wannacry | 1005d1262f355c963be3c8c056af74842b3c495d688ca3a6d4a31132f94d34cf

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MintInjector.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	MintInjector.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	MintInjector.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDFAB2.tmp	WannaCry.EXE
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDFAC5.tmp	WannaCry.EXE

Executes dropped EXE 8 IoCs

pid	Process
3464	taskdl.exe
2320	@[email protected]
2740	@[email protected]
3372	taskhsvc.exe
3748	@[email protected]
2080	taskdl.exe
1712	taskse.exe
3476	@[email protected]

Loads dropped DLL 21 IoCs

pid	Process
3460	WannaCry.EXE
3460	WannaCry.EXE
2704	cscript.exe
3460	WannaCry.EXE
3460	WannaCry.EXE
692	cmd.exe
692	cmd.exe
2320	@[email protected]
2320	@[email protected]
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3460	WannaCry.EXE
3460	WannaCry.EXE
3460	WannaCry.EXE
3460	WannaCry.EXE
3460	WannaCry.EXE
3460	WannaCry.EXE

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1496	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\lmlkrbkipiq805 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_WannaCry-main.zip\\WannaCry-main\\tasksche.exe\""	reg.exe

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	MintInjector.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 4 IoCs

Web Service

T1102

flow	ioc
164	camo.githubusercontent.com
172	camo.githubusercontent.com
174	camo.githubusercontent.com
175	camo.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	WannaCry.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
2736	MintInjector.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	POWERPNT.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vssadmin.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CLVIEW.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Office loads VBA resources, possible macro or embedded object present

Checks processor information in registry 2 TTPs 15 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\CurrentPatchLevel	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Interacts with shadow copies 3 TTPs 1 IoCs

Shadow copies are often targeted by ransomware to inhibit system recovery.

ransomware

File Deletion

T1070.004

Inhibit System Recovery

T1490

Direct Volume Access

T1006

pid	Process
2124	vssadmin.exe

Modifies Internet Explorer settings 1 TTPs 3 IoCs

adware spyware

Modify Registry

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main	CLVIEW.EXE
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	CLVIEW.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	CLVIEW.EXE

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-3063565911-2056067323-3330884624-1000_Classes\Local Settings	firefox.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

pid	Process
1884	reg.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry-main.zip:Zone.Identifier	firefox.exe

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
2584	WINWORD.EXE
2504	POWERPNT.EXE

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe
3372	taskhsvc.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	992	firefox.exe
Token: SeDebugPrivilege	3692	firefox.exe
Token: SeDebugPrivilege	3692	firefox.exe
Token: SeDebugPrivilege	3692	firefox.exe
Token: 33	3772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3772	AUDIODG.EXE
Token: 33	3772	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3772	AUDIODG.EXE
Token: SeBackupPrivilege	1420	vssvc.exe
Token: SeRestorePrivilege	1420	vssvc.exe
Token: SeAuditPrivilege	1420	vssvc.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: SeIncreaseQuotaPrivilege	4084	WMIC.exe
Token: SeSecurityPrivilege	4084	WMIC.exe
Token: SeTakeOwnershipPrivilege	4084	WMIC.exe
Token: SeLoadDriverPrivilege	4084	WMIC.exe
Token: SeSystemProfilePrivilege	4084	WMIC.exe
Token: SeSystemtimePrivilege	4084	WMIC.exe
Token: SeProfSingleProcessPrivilege	4084	WMIC.exe
Token: SeIncBasePriorityPrivilege	4084	WMIC.exe
Token: SeCreatePagefilePrivilege	4084	WMIC.exe
Token: SeBackupPrivilege	4084	WMIC.exe
Token: SeRestorePrivilege	4084	WMIC.exe
Token: SeShutdownPrivilege	4084	WMIC.exe
Token: SeDebugPrivilege	4084	WMIC.exe
Token: SeSystemEnvironmentPrivilege	4084	WMIC.exe
Token: SeRemoteShutdownPrivilege	4084	WMIC.exe
Token: SeUndockPrivilege	4084	WMIC.exe
Token: SeManageVolumePrivilege	4084	WMIC.exe
Token: 33	4084	WMIC.exe
Token: 34	4084	WMIC.exe
Token: 35	4084	WMIC.exe
Token: SeTcbPrivilege	1712	taskse.exe
Token: SeTcbPrivilege	1712	taskse.exe

Suspicious use of FindShellTrayWindow 8 IoCs

pid	Process
992	firefox.exe
992	firefox.exe
992	firefox.exe
992	firefox.exe
3692	firefox.exe
3692	firefox.exe
3692	firefox.exe
3692	firefox.exe

Suspicious use of SendNotifyMessage 6 IoCs

pid	Process
992	firefox.exe
992	firefox.exe
992	firefox.exe
3692	firefox.exe
3692	firefox.exe
3692	firefox.exe

Suspicious use of SetWindowsHookEx 18 IoCs

pid	Process
2584	WINWORD.EXE
2584	WINWORD.EXE
2584	WINWORD.EXE
2504	POWERPNT.EXE
2864	CLVIEW.EXE
2864	CLVIEW.EXE
2864	CLVIEW.EXE
2864	CLVIEW.EXE
3692	firefox.exe
3692	firefox.exe
3692	firefox.exe
2320	@[email protected]
2320	@[email protected]
2740	@[email protected]
2740	@[email protected]
3748	@[email protected]
3748	@[email protected]
3476	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2504 wrote to memory of 2832	2504	POWERPNT.EXE	35
PID 2504 wrote to memory of 2832	2504	POWERPNT.EXE	35
PID 2504 wrote to memory of 2832	2504	POWERPNT.EXE	35
PID 2504 wrote to memory of 2832	2504	POWERPNT.EXE	35
PID 2504 wrote to memory of 2864	2504	POWERPNT.EXE	36
PID 2504 wrote to memory of 2864	2504	POWERPNT.EXE	36
PID 2504 wrote to memory of 2864	2504	POWERPNT.EXE	36
PID 2504 wrote to memory of 2864	2504	POWERPNT.EXE	36
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 2308 wrote to memory of 992	2308	firefox.exe	38
PID 992 wrote to memory of 340	992	firefox.exe	39
PID 992 wrote to memory of 340	992	firefox.exe	39
PID 992 wrote to memory of 340	992	firefox.exe	39
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40
PID 992 wrote to memory of 2300	992	firefox.exe	40

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3388	attrib.exe
1480	attrib.exe

C:\Users\Admin\AppData\Local\Temp\MintInjector.exe
"C:\Users\Admin\AppData\Local\Temp\MintInjector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2736

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\Desktop\UnpublishTest.docx"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
PID:2584

C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE
"C:\Program Files (x86)\Microsoft Office\Office14\POWERPNT.EXE" /s "C:\Users\Admin\Desktop\OutBackup.ppsx"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504
- C:\Windows\splwow64.exe
  C:\Windows\splwow64.exe 12288
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\CLVIEW.EXE" "POWERPNT" "Microsoft PowerPoint"
  2⤵
  - Process spawned unexpected child process
  - System Location Discovery: System Language Discovery
  - Modifies Internet Explorer settings
  - Suspicious use of SetWindowsHookEx
  PID:2864

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2308
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:992
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.0.1860207009\1659549432" -parentBuildID 20221007134813 -prefsHandle 1284 -prefMapHandle 1276 -prefsLen 20847 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {95fe5e15-79a2-4d46-af90-53d76efbe6f6} 992 "\\.\pipe\gecko-crash-server-pipe.992" 1348 107ec958 gpu
    3⤵
    PID:340
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.1.187072658\2106777987" -parentBuildID 20221007134813 -prefsHandle 1540 -prefMapHandle 1536 -prefsLen 20928 -prefMapSize 233444 -appDir "C:\Program Files\Mozilla Firefox\browser" - {bebca424-1f4d-4cf5-8253-30fb61a552f8} 992 "\\.\pipe\gecko-crash-server-pipe.992" 1552 42ed558 socket
    3⤵
    - Checks processor information in registry
    PID:2300
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.2.384810386\66458850" -childID 1 -isForBrowser -prefsHandle 2056 -prefMapHandle 2052 -prefsLen 20966 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d8b41b55-65e8-4c46-bd15-cdbf20d2a611} 992 "\\.\pipe\gecko-crash-server-pipe.992" 2068 1a184358 tab
    3⤵
    PID:2068
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.3.1714986959\103084250" -childID 2 -isForBrowser -prefsHandle 2344 -prefMapHandle 2340 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {eec967d7-98f7-40fa-8850-112031ff2075} 992 "\\.\pipe\gecko-crash-server-pipe.992" 2460 e67858 tab
    3⤵
    PID:2532
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.4.1737909850\1029054374" -childID 3 -isForBrowser -prefsHandle 2976 -prefMapHandle 2972 -prefsLen 26216 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {edaeda0f-a078-4e8a-96b6-1a291825bbec} 992 "\\.\pipe\gecko-crash-server-pipe.992" 2988 e62558 tab
    3⤵
    PID:876
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.5.394792256\464615345" -childID 4 -isForBrowser -prefsHandle 3836 -prefMapHandle 3832 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {353706f6-3b24-40ce-8b35-1ee7c2a535c1} 992 "\\.\pipe\gecko-crash-server-pipe.992" 3848 e2d858 tab
    3⤵
    PID:2560
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.6.929544824\1308782876" -childID 5 -isForBrowser -prefsHandle 3956 -prefMapHandle 3960 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d9a1d23f-fe7e-4f9a-b580-8383b602ee8b} 992 "\\.\pipe\gecko-crash-server-pipe.992" 3944 1d53e058 tab
    3⤵
    PID:2544
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.7.870600707\1575464991" -childID 6 -isForBrowser -prefsHandle 4144 -prefMapHandle 4148 -prefsLen 26275 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4c45489c-b586-4ac3-a3f2-091c187559dc} 992 "\\.\pipe\gecko-crash-server-pipe.992" 4136 1e9e4458 tab
    3⤵
    PID:2140
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="992.8.2119300750\106698251" -childID 7 -isForBrowser -prefsHandle 4460 -prefMapHandle 4452 -prefsLen 26531 -prefMapSize 233444 -jsInitHandle 652 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {64c7478f-1818-4fda-b7ed-cc86f9a3a6fb} 992 "\\.\pipe\gecko-crash-server-pipe.992" 4456 22195058 tab
    3⤵
    PID:2216

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe"
1⤵
PID:3684
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe"
  2⤵
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of SetWindowsHookEx
  PID:3692
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.0.37889056\1061335180" -parentBuildID 20221007134813 -prefsHandle 1224 -prefMapHandle 1216 -prefsLen 20971 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {d508e93e-83d8-407f-b768-27267dd7e2dc} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 1304 107e9e58 gpu
    3⤵
    PID:3868
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.1.368448313\456997585" -parentBuildID 20221007134813 -prefsHandle 1480 -prefMapHandle 1476 -prefsLen 21052 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {6d18aaf2-939d-4807-bc07-32c32d284131} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 1492 e72258 socket
    3⤵
    PID:3940
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.2.1362374723\163018972" -childID 1 -isForBrowser -prefsHandle 1996 -prefMapHandle 1992 -prefsLen 21155 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {efdcbb4e-a033-4659-b82c-d7d3fbcf2cc6} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 2008 1a03c758 tab
    3⤵
    PID:3128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.3.1112534053\1153731526" -childID 2 -isForBrowser -prefsHandle 652 -prefMapHandle 2028 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {482f68d8-0631-4b39-9a1e-251484e59b83} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 2288 1a1bd558 tab
    3⤵
    PID:800
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.4.1772724948\53279376" -childID 3 -isForBrowser -prefsHandle 2324 -prefMapHandle 2328 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {f1cd5783-d9d5-4f19-a3cb-806c9bd28a31} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 2464 1b9a6358 tab
    3⤵
    PID:804
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.5.1721397688\1379211018" -childID 4 -isForBrowser -prefsHandle 3380 -prefMapHandle 1112 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {df833255-fc18-47fc-9997-15f2b7c2ea9a} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 3392 e30558 tab
    3⤵
    PID:2128
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.6.1794180398\1222828742" -childID 5 -isForBrowser -prefsHandle 3500 -prefMapHandle 3504 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {8a6233f5-c8e0-4740-a775-11122290d6b6} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 3488 1d336058 tab
    3⤵
    PID:1308
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.7.1392484837\377137174" -childID 6 -isForBrowser -prefsHandle 3692 -prefMapHandle 3696 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {3d327ac1-cfe3-4106-bd8b-4d33f37d5ef5} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 3680 1d334858 tab
    3⤵
    PID:2092
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.8.1295244101\568295275" -childID 7 -isForBrowser -prefsHandle 4100 -prefMapHandle 4104 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1883ce02-54fc-4d1d-823a-06ffa520aef4} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4204 21e30658 tab
    3⤵
    PID:2728
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.9.909501931\404131855" -parentBuildID 20221007134813 -prefsHandle 4392 -prefMapHandle 4372 -prefsLen 26340 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {7a3082b4-f1c1-4b57-877e-b8c06e1472ca} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4404 21a44058 rdd
    3⤵
    PID:1944
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.10.600053259\479383723" -parentBuildID 20221007134813 -sandboxingKind 1 -prefsHandle 4508 -prefMapHandle 4504 -prefsLen 26340 -prefMapSize 233496 -appDir "C:\Program Files\Mozilla Firefox\browser" - {fa79d564-ef5a-40eb-9603-e68b11529ad9} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4520 22df4858 utility
    3⤵
    PID:1700
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.11.1408671922\814374549" -childID 8 -isForBrowser -prefsHandle 4508 -prefMapHandle 4628 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {4bf1a689-a45c-46b8-8e87-8035ce34e35f} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4660 22fef758 tab
    3⤵
    PID:1192
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.12.1150072465\98201793" -childID 9 -isForBrowser -prefsHandle 4780 -prefMapHandle 4784 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {abe3c41e-db2a-43ea-b1b1-c0b8d8529134} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4768 22fefd58 tab
    3⤵
    PID:3656
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.13.762763427\390153281" -childID 10 -isForBrowser -prefsHandle 2432 -prefMapHandle 3804 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {1657f4b2-6753-41d6-b3d8-14229011e9a1} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4028 1d3d5858 tab
    3⤵
    PID:1160
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.14.1396317026\85208794" -childID 11 -isForBrowser -prefsHandle 3236 -prefMapHandle 3224 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {ca21fcbc-5436-495b-91cf-d93d8f5d4792} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4736 23d2cc58 tab
    3⤵
    PID:3020
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel="3692.15.442503558\36497368" -childID 12 -isForBrowser -prefsHandle 4052 -prefMapHandle 4040 -prefsLen 26340 -prefMapSize 233496 -jsInitHandle 864 -jsInitLen 246848 -a11yResourceId 64 -parentBuildID 20221007134813 -appDir "C:\Program Files\Mozilla Firefox\browser" - {dd6ade3a-3915-4353-9d87-34dd73939d74} 3692 "\\.\pipe\gecko-crash-server-pipe.3692" 4044 1bcaf658 tab
    3⤵
    PID:3752

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4ec
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\WannaCry.EXE
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\WannaCry.EXE"
1⤵
- Drops startup file
- Loads dropped DLL
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
PID:3460
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3388
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:1496
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:3464
- C:\Windows\SysWOW64\cmd.exe
  cmd /c 54521727472936.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3516
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    PID:2704
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1480
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2320
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:3372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:692
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2740
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:3688
    - - C:\Windows\SysWOW64\vssadmin.exe
        
        vssadmin delete shadows /all /quiet
        5⤵
        System Location Discovery: System Language Discovery
        Interacts with shadow copies
        
        PID:2124
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:4084
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  PID:2080
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:1712
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:3476
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lmlkrbkipiq805" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:1528
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "lmlkrbkipiq805" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCry-main.zip\WannaCry-main\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:1884

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1420

C:\Users\Admin\Desktop\@[email protected]
"C:\Users\Admin\Desktop\@[email protected]"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Direct Volume Access

T1006

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

System Information Discovery