cursed.exe
Token: SeDebugPrivilege	5676	vbc.exe
Token: SeDebugPrivilege	5676	vbc.exe
Token: SeIncreaseQuotaPrivilege	5208	WMIC.exe
Token: SeSecurityPrivilege	5208	WMIC.exe
Token: SeTakeOwnershipPrivilege	5208	WMIC.exe
Token: SeLoadDriverPrivilege	5208	WMIC.exe
Token: SeSystemProfilePrivilege	5208	WMIC.exe
Token: SeSystemtimePrivilege	5208	WMIC.exe
Token: SeProfSingleProcessPrivilege	5208	WMIC.exe
Token: SeIncBasePriorityPrivilege	5208	WMIC.exe
Token: SeCreatePagefilePrivilege	5208	WMIC.exe
Token: SeBackupPrivilege	5208	WMIC.exe
Token: SeRestorePrivilege	5208	WMIC.exe
Token: SeShutdownPrivilege	5208	WMIC.exe
Token: SeDebugPrivilege	5208	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5208	WMIC.exe
Token: SeRemoteShutdownPrivilege	5208	WMIC.exe
Token: SeUndockPrivilege	5208	WMIC.exe
Token: SeManageVolumePrivilege	5208	WMIC.exe
Token: 33	5208	WMIC.exe
Token: 34	5208	WMIC.exe
Token: 35	5208	WMIC.exe
Token: 36	5208	WMIC.exe
Token: SeIncreaseQuotaPrivilege	5208	WMIC.exe
Token: SeSecurityPrivilege	5208	WMIC.exe
Token: SeTakeOwnershipPrivilege	5208	WMIC.exe
Token: SeLoadDriverPrivilege	5208	WMIC.exe
Token: SeSystemProfilePrivilege	5208	WMIC.exe
Token: SeSystemtimePrivilege	5208	WMIC.exe
Token: SeProfSingleProcessPrivilege	5208	WMIC.exe
Token: SeIncBasePriorityPrivilege	5208	WMIC.exe
Token: SeCreatePagefilePrivilege	5208	WMIC.exe
Token: SeBackupPrivilege	5208	WMIC.exe
Token: SeRestorePrivilege	5208	WMIC.exe
Token: SeShutdownPrivilege	5208	WMIC.exe
Token: SeDebugPrivilege	5208	WMIC.exe
Token: SeSystemEnvironmentPrivilege	5208	WMIC.exe
Token: SeRemoteShutdownPrivilege	5208	WMIC.exe
Token: SeUndockPrivilege	5208	WMIC.exe
Token: SeManageVolumePrivilege	5208	WMIC.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe
3356	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
3148	@[email protected]
3148	@[email protected]
5488	@[email protected]
5488	@[email protected]
4444	@[email protected]
4444	@[email protected]
3520	@[email protected]
3520	@[email protected]
5212	@[email protected]
5212	@[email protected]
5324	@[email protected]
5324	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 3084	4600	msedge.exe	83
PID 4600 wrote to memory of 3084	4600	msedge.exe	83
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1572	4600	msedge.exe	84
PID 4600 wrote to memory of 1532	4600	msedge.exe	85
PID 4600 wrote to memory of 1532	4600	msedge.exe	85
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86
PID 4600 wrote to memory of 3224	4600	msedge.exe	86

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3552	attrib.exe
5340	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/kh4sh3i/Ransomware-Samples
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd09e646f8,0x7ffd09e64708,0x7ffd09e64718
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2072 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2540 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1304 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1308 /prefetch:1
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6472 /prefetch:8
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1708 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5740 /prefetch:8
  2⤵
  PID:6000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6800 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=1984,13943389453647107189,8363275022926872482,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:5392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2800

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:208

C:\Users\Admin\Downloads\Satana\Satana\Ransomware.Satana\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
"C:\Users\Admin\Downloads\Satana\Satana\Ransomware.Satana\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2044
- C:\Users\Admin\Downloads\Satana\Satana\Ransomware.Satana\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe
  "C:\Users\Admin\Downloads\Satana\Satana\Ransomware.Satana\683a09da219918258c58a7f61f7dc4161a3a7a377cf82a31b840baabfb9a4a96.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4280
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4280 -s 376
    3⤵
    - Program crash
    PID:4584

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 4280 -ip 4280
1⤵
PID:4812

C:\Users\Admin\Downloads\Unnamed_0\Unnamed_0\Ransomware.Unnamed_0\Ransomware.Unnamed_0.exe
"C:\Users\Admin\Downloads\Unnamed_0\Unnamed_0\Ransomware.Unnamed_0\Ransomware.Unnamed_0.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3976
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\4ssfubhx\4ssfubhx.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3032
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES6112.tmp" "c:\Users\Admin\AppData\Local\Temp\4ssfubhx\CSC1B8B32C444254615917EF92BE67291A6.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:112
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4420
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:3484

C:\Users\Admin\Desktop\cursed.exe
"C:\Users\Admin\Desktop\cursed.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5076
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\g3zqd1n2\g3zqd1n2.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4868
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESD21B.tmp" "c:\Users\Admin\AppData\Local\Temp\g3zqd1n2\CSC8E316F41B42F49F9BAF39F436A0B9D8.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1884
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:956
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:2500

C:\Users\Admin\Desktop\cursed.exe
"C:\Users\Admin\Desktop\cursed.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2104
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\vbiygwxf\vbiygwxf.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3608
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESE96C.tmp" "c:\Users\Admin\AppData\Local\Temp\vbiygwxf\CSC7CCAA5E89A5E4C6D8924C44A4DE8C215.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2916
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3588
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:1568

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /7
1⤵
- Drops startup file
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3356

C:\Users\Admin\Desktop\cursed.exe
"C:\Users\Admin\Desktop\cursed.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1920
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\jywglkvc\jywglkvc.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4256
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4AC6.tmp" "c:\Users\Admin\AppData\Local\Temp\jywglkvc\CSC11B2D8BEB7DC40C0B033216AABECBCB6.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2732
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:752

C:\Users\Admin\Desktop\cursed.exe
"C:\Users\Admin\Desktop\cursed.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:4740
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  PID:364
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\itqinc2k\itqinc2k.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1144
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES4C2D.tmp" "c:\Users\Admin\AppData\Local\Temp\itqinc2k\CSC2F580378D0994E919C22A644DA61C4F4.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1192
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4740 -s 776
  2⤵
  - Program crash
  PID:5076

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4740 -ip 4740
1⤵
PID:4612

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
PID:4248
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffcf7d7cc40,0x7ffcf7d7cc4c,0x7ffcf7d7cc58
  2⤵
  PID:2644
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1896,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2172,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2124 /prefetch:3
  2⤵
  PID:4348
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=2432 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3152,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3212,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4560,i,2076154300307572555,88341713273682294,262144 --variations-seed-version=20240801-180145.014000 --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:5216

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:5152

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SDRSVC
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5812

C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe
"C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa.exe"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:5524
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3552
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:5688
- C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4952
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 193381725561705.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:860
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3156
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:5340
- C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3148
- - C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:5144
  - - C:\Windows\notepad.exe
      "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
      4⤵
      PID:2352
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 5144 -s 972
      4⤵
      Program crash
      PID:6072
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:4976
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 3148 -s 696
    3⤵
    - Program crash
    PID:2756
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5516
- - C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:5488
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:2328
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:5208
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  PID:5068
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5524 -s 892
  2⤵
  - Program crash
  PID:5680

C:\Users\Admin\Desktop\cursed.exe
"C:\Users\Admin\Desktop\cursed.exe"
1⤵
- Drops startup file
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2900
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\5ialhkfu\5ialhkfu.cmdline"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:5552
- - C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe
    C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES3E2A.tmp" "c:\Users\Admin\AppData\Local\Temp\5ialhkfu\CSCBEDC3461ED1F462BA8B5F34997427483.TMP"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5612
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:5676
- - C:\Windows\notepad.exe
    "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
    3⤵
    PID:5312

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 5524 -ip 5524
1⤵
PID:5684

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3148 -ip 3148
1⤵
PID:5092

C:\Windows\sysWOW64\wbem\wmiprvse.exe
C:\Windows\sysWOW64\wbem\wmiprvse.exe -secured -Embedding
1⤵
PID:5748
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  - Process spawned unexpected child process
  PID:4628
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5748 -s 772
  2⤵
  - Process spawned unexpected child process
  - Program crash
  PID:3592

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:4080

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 5144 -ip 5144
1⤵
PID:3760

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 556 -p 5748 -ip 5748
1⤵
PID:4992

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4444
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  PID:6016
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 4444 -s 872
  2⤵
  - Program crash
  PID:6040

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 4444 -ip 4444
1⤵
PID:5264

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3520
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  PID:1764
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 3520 -s 860
  2⤵
  - Program crash
  PID:5416

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 3520 -ip 3520
1⤵
PID:4556

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5212
- C:\Windows\notepad.exe
  "C:\Windows\notepad.exe" -c "C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg"
  2⤵
  PID:5288
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 5212 -s 828
  2⤵
  - Program crash
  PID:5392

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 5212 -ip 5212
1⤵
PID:5772

C:\Users\Public\Desktop\@[email protected]
"C:\Users\Public\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scripting

T1064

Windows Management Instrumentation

T1047

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Scripting

T1064

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State

Filesize
1KB

MD5
8a062932e5d296c92c128d0fced619ac

SHA1
62b64b7c86b8296ebd0d73bf79d41253c254e598

SHA256
9131323eb8caa4cd6c6a726e7c4b1bf2ce289504aeba1085109c97e3387b42b5

SHA512
873fdcec260cfa0c626da4344176bcc8919ac734887fb7d9df0682a164cf15153c949eb3058a048c5e8778d4063606b4ee066a8062e02deba0e25c184f38c685

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity

Filesize
356B

MD5
38827a98c56fe35a7eb028675c99741c

SHA1
37e688380bf7cb1cbfcb25394354b82cef853708

SHA256
8a939b80094366513ac1f83ee870f6db1e73ba0bed0ca9cbff68ea071c1ae5c8

SHA512
7d07f30e601e69130793755f56752034b7145bc3c48d2a5ff9d3c88a03965902ae6fa43d59c16a55ff9171f47c158730b90784b94d2cc3e5b779b9f616c2b666

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
9311f86e34c0b73c761ede44ca96c1c1

SHA1
6acdd00ff92447505b2f65d54f43ea664e6bdfd1

SHA256
fb2f8bccaaaacacb315ffbd19ed957b513b052728b3749f048d2e0e0aaf11d8e

SHA512
65fbce7e811691d02e86eac1e42493686f2829e56ee7bc3c19c4e47cfdd1244219b19e6d0409a4d6a1f27528ca10933dedece3ed2f7e419791d5a51b9b8204d5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
99KB

MD5
5c1fef73ed8af434953e0f0f693f95f4

SHA1
8761f2cd586304a985d10322fa195cad9ece8a29

SHA256
d3f455f7b75fbd12d9c788c9ae8ed7bceac4ac83e318f11a06955829f2abc31c

SHA512
d285b71233edcb98c59c6716dd1d2a99569335362f75cffded422123e1388a76872afaa9f1babacb6bd89721ae9442d12b91824ba86763ae374160b5666ee7e5

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\JesYXqkYNx\cfg

Filesize
489B

MD5
560e63ad721ff461b61a43cfc54ef909

SHA1
9829fdeea6877667280bbcc9f9a8252d6338fddb

SHA256
0c5fc323873fbe693c1ff860282f035ad447050f8ec37ff2e662d087a949dfc9

SHA512
d2bfd22ec8c2ec9e69d0954ba241999e8e58e3be2abc5601e630593462c31c1a3cb628c45b0fe480ab97e0e06b4572980a7ea979c33d56a5ce1c176842cb7fb6

Download Submit
C:\Users\Admin\AppData\Local\JesYXqkYNx\cfgi

Filesize
489B

MD5
e00a3c7526b6953ebd8aae3a22d9a6f8

SHA1
61252c6ab7b0b5580538f3999a650c07db6581d0

SHA256
ec7e7fbb31e509612cdc456346c7e02ae07b8a5018c0f6309b494b05437ce1ff

SHA512
8afdd52415d94e1249ff2639eec240a87c29bef08a9ae93e71503315060ae46ed3f4c2ab8598d1dac0b54d7b103b52d3ad361913e99d9945ea04b977f0d290f7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\cursed.exe.log

Filesize
412B

MD5
3d2efb8ce05124fd69b2bf2beffe5980

SHA1
04d6f17256b3a923bd7d9abb14e3c7289976a918

SHA256
924a09842733197c09594e32578bbcc9c001a051812350676c4d6e1b6b78ff76

SHA512
0871c2c16fbbdb0b9bc317049996a76a646c05d38e602b4fbf6c3369c04d2f3fb34201ae45bececfce942314d81f3790b46f67b06928c9fb120c7cb53d47e566

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
2c01a205536970df481be060acadbce8

SHA1
47ed2a7b249eec71284b8d27486c7a57765731ea

SHA256
c548088f1602fb7520fcc9752ebbc99b77023ea89a5ef40ad143b52e6b122b11

SHA512
e6ee3dd7d66963714989e1db521ca19d68a80a824124c1b20f104912bc73ebaf824e082526490a34f33f2b313702ddd46c4dd5fd67a7a7b7ccc2b268547b20e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2c4fd2517cdcc7d2936cd13886e728b2

SHA1
22f59f130dfe36287a1c917bfe75640881d85732

SHA256
40e3b20fd668189601ad83425879f84702d8a10e08fcc291a27ac164c5199f02

SHA512
bfcddce4a98f3394c691df2a93c31e3ea4468f05135af72d5914cf3b52d5daec73b9da7d27db6e9ad851248660edf76a175a9c1a7adea26972356caa9e669731

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c8c8c50d218bdb310cdc3e4f8a3e731d

SHA1
95df20b91722732739aa1e785afcce63c952640e

SHA256
96a8ff5010abb5ff456227dd5461db6897f8cebabd831f7a911acf0ef6446825

SHA512
6153f7ab55befccffeb095be9808c96cf3d3df5e488a3aa268d6a5e91d1279676a2ecaad71a39ebeb5347f33945e8fcc25ac07104f738169d20a5f3dd7e9076d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e1256e674fd10b89c2a5d3cef7535867

SHA1
a8ad41ebee11c27f6b9998a857373701c5a5b275

SHA256
b3b100eb68e569e4b696dfcabf6d1720a8daf7ef91c0c53db9477ee9a3b6907f

SHA512
e0c43dab6950f2730cfe68cb62a6945936ddcfa41a5099bdc185ea0e23e88b7d71bb9ab44062e64609c845f2a7c7e9bb674fd06e01ffe5333b650c138394c5ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6af1ce88e0c2b90d06136d8de9a4ef7b

SHA1
24b900397a42efdb416ee8d6af3c38adbb007258

SHA256
c6817602b3fc7575edcb16e5a40a7845c4e648dfe8bd5926aadbae1b38f3da5c

SHA512
b26efb39c396c93d950b5a86c705f8a0ee35bc9d3668979b33cf3b596d31ac5a18e1a7dfa6fc86635037698a9fff802d72fb7e6d0869aad1ecf95e8adb6ee147

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d507d47c8d678011c7e4f2e930e06249

SHA1
a399d4abe465d302b19966cc67cda4e54e35a1ac

SHA256
8bfef4d89b9e9e49741aedd4b053883be54295bc8c41c0c3a58946dbe3730f8a

SHA512
6ed8d9ef32064099deb83820ca85f05e770fe87dd75f9928bd3b1f0d48225eccbbe40676beb29b132242b510eb5e3c6635679dcab3afd0b40fba4f9665b4a740

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c0c2634dd1c0810aae29d07513e22793

SHA1
17589d6828cb0c216d7a473590a20705531bb11b

SHA256
039fd1243dee02b887d16033f2899e1b6ed434249b2be9e19dde5453c44af230

SHA512
b240e37b99c52b7de0d3c6823840b40200f6469225bfb5a4d0fdb938510290c7e6ac22f2f722833a26c5a4d4aebb4759023bf8441685a4acd1e1b6f725673928

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
d090eef800ec9490d998fac1af6ef49b

SHA1
5b38ad3d6fad65932c49cb4b847c949c1beb157b

SHA256
8770d336765fb11ee89a575acbdc4eea8963ea887415046e7899de21fedf5fca

SHA512
4ec53e675c8de54173c8bdbcfbaa19a6f0bd4243e0e426499c61faf063178219823756f0b564b4bab88b272a104d0f6b67c7628603b5b3dd564630dda42e1f31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
65aa677074e74d8f868f12b2c9889f10

SHA1
2b660c3b855effaa083f0c97587a1a9adf8cb6b4

SHA256
2e8c3c04778df9d004d2d4eebff3d71795cfc97c773b75b527382280aa6dfe3d

SHA512
67667b9d00baa28ca300f6a9cec8e2657362a42d9839597a78d8091e58e482ac586a982d026db24d8ca7ca2d5630c226f0be8d2721338b2d2bdd1b7710c3b77c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ca87d5926fe2ade6ed186e5bccca62a0

SHA1
c400a8f6339e60f6423da233cf458226be3969bd

SHA256
634caeba55c4e119553c881abe10f595672de86e67a435a4c186a27080ee6b76

SHA512
563021272291ee5fca523e82c7411f1a3e2fa370d01b5ee3b2be4b2616726cd31e78dd7ceb77daf820b2609d10e23b3f27e173398bc53662e1015e54023d09e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
bbd793fdb5878cd38a4a29a52e1a465f

SHA1
0ba357a1908592cbbe692d3f3b57e2de89c7e9da

SHA256
21a1c6aa45062c4c115ab6182ecb0fb22fb8c3c8a5e929e91954cd42e29c9a5d

SHA512
75e43cb538a901a2ed039f1e8d69b11853c914d16d16d3977d6a8262a2069b1da2f5919f7a21096dea976313ea1a668781f2a30be26b9e4e3f2e328a54e2a5a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b14ef34bbd5bfbc6c4c104492b957bf2

SHA1
e25d4f6cb5f66dcdafd5e8d0c2cd0c30167fe57e

SHA256
7125679967d68e89069436df3603bdb3817561cb308ea495560fadc73c4ed31d

SHA512
1e1d09a9866a46bedea5ba07c8a5e502674151eded351a5cade4797d09a2756bad5a51ab3cae65c8c2b34daf464044f6a2f7b46cb9d2667254f4d5b95a1ecc7d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58074e.TMP

Filesize
1KB

MD5
2e327bbe48b735f21c97453ce20c13c1

SHA1
ff8985291bbf30fb930faa75beb2c83782a562af

SHA256
9889c91152efd9cb3d50c49c6631d83f5ad79d7ba3b78fe3f72c6da0451ec927

SHA512
f201446744e8c11269d83271187736b8b627addd611e56e651942d6afe4c0fbb5be8b69c294e3743389386cbbf5bea292966b29352b68d3be4384cbb6f7e9e54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a0158a65442831a8c222a4462d4b7b22

SHA1
088ceaeaad7b4c51144c813c2bbefe9345f68a56

SHA256
3bb11bfd67e838bd0fcdd9ad99a743f658b0940b7448dc5e3473cbbee00a448c

SHA512
1202d60913e84d175cf8ef813d6a7f2d23e8248735e2dd7002e9290d9ae15d1dfae97cf111765173438642b540b09822e320b8d191a7f0654c5bb250825a0b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3ad3a1c0bfe7d2e11c121e25ea8ae7a

SHA1
fbd858e2f241ed9584e6718422ddcc4e21412928

SHA256
a41efa2fa3a4bb915da1082a6e5460d5b75f0efe053d1fb6403550281a27e983

SHA512
254336a5e1bf7d6c7867f04e5fe646a6b44c24b30586cdf35ddfa6807873678dcc46e0f75e3c1e562e40823afa3dbef34a6dc35f426d51a9601e17814732a401

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b19085a8369ca33974d8549ce00f03b1

SHA1
4d49fa76a374ba0df9f05e60e9b4591ff52a8d8a

SHA256
8338bdeca6d625269e73110246abda6e2acf6b3d0e039ee913ce5b20df4fba64

SHA512
ba577d12f8aaef17c79ba7c4d9b0f68f3ed47ec594904889c7467062aac04d6ecfb84cfb13c42baefa57466af90bce49b9ebadc9f243e414726db23c7c05d5e0

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ssfubhx\4ssfubhx.dll

Filesize
15KB

MD5
f7ef38896b4417dabebfcd09d9ccee8a

SHA1
03c6ebedfea87076ba810ef53ed7f42b0217591d

SHA256
3e8556c17095b54f903ddee95cd245e07386527512e8f182675d92703526e7e0

SHA512
6352187ebd75b6693c0462ca2eccef2ecb5eb05cedbbc316dd6c5a4f213d99b12ccddf482bde6269405123de414294dc5b20152ced0d52d666f5f16b738c16f8

Download Submit
C:\Users\Admin\AppData\Local\Temp\4ssfubhx\4ssfubhx.pdb

Filesize
49KB

MD5
cc69a4609873c30380738b752df89588

SHA1
5ab7eb35d0072cff36fc559143877d60d0441ae9

SHA256
d42affd5b4a65ba460f7d80c4cc7384eb444fd82d60aee68f84ff8dd0c89ee64

SHA512
9e0cfedf1e43b237c9d21572d5d0c9751c8b232dba5faee06c4f7a0c1a603365654bf4e6f0d97f0f11e6d02b7d3214a60e1ce6f713ffec47fdd2dec6782c8cda

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4AC6.tmp

Filesize
1KB

MD5
5c47e73544167aabfbe3d75c9a3addf4

SHA1
44399892ed0e8ad6768276ecf8523c206c743454

SHA256
746dc9c5c7d0054018de85c4790dc01427556cd2ee97cf75e683cd0093a6047f

SHA512
f93060c9573bd171d41d0e06631d33916d71a680da9732423981609ab1897160a305dff74f7703a7df91babb597b401e738e25a84e75f823b20c1ae863b6eca2

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES4C2D.tmp

Filesize
1KB

MD5
47df073b6656d910224a62015344d6d3

SHA1
43d2412890cdf7e849a5fecb7262ae8d27c74f0d

SHA256
8436b8ba1790cf33c2adfa5d94b018cbba664ad63991499a6135d7b47fc1e018

SHA512
1c071dc897bd1eaba82ae1cd6ab643497ae391a678e03348bb77a3d3d6e8700085cfed41888b585735fa5a87c9b88f2458dbf02144ebf75ffa5666c3c22134de

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES6112.tmp

Filesize
1KB

MD5
e68ec5bdbd222da39d4a06ff6fb6036b

SHA1
57ac73b653ca56633c4716305466c65e50d923ec

SHA256
28e9e14b40e43a15eac24bddf00d358c5cf61e777af7299c652b9a8923a5ce96

SHA512
8b46077642765155a002632a014baedb393000d179ade1fbc8c047c6df0de83b616dfad5b4ace55fbfbf3cd37d40d4162b696ccc0ac1a5f5bdb49d69a1804df7

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESD21B.tmp

Filesize
1KB

MD5
37051eb1edede849fbd0f034a602b1ab

SHA1
fba0da283784c064c5464769a30e2c23c388158e

SHA256
eefbf579c77fc685380b9f3661383589c689240505c2a407c0422cce08aaf92f

SHA512
9b30577f32d010550c484639b95607a10a18ad3295c3a70599db11b22d5784780d7c2c86fbbe4e80325bad1d00770d157a12566bf53f9386bf2bfbc42502ca53

Download Submit
C:\Users\Admin\AppData\Local\Temp\RESE96C.tmp

Filesize
1KB

MD5
0e8eaa8d7bb9f0d49e63fe3108d46291

SHA1
5e3e8e086a6cbfe3a29469b4fd815cadbf855bd7

SHA256
846c5b82c574446f1541e8a3401d7d5dcec2e206f09aebd47833fa240c733004

SHA512
52acc0f62e641b1d3787aae7f20a74ae6aaa679e12f5cf745d7fbbdc89db09bfcab8759afdbc6f07a2eacf30389b457ff1ee371362890786209db0e98c760c0b

Download Submit
C:\Users\Admin\AppData\Local\Temp\g3zqd1n2\g3zqd1n2.dll

Filesize
15KB

MD5
b5be0ed4d0e8f8df2d722b2654e49ebc

SHA1
e670b906b387bf22855cd334c7b01b70ddf108ca

SHA256
e80e3ce7e227166bddcbb973b79e15fcaa2ac7675949e616262aa8991e37df02

SHA512
41d0da3da0eb1f0fe59fa3f2ef833d22270fdbed178cdb53f29fe030795cb59b19910a606ef0afccf3adf0ee3ab1518fcbcac41d8930e86d6e20dfabed4a9a2e

Download Submit
C:\Users\Admin\AppData\Local\Temp\g3zqd1n2\g3zqd1n2.pdb

Filesize
49KB

MD5
b7a7bc189addd41eeea508eca6b63765

SHA1
51920cd44edd2720860658a7e6f955b609ea128e

SHA256
13b98eb4c9cbcc4c2e1e49e36e179fe0e2f13e2a82ed5ef801b4633e5ba1f56a

SHA512
fdfb3e5f061aaaeeecae67e54145ec0540d56c42071a806529299eed89c00473ee0ea01cfa5492cc512c3a86d112183ed7123425f335bcbeb2ff3af7eb0007ea

Download Submit
C:\Users\Admin\AppData\Local\Temp\itqinc2k\itqinc2k.dll

Filesize
15KB

MD5
fdb79f147912c230c08ec11e98e8faf5

SHA1
9bb975a042d6d4790ac21b641f7d181229f6db02

SHA256
e5c9371136ab29a3555885d5a7bc3e4de9e88ab97a91b8fd21292ec87004fa3c

SHA512
ad78ad91961664276fc4a9e95d18cd6103847c88be459f7e9a44dde811e822c60e210a37d150b69cd7a1e38e5da6de8dba301a53cdd556332f42205c0a143c0a

Download Submit
C:\Users\Admin\AppData\Local\Temp\itqinc2k\itqinc2k.pdb

Filesize
49KB

MD5
8780ba79ab019c7bdda7a778e99177bf

SHA1
46e518a74c189538bbc41ac33bc2157dfd748676

SHA256
3ad02b5394e31201ba24289c8283b2de6e6ed590c655eb97c1e3abf2827023c1

SHA512
f49cfcc2315c93f42174d206888380f0420940b136917ad47b8c62e4adbba6a5ac7ba9c3b8fac0d1bb22549e7890de85c231f0259b17667b4cb8a07fca523fe6

Download Submit
C:\Users\Admin\AppData\Local\Temp\jywglkvc\jywglkvc.dll

Filesize
15KB

MD5
03b8e402b7a4b6949ee8bd02359ecc58

SHA1
000eb387db76182a2b4e472a32fa71b76b7865e0

SHA256
e8df46366c189d49d52359b3ea354766eb555142066425b8779d24b02affed27

SHA512
c9ae3b3ae4664febcd6ec89b62a7f12b6c5e77931f7012f58693304a115109664295b3d8de2fe6897399e76e95076f91d4331defbb52722962c3c5a45501021d

Download Submit
C:\Users\Admin\AppData\Local\Temp\jywglkvc\jywglkvc.pdb

Filesize
49KB

MD5
dd2030e7af7281582b20ea63d3eab15e

SHA1
c3c732bef5890f505a98a05bb611eff68e07cacd

SHA256
2da5aae55ca13e9e73c767c26b61c92f64cc8d2e04b8c6740f22cf8e93543e9c

SHA512
541369b468fa92aba7578848cd959be88d3dcae9f4931f75f1977081507a31dee4597554610de94a1d8f842f594771355924849f3226ae062fd214fa24d0db87

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbiygwxf\vbiygwxf.dll

Filesize
15KB

MD5
3794d7c5cc75dea4dba6133c6f7e4401

SHA1
2503db18f584483a6cdd223774763cb10b066591

SHA256
7d346c8b6c0b20b82c50ce3546ac65646dc6040f4031abb5ac1bf64c53e98a99

SHA512
11c426c69f926c891e9576a6e616c73e1ab2c359bafe40e8917f1e07f8967fbc55fb37e0501e7885827d76d222652a269adee3c61233ac4c4a1afc28e3b7a378

Download Submit
C:\Users\Admin\AppData\Local\Temp\vbiygwxf\vbiygwxf.pdb

Filesize
49KB

MD5
24856915119f05214b4279436c0f38be

SHA1
03f2ef3d61c34d240a78711daaabdf1d2e6529f7

SHA256
3f105bd188719b1ac4633e4eda2176b379d22a67f58591ca5854d8b4f71210aa

SHA512
8a1c628f76e4737c8a4de2aab6b438b5b6d823633024247e56d40c47e7aaafe30e71fa338b4fb550fdf228561e79d5f3df68fc1cc9d5f467daf8c6f9889738f9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\rTErod.url

Filesize
59B

MD5
7521802ee5f422a3f3cf20d49ae3d8db

SHA1
ab51bef3af43570212f360b11e0bf00e4d63ac40

SHA256
237cc45c98ef320df9497cce7db9d9acca3ba15a522496b01a290bce865c084a

SHA512
7bb89f5c4387cad69ce5ed4de0d3558864024a03cedffc528ba9a0b69a38521d7cc21a72a27c637ec78f6a606047fc0ae9c07973bdb57b301d1c605e7022c25c

Download Submit
C:\Users\Admin\Downloads\Satana\Satana\@[email protected]

Filesize
919B

MD5
2f7dd9602b594af505b955f9b78ccf1e

SHA1
a9ff4c1ee944459fbb591281639454c183ef7713

SHA256
1f5fc10ef017bc98338bf0f4ac1cfd6907f6ac5308efbceba0d0bdf3e0054efa

SHA512
4983d0999fd74110312e5968ee283a45f8d3fc9cbaf52479e6bd20c950609a0a9e089ee364476d0526c24aad56e064440477d43fab08879fc8a62af0d5a2c1fe

Download Submit
C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\Downloads\WannaCry\WannaCry\Ransomware.WannaCry\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ssfubhx\4ssfubhx.0.cs

Filesize
29KB

MD5
be0c48fc5057a467514eec58f1b1264b

SHA1
6d656174c6c9ab1e4c3d75cc9270a2aa4079183b

SHA256
8685fc1ef0ff239f59289b26d9aa7134998f4cc4a15b22c9a8922c071bb32639

SHA512
157df2d4ef94906418ea32be5feedc28aac61787033e7473f0eab8e22d32a2a83ddbb5c43c16b0d5f83c8c27f167e1fcf2967df35bdbafca75327dc35ed443f1

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ssfubhx\4ssfubhx.cmdline

Filesize
248B

MD5
a723383d365f5035c89c5974bfe34b8d

SHA1
9694ea5298701d1a56f08fb565518ad7150f22f2

SHA256
831b1b32cae9109ea65d16b8d261942ea510dfb2a5a8465ad1862dd4509a6fe0

SHA512
facea6e959219985ce0bf45b60a4130a3d78ee9510e81f0cbdc104a3a72def6ce4e145b2f87c05b5aac4c2e7f5bba44608618a22ff32816ef4048bb43439f29b

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\4ssfubhx\CSC1B8B32C444254615917EF92BE67291A6.TMP

Filesize
1KB

MD5
6b9bfb5bf6a0eec6fb13d863b956fa32

SHA1
cc8cab78f9b9b2211eea604e81640c9675f3561b

SHA256
f5d7947e43c871902dd5460d569c337015a10ecebe93372c2bc0e4f48ee00d0f

SHA512
8c6d26e6a4f6866f0b410470431025961ed1efe0c6aec46d799dafade4746867c8fcf9fdd75f30745fb1ec5b0e3705b779468f4d8aa06e63e3d877927023ce62

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g3zqd1n2\CSC8E316F41B42F49F9BAF39F436A0B9D8.TMP

Filesize
1KB

MD5
344a1033dba15e59afc7f815778b32d4

SHA1
d5d0a2c7a982a3df2da82824f93b5aecf1d627cb

SHA256
27aee7fffb7dfe98286d6a68482acb7ef4672c61525322996a921b06e817c482

SHA512
bbc96dacc2c0c0260c19d6920eb752f3f41c84e6dc47371fbcec61e1e50e4cdf0ba745d7f72b9592120d9c98f11498d3bd648c4e9f7080ccb67740ad264d6df0

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\g3zqd1n2\g3zqd1n2.cmdline

Filesize
248B

MD5
b54351b450fd49215b7631e96b3ba61c

SHA1
a931ec9f9d810060737631995810a67adff08ea9

SHA256
ce8864b9beae9f17c261857e5cc605d4aae136e9dd8fce57d66f488a342d4d70

SHA512
55abe61c097a34525d2c44784d513ceef001f62fdc06cad15265acc11f9b4598e2ebad4738efa4b665d7932a171d8fe5ea6c55f998a3a1b4e98e13a753aff0ce

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\itqinc2k\CSC2F580378D0994E919C22A644DA61C4F4.TMP

Filesize
1KB

MD5
411ac95a41e06ef91cf3cfacae522623

SHA1
b1ddf95d738994120609806de97c5dc5a444ade6

SHA256
18c48e3950be43f3d385fbdab8519547bdf224b102bfaeb247468205b38bb864

SHA512
bcce0f0d46876c6633a92fc182226857e02bda7e85af4acd36b68063085399c2ff5d37ed1a12f083fad10d06010ec968b43d1ce015249a7ca84e9550c32e61b7

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\itqinc2k\itqinc2k.cmdline

Filesize
248B

MD5
4cfbc227a66268fa266d063bee0514ad

SHA1
9784dda37043430a5b706b64031e40138623b94e

SHA256
527849ebedd77d266cd261dea5568ee0bd448c80269df59f986af94f87833caa

SHA512
4be5fe4a2c7cdc22f8527412580935cd59b2d931626873d679c9954e2f6bd1186d30ed64b0aa6b05a090e5f90ff50fc09e1e836e4fa3f328ce6bae4b095bd244

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jywglkvc\CSC11B2D8BEB7DC40C0B033216AABECBCB6.TMP

Filesize
1KB

MD5
01796a1fad309f6a09ba88391373611b

SHA1
4f1e2ce36a3f1fb81e1b97285813e1345132e2f4

SHA256
4433fa3a107939bf3d91ea2dac3bf86ec662ad375d93c88486efdcc5285ce71a

SHA512
745ddecc8370601f54c8070d7f01b76b2c3d7fff1b23eeb179fb2e0a048bdf621baf4266b4703db1bf22e1b6aa1a8e26a424d01b0f2d0706a88ee7a3654a33a4

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\jywglkvc\jywglkvc.cmdline

Filesize
248B

MD5
b5b82a07e27b6a5ed03878662edb1812

SHA1
069b4424619fe5c8d2c829f9657abe31ab80d955

SHA256
5b4d4a0c33dfc62bdab95466fbd58065cc6768180c2a9da64180c608ac3b3adc

SHA512
9923fe0bed4f61308dad077c0c8060b9a4eddfb06e56c29daa494692d6a03895fedcc288853d577fe10bb485b54a1b62cd92f4c52f62ffd4c2389e434aa907b6

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vbiygwxf\CSC7CCAA5E89A5E4C6D8924C44A4DE8C215.TMP

Filesize
1KB

MD5
1195c547ebea5a6f8423f7af89e54b7d

SHA1
7c56a67dea98cd55b573f62c6a5306a88bc4075a

SHA256
da2c153349b9f28f26629ad587ea5bd2eba50f050d65d02f1639b9bb07db770a

SHA512
a44917a134d70b8c4b24bd9fdd077e81985551cefcd06d67bfb4398454f5d3ce7b46fb5562f06f7cfe0d875c61d081ba51a6c7d2122d6349c11feafe155562c9

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\vbiygwxf\vbiygwxf.cmdline

Filesize
248B

MD5
15ba986ebea17124862899ea3b2fdb65

SHA1
46e859ca2d6ba9eacacf7e50b26bd363092b01db

SHA256
3b4faeba41af11084023f8c9dc5fd1a2c31f920e4c4974eedbf0775d34b91832

SHA512
29fe3c8c049d77b72203ad45814239d7eb5a5cd11407364df2fa990f0e43da87db2a84369de73ee5795716e402f4b6ca72fa14c6437314b59111d9642c46ff5b

Download Submit
memory/956-521-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/1920-587-0x00000000031F0000-0x00000000031FA000-memory.dmp

Filesize
40KB

Download
memory/2104-547-0x0000000001370000-0x000000000137A000-memory.dmp

Filesize
40KB

Download
memory/2900-2376-0x00000000009C0000-0x00000000009CA000-memory.dmp

Filesize
40KB

Download
memory/3148-2392-0x0000000002850000-0x0000000002919000-memory.dmp

Filesize
804KB

Download
memory/3148-2391-0x0000000002850000-0x0000000002919000-memory.dmp

Filesize
804KB

Download
memory/3356-561-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-560-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-565-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-566-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-567-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-568-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-570-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-571-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-569-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3356-559-0x00000250736F0000-0x00000250736F1000-memory.dmp

Filesize
4KB

Download
memory/3588-552-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3588-557-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/3976-477-0x0000000005520000-0x00000000055B2000-memory.dmp

Filesize
584KB

Download
memory/3976-478-0x0000000005AD0000-0x0000000005BA6000-memory.dmp

Filesize
856KB

Download
memory/3976-460-0x0000000000BE0000-0x0000000000CC8000-memory.dmp

Filesize
928KB

Download
memory/3976-475-0x0000000002E20000-0x0000000002E2A000-memory.dmp

Filesize
40KB

Download
memory/3976-483-0x0000000005BA0000-0x0000000005C3C000-memory.dmp

Filesize
624KB

Download
memory/3976-482-0x00000000056E0000-0x00000000057A9000-memory.dmp

Filesize
804KB

Download
memory/3976-479-0x0000000005500000-0x000000000550C000-memory.dmp

Filesize
48KB

Download
memory/4012-614-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4280-372-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4280-370-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4280-373-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4280-369-0x0000000000400000-0x000000000041B000-memory.dmp

Filesize
108KB

Download
memory/4420-489-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4420-484-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4420-486-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download
memory/4740-596-0x00000000051F0000-0x00000000052B9000-memory.dmp

Filesize
804KB

Download
memory/4740-611-0x0000000005450000-0x000000000545A000-memory.dmp

Filesize
40KB

Download
memory/4740-613-0x00000000051F0000-0x00000000052B9000-memory.dmp

Filesize
804KB

Download
memory/5076-509-0x0000000004C80000-0x0000000004C8A000-memory.dmp

Filesize
40KB

Download
memory/5144-2363-0x0000000073CB0000-0x0000000073D32000-memory.dmp

Filesize
520KB

Download
memory/5144-2393-0x0000000000260000-0x000000000055E000-memory.dmp

Filesize
3.0MB

Download
memory/5144-2361-0x0000000073F80000-0x0000000074002000-memory.dmp

Filesize
520KB

Download
memory/5144-2364-0x0000000073C80000-0x0000000073CA2000-memory.dmp

Filesize
136KB

Download
memory/5144-2402-0x0000000000260000-0x000000000055E000-memory.dmp

Filesize
3.0MB

Download
memory/5144-2401-0x0000000003D50000-0x0000000003E19000-memory.dmp

Filesize
804KB

Download
memory/5144-2400-0x0000000003D50000-0x0000000003E19000-memory.dmp

Filesize
804KB

Download
memory/5144-2365-0x0000000000260000-0x000000000055E000-memory.dmp

Filesize
3.0MB

Download
memory/5144-2394-0x0000000073F80000-0x0000000074002000-memory.dmp

Filesize
520KB

Download
memory/5144-2396-0x0000000073D40000-0x0000000073F5C000-memory.dmp

Filesize
2.1MB

Download
memory/5144-2399-0x0000000073C00000-0x0000000073C77000-memory.dmp

Filesize
476KB

Download
memory/5144-2398-0x0000000073C80000-0x0000000073CA2000-memory.dmp

Filesize
136KB

Download
memory/5144-2397-0x0000000073CB0000-0x0000000073D32000-memory.dmp

Filesize
520KB

Download
memory/5144-2362-0x0000000073D40000-0x0000000073F5C000-memory.dmp

Filesize
2.1MB

Download
memory/5144-2395-0x0000000073F60000-0x0000000073F7C000-memory.dmp

Filesize
112KB

Download
memory/5524-892-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/5524-2390-0x0000000003410000-0x00000000034D9000-memory.dmp

Filesize
804KB

Download
memory/5524-2383-0x0000000003410000-0x00000000034D9000-memory.dmp

Filesize
804KB

Download
memory/5676-2380-0x0000000000400000-0x00000000004C9000-memory.dmp

Filesize
804KB

Download