wannacry | hxxps://github[.]com/Endermanch/MalwareDatabase/tree/master/ransomwares

Resubmissions

30-09-2024 04:43

240930-fcd9xayenq 6

30-09-2024 04:39

29-09-2024 07:53

29-09-2024 07:47

28-09-2024 19:59

Analysis

max time kernel
299s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Endermanch/MalwareDatabase/tree/master/ransomwares

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw Next, please find an application file named "@[email protected]". It is the decrypt software. Run and follow the instructions! (You may need to disable your antivirus for a while.) Q: How can I trust? A: Don't worry about decryption. We will decrypt your files surely because nobody will trust us if we cheat users. * If you need our assistance, send a message by clicking <Contact Us> on the decryptor window. �

Wallets

12t9YDPgwueZ9NyMgw519p7AA8isjr6SMw

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Program Files (x86)\\Windows\\Error file remover\\fatalerror.exe"	msiexec.exe

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SD52CA.tmp	[email protected]
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SD52D1.tmp	[email protected]

Executes dropped EXE 13 IoCs

pid	Process
3116	taskdl.exe
4884	@[email protected]
4572	@[email protected]
4276	taskhsvc.exe
1048	taskdl.exe
5024	taskse.exe
2296	@[email protected]
2752	taskdl.exe
112	taskse.exe
244	@[email protected]
3968	taskse.exe
4800	@[email protected]
516	taskdl.exe

Loads dropped DLL 39 IoCs

pid	Process
4796	[email protected]
4796	[email protected]
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
3288	MsiExec.exe
5056	MsiExec.exe
3288	MsiExec.exe
4796	[email protected]
3288	MsiExec.exe
868	[email protected]
868	[email protected]
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
3124	MsiExec.exe
5008	MsiExec.exe
3124	MsiExec.exe
868	[email protected]
3124	MsiExec.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4488	icacls.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\rbeoqsjruepbaol925 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Temp1_WannaCrypt0r.zip\\tasksche.exe\""	reg.exe

Blocklisted process makes network request 2 IoCs

flow	pid	Process
197	3288	MsiExec.exe
199	3124	MsiExec.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\U:	[email protected]
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	[email protected]
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\W:	[email protected]
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\J:	[email protected]
File opened (read-only)	\??\L:	[email protected]
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\E:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	[email protected]
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\M:	[email protected]
File opened (read-only)	\??\E:	msiexec.exe
File opened (read-only)	\??\T:	[email protected]
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\Z:	[email protected]
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	[email protected]
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\B:	[email protected]
File opened (read-only)	\??\V:	[email protected]
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\S:	[email protected]
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\A:	[email protected]
File opened (read-only)	\??\K:	[email protected]
File opened (read-only)	\??\X:	[email protected]
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\E:	msiexec.exe

File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
defense_evasion

Windows File and Directory Permissions Modification
T1222.001

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
127	raw.githubusercontent.com
128	raw.githubusercontent.com
129	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	[email protected]
Set value (str)	\REGISTRY\USER\S-1-5-21-2170637797-568393320-3232933035-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\@[email protected]"	@[email protected]

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\Windows Logoff Sound.wav	msiexec.exe
File opened for modification	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe
File created	C:\Program Files (x86)\Windows\Error file remover\fatalerror.exe	msiexec.exe

Drops file in Windows directory 38 IoCs

description	ioc	Process
File created	C:\Windows\Tasks\sys.job	MsiExec.exe
File opened for modification	C:\Windows\Installer\MSIDE31.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDE9F.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB26D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB68D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEB0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDEDF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDF7D.tmp	msiexec.exe
File opened for modification	C:\Windows\Tasks\sys.job	MsiExec.exe
File created	C:\Windows\Installer\e5aaecf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB2EB.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3B8.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB487.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC29.tmp	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDCD7.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE192.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aaecf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB152.tmp	msiexec.exe
File created	C:\Windows\Installer\SourceHash{C452D4E2-DE24-48B6-B5C3-ACB240A01606}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3C9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB409.tmp	msiexec.exe
File created	C:\Windows\Installer\e5aaed3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDC88.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIAF6B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB066.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDB7B.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB3E9.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB5D0.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\e5aaed3.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDD36.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIDBDA.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE0C6.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIE26E.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB23D.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIB369.tmp	msiexec.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 32 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskdl.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	@[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskse.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MsiExec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskhsvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	[email protected]
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	msiexec.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 7 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133720698805126600"	msedge.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\26\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\SOFTWARE\CLASSES\LOCAL SETTINGS\MUICACHE\27	msiexec.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2170637797-568393320-3232933035-1000\{7780C683-B449-4DCE-BB05-43C037C788F5}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
4036	reg.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
4272	vlc.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2144	msiexec.exe
2144	msiexec.exe
2144	msiexec.exe
2144	msiexec.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
4276	taskhsvc.exe
3236	msedge.exe
3236	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
2296	@[email protected]
4272	vlc.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	2144	msiexec.exe
Token: SeCreateTokenPrivilege	4796	[email protected]
Token: SeAssignPrimaryTokenPrivilege	4796	[email protected]
Token: SeLockMemoryPrivilege	4796	[email protected]
Token: SeIncreaseQuotaPrivilege	4796	[email protected]
Token: SeMachineAccountPrivilege	4796	[email protected]
Token: SeTcbPrivilege	4796	[email protected]
Token: SeSecurityPrivilege	4796	[email protected]
Token: SeTakeOwnershipPrivilege	4796	[email protected]
Token: SeLoadDriverPrivilege	4796	[email protected]
Token: SeSystemProfilePrivilege	4796	[email protected]
Token: SeSystemtimePrivilege	4796	[email protected]
Token: SeProfSingleProcessPrivilege	4796	[email protected]
Token: SeIncBasePriorityPrivilege	4796	[email protected]
Token: SeCreatePagefilePrivilege	4796	[email protected]
Token: SeCreatePermanentPrivilege	4796	[email protected]
Token: SeBackupPrivilege	4796	[email protected]
Token: SeRestorePrivilege	4796	[email protected]
Token: SeShutdownPrivilege	4796	[email protected]
Token: SeDebugPrivilege	4796	[email protected]
Token: SeAuditPrivilege	4796	[email protected]
Token: SeSystemEnvironmentPrivilege	4796	[email protected]
Token: SeChangeNotifyPrivilege	4796	[email protected]
Token: SeRemoteShutdownPrivilege	4796	[email protected]
Token: SeUndockPrivilege	4796	[email protected]
Token: SeSyncAgentPrivilege	4796	[email protected]
Token: SeEnableDelegationPrivilege	4796	[email protected]
Token: SeManageVolumePrivilege	4796	[email protected]
Token: SeImpersonatePrivilege	4796	[email protected]
Token: SeCreateGlobalPrivilege	4796	[email protected]
Token: SeShutdownPrivilege	1788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1788	msiexec.exe
Token: SeCreateTokenPrivilege	1788	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1788	msiexec.exe
Token: SeLockMemoryPrivilege	1788	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1788	msiexec.exe
Token: SeMachineAccountPrivilege	1788	msiexec.exe
Token: SeTcbPrivilege	1788	msiexec.exe
Token: SeSecurityPrivilege	1788	msiexec.exe
Token: SeTakeOwnershipPrivilege	1788	msiexec.exe
Token: SeLoadDriverPrivilege	1788	msiexec.exe
Token: SeSystemProfilePrivilege	1788	msiexec.exe
Token: SeSystemtimePrivilege	1788	msiexec.exe
Token: SeProfSingleProcessPrivilege	1788	msiexec.exe
Token: SeIncBasePriorityPrivilege	1788	msiexec.exe
Token: SeCreatePagefilePrivilege	1788	msiexec.exe
Token: SeCreatePermanentPrivilege	1788	msiexec.exe
Token: SeBackupPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	1788	msiexec.exe
Token: SeShutdownPrivilege	1788	msiexec.exe
Token: SeDebugPrivilege	1788	msiexec.exe
Token: SeAuditPrivilege	1788	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1788	msiexec.exe
Token: SeChangeNotifyPrivilege	1788	msiexec.exe
Token: SeRemoteShutdownPrivilege	1788	msiexec.exe
Token: SeUndockPrivilege	1788	msiexec.exe
Token: SeSyncAgentPrivilege	1788	msiexec.exe
Token: SeEnableDelegationPrivilege	1788	msiexec.exe
Token: SeManageVolumePrivilege	1788	msiexec.exe
Token: SeImpersonatePrivilege	1788	msiexec.exe
Token: SeCreateGlobalPrivilege	1788	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe
Token: SeTakeOwnershipPrivilege	2144	msiexec.exe
Token: SeRestorePrivilege	2144	msiexec.exe

Suspicious use of FindShellTrayWindow 32 IoCs

pid	Process
1788	msiexec.exe
1788	msiexec.exe
2856	msiexec.exe
2856	msiexec.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe

Suspicious use of SendNotifyMessage 27 IoCs

pid	Process
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe
4272	vlc.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4884	@[email protected]
4884	@[email protected]
4572	@[email protected]
4572	@[email protected]
2296	@[email protected]
2296	@[email protected]
244	@[email protected]
4272	vlc.exe
4800	@[email protected]

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4796 wrote to memory of 1788	4796	[email protected]	123
PID 4796 wrote to memory of 1788	4796	[email protected]	123
PID 4796 wrote to memory of 1788	4796	[email protected]	123
PID 2144 wrote to memory of 3288	2144	msiexec.exe	124
PID 2144 wrote to memory of 3288	2144	msiexec.exe	124
PID 2144 wrote to memory of 3288	2144	msiexec.exe	124
PID 2144 wrote to memory of 5056	2144	msiexec.exe	125
PID 2144 wrote to memory of 5056	2144	msiexec.exe	125
PID 2144 wrote to memory of 5056	2144	msiexec.exe	125
PID 868 wrote to memory of 2856	868	[email protected]	127
PID 868 wrote to memory of 2856	868	[email protected]	127
PID 868 wrote to memory of 2856	868	[email protected]	127
PID 2144 wrote to memory of 3124	2144	msiexec.exe	128
PID 2144 wrote to memory of 3124	2144	msiexec.exe	128
PID 2144 wrote to memory of 3124	2144	msiexec.exe	128
PID 2144 wrote to memory of 5008	2144	msiexec.exe	129
PID 2144 wrote to memory of 5008	2144	msiexec.exe	129
PID 2144 wrote to memory of 5008	2144	msiexec.exe	129
PID 1436 wrote to memory of 2832	1436	[email protected]	134
PID 1436 wrote to memory of 2832	1436	[email protected]	134
PID 1436 wrote to memory of 2832	1436	[email protected]	134
PID 1436 wrote to memory of 4488	1436	[email protected]	135
PID 1436 wrote to memory of 4488	1436	[email protected]	135
PID 1436 wrote to memory of 4488	1436	[email protected]	135
PID 1436 wrote to memory of 3116	1436	[email protected]	138
PID 1436 wrote to memory of 3116	1436	[email protected]	138
PID 1436 wrote to memory of 3116	1436	[email protected]	138
PID 1436 wrote to memory of 1180	1436	[email protected]	139
PID 1436 wrote to memory of 1180	1436	[email protected]	139
PID 1436 wrote to memory of 1180	1436	[email protected]	139
PID 1180 wrote to memory of 4620	1180	cmd.exe	141
PID 1180 wrote to memory of 4620	1180	cmd.exe	141
PID 1180 wrote to memory of 4620	1180	cmd.exe	141
PID 1436 wrote to memory of 980	1436	[email protected]	142
PID 1436 wrote to memory of 980	1436	[email protected]	142
PID 1436 wrote to memory of 980	1436	[email protected]	142
PID 1436 wrote to memory of 4884	1436	[email protected]	145
PID 1436 wrote to memory of 4884	1436	[email protected]	145
PID 1436 wrote to memory of 4884	1436	[email protected]	145
PID 1436 wrote to memory of 5008	1436	[email protected]	146
PID 1436 wrote to memory of 5008	1436	[email protected]	146
PID 1436 wrote to memory of 5008	1436	[email protected]	146
PID 5008 wrote to memory of 4572	5008	cmd.exe	148
PID 5008 wrote to memory of 4572	5008	cmd.exe	148
PID 5008 wrote to memory of 4572	5008	cmd.exe	148
PID 4884 wrote to memory of 4276	4884	@[email protected]	149
PID 4884 wrote to memory of 4276	4884	@[email protected]	149
PID 4884 wrote to memory of 4276	4884	@[email protected]	149
PID 3236 wrote to memory of 4128	3236	msedge.exe	152
PID 3236 wrote to memory of 4128	3236	msedge.exe	152
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153
PID 3236 wrote to memory of 4596	3236	msedge.exe	153

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

Views/modifies file attributes 1 TTPs 2 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
2832	attrib.exe
980	attrib.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/Endermanch/MalwareDatabase/tree/master/ransomwares
1⤵
PID:3532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=11 --field-trial-handle=4996,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5016 /prefetch:1
1⤵
PID:5072

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=10 --field-trial-handle=4188,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
1⤵
PID:1784

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=12 --field-trial-handle=5416,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:1
1⤵
PID:1780

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=5584,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:8
1⤵
PID:3596

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --field-trial-handle=5588,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
1⤵
PID:224

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --field-trial-handle=6048,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
1⤵
PID:2588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=16 --field-trial-handle=6176,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:1
1⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6656,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
1⤵
PID:3280

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=18 --field-trial-handle=6732,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6740 /prefetch:1
1⤵
PID:2528

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6916,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6924 /prefetch:8
1⤵
PID:2628

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7056,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
1⤵
PID:4052

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --field-trial-handle=6128,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
1⤵
PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=22 --field-trial-handle=6020,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:1
1⤵
PID:4484

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=5868,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
1⤵
PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7456,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7420 /prefetch:8
1⤵
PID:4804

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --field-trial-handle=6336,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:8
1⤵
PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=26 --field-trial-handle=5660,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7424 /prefetch:1
1⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=6852,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
1⤵
PID:684

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=6168,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
1⤵
PID:3448

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4796
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  PID:1788

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 844654EFF626EBEFC52473240EBDA4B6
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3288
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 563779CB8CF5A52858D016B2E562340B E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5056
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 7A0A91AAE210C92C55B8B2BF3266615F
  2⤵
  - Loads dropped DLL
  - Blocklisted process makes network request
  - System Location Discovery: System Language Discovery
  PID:3124
- C:\Windows\syswow64\MsiExec.exe
  C:\Windows\syswow64\MsiExec.exe -Embedding 730876ABC455FE7B39BD559A602F6C79 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  PID:5008

C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:868
- C:\Windows\SysWOW64\msiexec.exe
  "C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH="C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\[email protected]" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp\Temp1_Winlocker.VB6.Blacksod (1).zip\" EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "
  2⤵
  - Enumerates connected drives
  - System Location Discovery: System Language Discovery
  - Suspicious use of FindShellTrayWindow
  PID:2856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --enable-dinosaur-easter-egg-alt-images --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=1 --renderer-client-id=29 --field-trial-handle=7488,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7396 /prefetch:1
1⤵
PID:5116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.FileUtilService --lang=en-US --service-sandbox-type=service --field-trial-handle=5876,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:8
1⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --field-trial-handle=7264,i,7447299413640964517,4240724842020506306,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
1⤵
PID:2608

C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]
"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\[email protected]"
1⤵
- Drops startup file
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1436
- C:\Windows\SysWOW64\attrib.exe
  attrib +h .
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:2832
- C:\Windows\SysWOW64\icacls.exe
  icacls . /grant Everyone:F /T /C /Q
  2⤵
  - Modifies file permissions
  - System Location Discovery: System Language Discovery
  PID:4488
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3116
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 227561727596261.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1180
- - C:\Windows\SysWOW64\cscript.exe
    cscript.exe //nologo m.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4620
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +s F:\$RECYCLE
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:980
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected] co
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4884
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\taskhsvc.exe
    TaskData\Tor\taskhsvc.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b @[email protected] vs
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5008
- - C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
    @[email protected] vs
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:532
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2276
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1048
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5024
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2296
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "rbeoqsjruepbaol925" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2484
- - C:\Windows\SysWOW64\reg.exe
    reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "rbeoqsjruepbaol925" /t REG_SZ /d "\"C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\tasksche.exe\"" /f
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    - Modifies registry key
    PID:4036
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:112
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:244
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskse.exe
  taskse.exe C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3968
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]
  @[email protected]
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4800
- C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\taskdl.exe
  taskdl.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:516

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=127.0.6533.89 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=127.0.2651.86 --initial-client-data=0x23c,0x240,0x244,0x218,0x25c,0x7ffbed39d198,0x7ffbed39d1a4,0x7ffbed39d1b0
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=2956,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --field-trial-handle=1904,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=3236 /prefetch:3
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --field-trial-handle=2196,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:8
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4312,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4312,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=4564,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --field-trial-handle=120,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --video-capture-use-gpu-memory-buffer --field-trial-handle=2576,i,7147826361517124782,14907409292705388872,262144 --variations-seed-version --mojo-platform-channel-handle=1404 /prefetch:8
  2⤵
  PID:512

C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\127.0.2651.86\elevation_service.exe"
1⤵
PID:4484

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
PID:2332

C:\Program Files\VideoLAN\VLC\vlc.exe
"C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file "C:\Users\Admin\Desktop\TraceWait.aiff"
1⤵
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

File and Directory Permissions Modification

T1222

Windows File and Directory Permissions Modification

T1222.001

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Config.Msi\e5aaed2.rbs

Filesize
100KB

MD5
6495aa8f9a233b0a5a0bf45afc77f4b3

SHA1
d2a4b9b4b589df149d4f267ad57119e59208d083

SHA256
12ed64e53c90ddda811794c2912d753c094ff48216cf45c61e809bd5cfd3a539

SHA512
d6222be69bd9de9204dae7e94cffcfdda4d177b166e6aaad9a37b027e3510f710b2793a68f604f306ae0feacf50f425bccc5556193dcae4992768fb237447ead

Download Submit
C:\Config.Msi\e5aaed6.rbs

Filesize
101KB

MD5
e6ebadb8611cfa8232088bfcc5c227ed

SHA1
bdc9027cb4a806f8920f042256b0ff45ba98cb03

SHA256
fe73809f2c6a6d4ea290e75ca5bc9722f01084177d81c4f0b36c4b9e4670af2b

SHA512
e681b5913834aa71f8258a736fe3825516208553e13e387847531e023103cbf45b78b5ebcf2b5fce0390687213e960fa108a4077f6be1c155937f4bad2d57457

Download Submit
C:\ProgramData\Adobe\Setup\{AC76BA86-7AD7-1033-7B44-AC0F074E4100}\@[email protected]

Filesize
1KB

MD5
aca2b70863fdec97ee1ae4e58eca5c55

SHA1
ae6f4e22c9b66b52584f0a15180f7323ee7fde15

SHA256
b7b1f0df6673a0280fcc0acc5fae60930d0dfe8abd92d062775349204762d697

SHA512
caf78dcd958abba2ac15735d1d4bd38f35a9ae04790f4be9f421bac08205f950031d34082a86417aa552a1e6273eba3f39bb2dd84b43fd2478c06594b5e4a591

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State

Filesize
2KB

MD5
fdd5ea2a84a8b4038f10d66441816684

SHA1
d4dbac88695fde0655aea8b3ee0ddbffcd8ce315

SHA256
ed52c3d0cb79496502a1e0bfb81f7cf4f1bfb35fc58ed1e354631dc38c2aa172

SHA512
c8708dba5b31c143923aea309012488de060c1efb1f4e9266e62e9f1a3b32c64f23235292d76b614a7975e8adf0db4c23df7a4810c252dc0927731a4f169f981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
12KB

MD5
5959a29e8dcdb87af92b3a58fd1b36f3

SHA1
0e3ba65297f963975dfee1f062dabbae9a3c3110

SHA256
0a0b57596a123edaa8afe73124ec6a3a83edeef761f60737ef62beec39864546

SHA512
82c206536e1f04020edb942e91c206bae8e1ab64180e15a8b229bf50a5b17e017471fb49308c2e681c5b997f5d23cb5af9f74fdd05d01baffd090074a761c319

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
30KB

MD5
7bf24cb14eb5bf7b2a8f17a4654cbdaf

SHA1
6d2e428fe670b8fd77d1f8ddc019d5390a20ab5b

SHA256
8da65a120767a3c9c091277803a0a561d8d8f931175552ea96df39b75ddc9b83

SHA512
44291e8d5b1721d6f3e9e02640306ca9af309b1d9b63883fd42614882583f654e053598b567f79e68d28fbb2c362fa066bbabece6c2a61624f3fa2cea8bae22c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
77KB

MD5
a0f7cc9889cfbf845180cf842b09177e

SHA1
d9bd2720cd139c264f3477fe8f2325300bd09e64

SHA256
bab39f1b1570b6dc52476135e6a4e28b37022891f12307c190677ed605afcaa1

SHA512
055de1cfaaa4ec44db262dfefbdd575b548b36a8f15e797597592cb19fa43bee6b33a4c36c9c292aa53073b407d9087b5ce3dcbb1c9c3f5919187e3c2f0fdf6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
77KB

MD5
d488b1b7cea449690cb8f16c0ab61ef7

SHA1
b751934b0e79502b685af11d0fd543cddaf6b5ef

SHA256
44443d6ca560b63718e7242b8c859a3f6a1bb0dd84415d03ca92cd8c1a883061

SHA512
6da7f6a81b283adc9ed25bf86134a33d36d5a76622d2cce16a6e018a88700275990825b9f82a08278c89716a05640b138d4369931bb6f1173b0bd770d623e5a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
81KB

MD5
78f4168aaeba4f6ae994137d239cf027

SHA1
8e7be3382cbb53847f1c2f5053f9133e81a8273f

SHA256
7f58637862617d334311afabfc7d1215c6151c295058ed284c910ae55b48e299

SHA512
f756ce873ee9baf7610dd8af480a01e06a1aa4025aa29db8e1560c66e9ef17634fde2af6bdeddb68cb6139936bb8e744f1cc320091b41994524f7c98f9e49f90

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
1e030f050b7bd3549b7323992ea9c60a

SHA1
cf2809557f579d83b4522495295686f513406c5a

SHA256
c1a116ba6dc470036bc6e48568d190f6766b924144290e8608041f077750734b

SHA512
78c090fcff1d98eb8791e1662784298dee02edddc88fd28fd4be20e022e895e69129a0ad291fb2e3607eb8e75c488ab1128962fe8215aa558c76f5cca90b4812

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
26afb376830e37b10e8f258fd8476b27

SHA1
9654a2b12f16d11725162a5b51cec384d2bd36d5

SHA256
f80fd62966985f0d0fe62533ab4fba811cb2cd50d3c7d1129b2087b4a3dc32ab

SHA512
e265f708299507fb94cda6f76dd1b939d077a953abdaaac6857ac0cd50bbbf19129fd27b2be440a675a405054a7aa9ac6bac30071824309983775e93725536de

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
26B

MD5
6bc190dd42a169dfa14515484427fc8e

SHA1
b53bd614a834416e4a20292aa291a6d2fc221a5e

SHA256
b3395b660eb1edb00ff91ece4596e3abe99fa558b149200f50aabf2cb77f5087

SHA512
5b7011ed628b673217695809a38a800e9c8a42ceb0c54ab6f8bc39dba0745297a4fbd66d6b09188fcc952c08217152844dfc3ada7cf468c3aafcec379c0b16b6

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
03e6eebcbdaccb5d4dc6391772cbe275

SHA1
e19803c8ea3900b34c2377fcebda62ef6f034215

SHA256
a07baeac6a629d3ac2c6909294486e37f0631b33767adbd3c4930bb91f124787

SHA512
61fbfa16dbe4a633c4133843d4377ef9edd2377967ed22894b45fe24af8d6c4651edfda0536092780d9048106ba80cca45d65f6c251d64f03c23d809c29cd670

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\tracking.ini

Filesize
84B

MD5
8084ecfe42f3e824d43f5a018bdfbc80

SHA1
e907148939183bbf55a576cfc68845ceea95cfd9

SHA256
025d0d465996ecc95457cf566eadd882db4e98feeadf59607e1e78e894cdb38a

SHA512
36fa8d82cfeaa87d1acb26427ec0406cd3c0486dd5bbc988b6d65b462a73a1e61b476dbaf16f9bda7c56aba65a9640128425a9a56c4052885f72011551577846

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
3KB

MD5
854a8341e89558365fa7b3fe7a2b81e3

SHA1
87a9ffd06218cafe5efdfbea53e88dc2809e53c4

SHA256
586506b3e95e560a6663cde24e317de6a42efce17811ac60ee0588ced2d45e29

SHA512
5896ced2003fd111840535224fca7471bf2b3dbe730dfde0d3621c0722573c545e67e0a9f8d5022ac6501c021b574da43f10f3d881f721205a166090b8d954ae

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
4KB

MD5
6eb9f5d2c591b1d86c7c89e58d841580

SHA1
f486e33b0efc5d6a656ed61eda9c68a13b6830a0

SHA256
11c94fe8a8c31c0d42d13fe7eb5587e4cd3499c9b6a863a4352ed86494d0ad20

SHA512
0b5ec097166ec0c9d31ae51630fc18731f730f78ffefea3f8b7b9a5e870359a1187f3ceeb6db963561de11c63b70051da39121f257e00317a2f80a33e00822e8

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
1KB

MD5
181e4d1b4dec34de96de3d8fb8c81302

SHA1
bcbbb25c52c2c5f196ccccce54bd6342f7a07c66

SHA256
f899a044be460faf1be4502474c0d78a2889a98b611254a985d1deee4ad6ba31

SHA512
08314d506cc22d328b40b2ea3f58a9273480816d6bac82477c31178d8fb397da62ce7156c6708daf32d055efbfc27a3e3031edbfa986d5bef0ebb859b35d3ef5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
2KB

MD5
6b8846aaa3f059593ed202c225e3129f

SHA1
a9ed0c5db0af22b2602862a81c02047d6252fc6f

SHA256
efbccbe6c72dbf2d580f2eb659071afd5acf6041662f62842307e7340dfc3745

SHA512
91ef651c4635c5f7b6e8fa7dc4b66160089d30fefcaed0eee30e30fdcb3a84f332a0a59f056a4521b84dab154a54e84140806a3ca890e5c088fbecd7f628f89c

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
3KB

MD5
c6eea6594a0a5b0e0bb58806e0500057

SHA1
a54f1276951771f92de6a0d79f7e7532df5dffbc

SHA256
4d603a679f287e28b3a155316537d29c6a20651e4e254a139564ae2486a785f5

SHA512
6681940049954c532cb32fe42ac4d913c04a0e97ff20aa4a99eb729d60a1215ab70670b0233a36ad24d00ef824570a381af0f7cfc7d571bd8717d5c8218fc6ef

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{70006E3D-3B86-4ACD-94DF-C182700BCFD3}.session

Filesize
3KB

MD5
918737997a7bcd00211a8d2dbf6dd10f

SHA1
c69b830499aab6d3e7b3bbcb943d4a14b8094cfb

SHA256
ef098d6cf057045157739ff9ef856bf717f0544ccc0555f125746deb1dd4f496

SHA512
369bb7bc5e1fb1fba08cedde228819e511cde78c7d4512c1e78dd3e8eeed0be80ed9103742d48e4341c6671353daf194312f4ab894596192c963948f8e24a51f

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{E7751463-B964-44A8-9C35-80BCBF93C9C9}.session

Filesize
2KB

MD5
fb354f26fb51887a5dfc995f4b87918c

SHA1
d2b99d27e7e42d3a1f69bb37df248267b5a6481a

SHA256
8e426234eb214e57ad869f5cc2b643561a96921586a5a05b56d9677cb12f3239

SHA512
89c3e68e29564355125404608fa7144e27770f95df592e1fda468e64dead2da64cab99eeda769b290f5a97337decfbf61265b44afe732734595dfbc8041df6e5

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{E7751463-B964-44A8-9C35-80BCBF93C9C9}.session

Filesize
3KB

MD5
a3049af1c7063bd17fee63b773b6dbca

SHA1
4274053ee5abaad5311a10f47a52e4f871613cef

SHA256
0c1a22f01bd37a422c97ebe7e8db3c94aad63e5910743421ac0107b10b28456a

SHA512
4f65c444bd53659df992def985ff8891f29419057cf2771a4aa3b5dbd3ecbff1db6a066c985171ec6d2115ca77e8b7e524327a6282a92c29bc5035434de41428

Download Submit
C:\Users\Admin\AppData\Local\Temp\AdvinstAnalytics\Error file remover\1.0.0.0\{E7751463-B964-44A8-9C35-80BCBF93C9C9}.session

Filesize
4KB

MD5
c95cef93e0db963dafcaba9ac6b6d4a0

SHA1
d927eeac81e488d57f60abeddfc1eeea26c57814

SHA256
e25982065c2b71c8fb613b058bb033f8bd3151c290be69f06a5d7f87c48be1c5

SHA512
4123b63011726c31fa1c253a319cdb345b120250be87d1ae9f618c419787d7349d6fe0ba915093161ffb5f7f96379bd5eda203849d930dbef2e2515aa0c69069

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
933B

MD5
7a2726bb6e6a79fb1d092b7f2b688af0

SHA1
b3effadce8b76aee8cd6ce2eccbb8701797468a2

SHA256
840ab19c411c918ea3e7526d0df4b9cb002de5ea15e854389285df0d1ea9a8e5

SHA512
4e107f661e6be183659fdd265e131a64cce2112d842226305f6b111d00109a970fda0b5abfb1daa9f64428e445e3b472332392435707c9aebbfe94c480c72e54

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\@[email protected]

Filesize
240KB

MD5
7bf2b57f2a205768755c07f238fb32cc

SHA1
45356a9dd616ed7161a3b9192e2f318d0ab5ad10

SHA256
b9c5d4339809e0ad9a00d4d3dd26fdf44a32819a54abf846bb9b560d81391c25

SHA512
91a39e919296cb5c6eccba710b780519d90035175aa460ec6dbe631324e5e5753bd8d87f395b5481bcd7e1ad623b31a34382d81faae06bef60ec28b49c3122a9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\TaskData\Tor\tor.exe

Filesize
3.0MB

MD5
fe7eb54691ad6e6af77f8a9a0b6de26d

SHA1
53912d33bec3375153b7e4e68b78d66dab62671a

SHA256
e48673680746fbe027e8982f62a83c298d6fb46ad9243de8e79b7e5a24dcd4eb

SHA512
8ac6dc5bb016afc869fcbb713f6a14d3692e866b94f4f1ee83b09a7506a8cb58768bd47e081cf6e97b2dacf9f9a6a8ca240d7d20d0b67dbd33238cc861deae8f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Temp1_WannaCrypt0r.zip\msg\m_finnish.wnry

Filesize
37KB

MD5
35c2f97eea8819b1caebd23fee732d8f

SHA1
e354d1cc43d6a39d9732adea5d3b0f57284255d2

SHA256
1adfee058b98206cb4fbe1a46d3ed62a11e1dee2c7ff521c1eef7c706e6a700e

SHA512
908149a6f5238fcccd86f7c374986d486590a0991ef5243f0cd9e63cc8e208158a9a812665233b09c3a478233d30f21e3d355b94f36b83644795556f147345bf

Download Submit
C:\Users\Admin\AppData\Local\Temp\shiD860.tmp

Filesize
3.1MB

MD5
aff55ff1a0d686ad405855bd22a932d6

SHA1
00b5db2b0322b2aad7aebd80d1d13372eeb85832

SHA256
926a128e1ef90c09470460fab0682fa500640b96ad3ad6fd8efaff9ed46e97db

SHA512
19bccc43eff166e1c701713edd6279d6c55b1c1277c2391eec73e6aebd201db762a52fc5a764900ac04441e73c573703ee29944c6c0a8e59d90b46b3279cd11e

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi

Filesize
1010KB

MD5
27bc9540828c59e1ca1997cf04f6c467

SHA1
bfa6d1ce9d4df8beba2bedf59f86a698de0215f3

SHA256
05c18698c3dc3b2709afd3355ad5b91a60b2121a52e5fcc474e4e47fb8e95e2a

SHA512
a3ae822116cddb52d859de7ffc958541bb47c355a835c5129aade9cc0e5fba3ff25387061deb5b55b5694a535f09fe8669485282eb6e7c818cc7092eb3392848

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Windows Logoff Sound.wav

Filesize
724KB

MD5
bab1293f4cf987216af8051acddaf97f

SHA1
00abe5cfb050b4276c3dd2426e883cd9e1cde683

SHA256
bc26b1b97eeb45995bbd5f854db19f994cce1bb9ac9fb625eb207302dccdf344

SHA512
3b44371756f069be4f70113a09761a855d80e96c23c8cd76d0c19a43e93d1a159af079ba5189b88b5ee2c093099a02b00ea4dc20a498c9c0c2df7dc95e5ddd49

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\fatalerror.exe

Filesize
24KB

MD5
e579c5b3c386262e3dd4150eb2b13898

SHA1
5ab7b37956511ea618bf8552abc88f8e652827d3

SHA256
e9573a3041e5a45ed8133576d199eb8d12f8922bbe47d194fef9ac166a96b9e2

SHA512
9cf947bad87a701f0e0ad970681767e64b7588089cd9064c72bf24ba6ca0a922988f95b141b29a68ae0e0097f03a66d9b25b9d52197ff71f6e369cde0438e0bb

Download Submit
C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\decoder.dll

Filesize
126KB

MD5
3531cf7755b16d38d5e9e3c43280e7d2

SHA1
19981b17ae35b6e9a0007551e69d3e50aa1afffe

SHA256
76133e832c15aa5cbc49fb3ba09e0b8dd467c307688be2c9e85e79d3bf62c089

SHA512
7b053ba2cf92ef2431b98b2a06bd56340dad94de36d11e326a80cd61b9acb378ac644ac407cf970f4ef8333b8d3fb4ff40b18bb41ec5aee49d79a6a2adcf28fd

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
5.1MB

MD5
87ff0abb5efc83f54e6767b88bfb33bf

SHA1
fd04159f8e72f93e12ba1eb47b744aa9845430aa

SHA256
4a969d246de04d6bcc80bfddadad01c1d4a7eb09359dd919bf6a1599ecf064e6

SHA512
bf878cc9b34ddc2c20e796f106f23881edcad51586a0bf4f325165f24a15f10833eff79a3f4fa516d19736415fe781965831b04f79677a9b1a65ae71d4eb4c58

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini

Filesize
75B

MD5
7ce64148a04f2126e49e76842237735e

SHA1
5ef2433fcedc94a942b67a15e81062456e49ea74

SHA256
2d3a9d9b123be568880faafa3b78cc8196e5e684ff8a7ac16e2e8b381931b6b3

SHA512
3e818b983bbd79badd3fa3cf294f91a03cd4444b6a0c422d16c13d50136f112d34e8640c600d6f82b0fe5d460d17d0ff273cc6d4c6b6f3ea02ff6d64b847ce9c

Download Submit
C:\Users\Admin\AppData\Roaming\vlc\vlc-qt-interface.ini.lock

Filesize
18B

MD5
61f32e48451b2f35c21103a2bd5b7db7

SHA1
b8227be16f77cdd1a4ded70c22a799ed6311b77b

SHA256
c6070d16daa3855a0da5e272df08940eeea459fc5337f2b7e85df88dbbedbca0

SHA512
5d7501672c3a7d72d2375a2177fa680a6c68c2b00db381e21bdc205b1f2e8cefdab3637c928781c87342c2c9cabb44d25f1fa2882ce7b400d2826c724ae7841d

Download Submit
C:\Users\Default\Desktop\@[email protected]

Filesize
1.4MB

MD5
c17170262312f3be7027bc2ca825bf0c

SHA1
f19eceda82973239a1fdc5826bce7691e5dcb4fb

SHA256
d5e0e8694ddc0548d8e6b87c83d50f4ab85c1debadb106d6a6a794c3e746f4fa

SHA512
c6160fd03ad659c8dd9cf2a83f9fdcd34f2db4f8f27f33c5afd52aced49dfa9ce4909211c221a0479dbbb6e6c985385557c495fc04d3400ff21a0fbbae42ee7c

Download Submit
C:\Windows\Installer\MSIAF6B.tmp

Filesize
88KB

MD5
4083cb0f45a747d8e8ab0d3e060616f2

SHA1
dcec8efa7a15fa432af2ea0445c4b346fef2a4d6

SHA256
252b7423b01ff81aea6fe7b40de91abf49f515e9c0c7b95aa982756889f8ac1a

SHA512
26f8949cad02334f9942fda8509579303b81b11bc052a962c5c31a7c6c54a1c96957f30ee241c2206d496d2c519d750d7f6a12b52afdb282fa706f9fee385133

Download Submit
C:\Windows\Installer\MSIB066.tmp

Filesize
180KB

MD5
d552dd4108b5665d306b4a8bd6083dde

SHA1
dae55ccba7adb6690b27fa9623eeeed7a57f8da1

SHA256
a0367875b68b1699d2647a748278ebce64d5be633598580977aa126a81cf57c5

SHA512
e5545a97014b5952e15bb321135f65c0e24414f8dd606fe454fd2d048d3f769b9318df7cfb2a6bf932eb2bf6d79811b93cb2008115deb0f0fa9db07f32a70969

Download Submit
C:\Windows\Installer\MSIB3C9.tmp

Filesize
96KB

MD5
3cab78d0dc84883be2335788d387601e

SHA1
14745df9595f190008c7e5c190660361f998d824

SHA256
604e79fe970c5ed044517a9a35e4690ea6f7d959d21173ebef45cdd3d3a22bdd

SHA512
df6b49f2b5cddebd7e23e81b0f89e4883fc12d95735a9b3f84d2f402f4996c54b5fdea8adb9eaa98e8c973b089656d18d6b322bd71cb42d7807f7fa8a7348820

Download Submit
C:\Windows\Installer\MSIB3E9.tmp

Filesize
128KB

MD5
7e6b88f7bb59ec4573711255f60656b5

SHA1
5e7a159825a2d2cb263a161e247e9db93454d4f6

SHA256
59ff5bc12b155cc2e666bd8bc34195c3750eb742542374fc5e53fb22d11e862f

SHA512
294a379c99403f928d476e04668717cdabc7dc3e33bcf6bcad5c3d93d4268971811ff7303aa5b4b2ed2b59d59c8eba350a9a30888d4b5b3064708521ac21439c

Download Submit
C:\Windows\Installer\MSIB409.tmp

Filesize
312KB

MD5
aa82345a8f360804ea1d8d935f0377aa

SHA1
c09cf3b1666d9192fa524c801bb2e3542c0840e2

SHA256
9c155d4214cebda186647c035ada552963dcac8f88a6b38a23ea34f9ecd1d437

SHA512
c051a381d87ba933ea7929c899fb01af2207cb2462dcb2b55c28cff65596b27bdb05a48207624eeea40fddb85003133ad7af09ca93cfb2426c155daea5a9a6db

Download Submit
C:\Windows\Tasks\sys.job

Filesize
312B

MD5
5fd9a86ddfe7bfce63018105b9d95da0

SHA1
5ae3a31cdb6e732ce1879d2cb74b7af14285eab1

SHA256
4aeef5547d9d95d1c652323a69cae79129b5123df17954b12a33036597f7bf0a

SHA512
f8a7ab108aa5b36783cef7e045f36b653f29bf05233da2fa3a0a414f079b4863aa610523c6d20409620cd6fe7cf8ef1a04859fc93b20a3d6e5cef2f7d61f0004

Download Submit
memory/1436-656-0x0000000010000000-0x0000000010010000-memory.dmp

Filesize
64KB

Download
memory/4276-2165-0x00000000744C0000-0x0000000074542000-memory.dmp

Filesize
520KB

Download
memory/4276-2234-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2167-0x00000000744A0000-0x00000000744BC000-memory.dmp

Filesize
112KB

Download
memory/4276-2164-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2168-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/4276-2170-0x0000000074140000-0x00000000741C2000-memory.dmp

Filesize
520KB

Download
memory/4276-2169-0x00000000741D0000-0x00000000741F2000-memory.dmp

Filesize
136KB

Download
memory/4276-2085-0x0000000074140000-0x00000000741C2000-memory.dmp

Filesize
520KB

Download
memory/4276-2086-0x00000000741D0000-0x00000000741F2000-memory.dmp

Filesize
136KB

Download
memory/4276-2218-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2222-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/4276-2166-0x0000000074420000-0x0000000074497000-memory.dmp

Filesize
476KB

Download
memory/4276-2248-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2252-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/4276-2305-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2314-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2331-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2335-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/4276-2087-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2366-0x00000000002F0000-0x00000000005EE000-memory.dmp

Filesize
3.0MB

Download
memory/4276-2084-0x0000000074200000-0x000000007441C000-memory.dmp

Filesize
2.1MB

Download
memory/4276-2083-0x00000000744C0000-0x0000000074542000-memory.dmp

Filesize
520KB

Download