wannacry | be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

Analysis

max time kernel
117s
max time network
124s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27-10-2024 18:38

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

WannaCry.exe
Size

224KB
MD5

5c7fb0927db37372da25f270708103a2
SHA1

120ed9279d85cbfa56e5b7779ffa7162074f7a29
SHA256

be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844
SHA512

a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206
SSDEEP

3072:Y059femWRwTs/dbelj0X8/j84pcRXPlU3Upt3or4H84lK8PtpLzLsR/EfcZ:+5RwTs/dSXj84mRXPemxdBlPvLzLeZ

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs

description	pid	Process	procid_target
PID 3888 created 2012	3888	taskmgr.exe	107
PID 3888 created 2012	3888	taskmgr.exe	107

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA5BD.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA5D4.tmp	WannaCry.exe

Executes dropped EXE 6 IoCs

pid	Process
4380	!WannaDecryptor!.exe
1372	!WannaDecryptor!.exe
2572	!WannaDecryptor!.exe
2012	!WannaDecryptor!.exe
1816	!WannaDecryptor!.exe
536	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\WannaCry.exe\" /r"	WannaCry.exe

Sets desktop wallpaper using registry 2 TTPs 2 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000	taskmgr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A	taskmgr.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName	taskmgr.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	chrome.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	chrome.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
4636	taskkill.exe
3356	taskkill.exe
1956	taskkill.exe
4452	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "157"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe

Suspicious behavior: EnumeratesProcesses 33 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
2012	!WannaDecryptor!.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	4452	taskkill.exe
Token: SeDebugPrivilege	1956	taskkill.exe
Token: SeDebugPrivilege	3356	taskkill.exe
Token: SeDebugPrivilege	4636	taskkill.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeIncreaseQuotaPrivilege	656	WMIC.exe
Token: SeSecurityPrivilege	656	WMIC.exe
Token: SeTakeOwnershipPrivilege	656	WMIC.exe
Token: SeLoadDriverPrivilege	656	WMIC.exe
Token: SeSystemProfilePrivilege	656	WMIC.exe
Token: SeSystemtimePrivilege	656	WMIC.exe
Token: SeProfSingleProcessPrivilege	656	WMIC.exe
Token: SeIncBasePriorityPrivilege	656	WMIC.exe
Token: SeCreatePagefilePrivilege	656	WMIC.exe
Token: SeBackupPrivilege	656	WMIC.exe
Token: SeRestorePrivilege	656	WMIC.exe
Token: SeShutdownPrivilege	656	WMIC.exe
Token: SeDebugPrivilege	656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	656	WMIC.exe
Token: SeRemoteShutdownPrivilege	656	WMIC.exe
Token: SeUndockPrivilege	656	WMIC.exe
Token: SeManageVolumePrivilege	656	WMIC.exe
Token: 33	656	WMIC.exe
Token: 34	656	WMIC.exe
Token: 35	656	WMIC.exe
Token: 36	656	WMIC.exe
Token: SeIncreaseQuotaPrivilege	656	WMIC.exe
Token: SeSecurityPrivilege	656	WMIC.exe
Token: SeTakeOwnershipPrivilege	656	WMIC.exe
Token: SeLoadDriverPrivilege	656	WMIC.exe
Token: SeSystemProfilePrivilege	656	WMIC.exe
Token: SeSystemtimePrivilege	656	WMIC.exe
Token: SeProfSingleProcessPrivilege	656	WMIC.exe
Token: SeIncBasePriorityPrivilege	656	WMIC.exe
Token: SeCreatePagefilePrivilege	656	WMIC.exe
Token: SeBackupPrivilege	656	WMIC.exe
Token: SeRestorePrivilege	656	WMIC.exe
Token: SeShutdownPrivilege	656	WMIC.exe
Token: SeDebugPrivilege	656	WMIC.exe
Token: SeSystemEnvironmentPrivilege	656	WMIC.exe
Token: SeRemoteShutdownPrivilege	656	WMIC.exe
Token: SeUndockPrivilege	656	WMIC.exe
Token: SeManageVolumePrivilege	656	WMIC.exe
Token: 33	656	WMIC.exe
Token: 34	656	WMIC.exe
Token: 35	656	WMIC.exe
Token: 36	656	WMIC.exe
Token: SeBackupPrivilege	3772	vssvc.exe
Token: SeRestorePrivilege	3772	vssvc.exe
Token: SeAuditPrivilege	3772	vssvc.exe
Token: SeShutdownPrivilege	3444	chrome.exe
Token: SeCreatePagefilePrivilege	3444	chrome.exe
Token: SeDebugPrivilege	3888	taskmgr.exe
Token: SeSystemProfilePrivilege	3888	taskmgr.exe
Token: SeCreateGlobalPrivilege	3888	taskmgr.exe

Suspicious use of FindShellTrayWindow 58 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe

Suspicious use of SendNotifyMessage 54 IoCs

pid	Process
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3444	chrome.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe
3888	taskmgr.exe

Suspicious use of SetWindowsHookEx 12 IoCs

pid	Process
4380	!WannaDecryptor!.exe
4380	!WannaDecryptor!.exe
1372	!WannaDecryptor!.exe
1372	!WannaDecryptor!.exe
2572	!WannaDecryptor!.exe
2572	!WannaDecryptor!.exe
2012	!WannaDecryptor!.exe
2012	!WannaDecryptor!.exe
1816	!WannaDecryptor!.exe
536	!WannaDecryptor!.exe
536	!WannaDecryptor!.exe
1904	LogonUI.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 4604	3672	WannaCry.exe	85
PID 3672 wrote to memory of 4604	3672	WannaCry.exe	85
PID 3672 wrote to memory of 4604	3672	WannaCry.exe	85
PID 4604 wrote to memory of 5032	4604	cmd.exe	87
PID 4604 wrote to memory of 5032	4604	cmd.exe	87
PID 4604 wrote to memory of 5032	4604	cmd.exe	87
PID 3672 wrote to memory of 4380	3672	WannaCry.exe	91
PID 3672 wrote to memory of 4380	3672	WannaCry.exe	91
PID 3672 wrote to memory of 4380	3672	WannaCry.exe	91
PID 3672 wrote to memory of 4636	3672	WannaCry.exe	92
PID 3672 wrote to memory of 4636	3672	WannaCry.exe	92
PID 3672 wrote to memory of 4636	3672	WannaCry.exe	92
PID 3672 wrote to memory of 4452	3672	WannaCry.exe	93
PID 3672 wrote to memory of 4452	3672	WannaCry.exe	93
PID 3672 wrote to memory of 4452	3672	WannaCry.exe	93
PID 3672 wrote to memory of 1956	3672	WannaCry.exe	94
PID 3672 wrote to memory of 1956	3672	WannaCry.exe	94
PID 3672 wrote to memory of 1956	3672	WannaCry.exe	94
PID 3672 wrote to memory of 3356	3672	WannaCry.exe	95
PID 3672 wrote to memory of 3356	3672	WannaCry.exe	95
PID 3672 wrote to memory of 3356	3672	WannaCry.exe	95
PID 3672 wrote to memory of 1372	3672	WannaCry.exe	102
PID 3672 wrote to memory of 1372	3672	WannaCry.exe	102
PID 3672 wrote to memory of 1372	3672	WannaCry.exe	102
PID 3672 wrote to memory of 3620	3672	WannaCry.exe	103
PID 3672 wrote to memory of 3620	3672	WannaCry.exe	103
PID 3672 wrote to memory of 3620	3672	WannaCry.exe	103
PID 3620 wrote to memory of 2572	3620	cmd.exe	105
PID 3620 wrote to memory of 2572	3620	cmd.exe	105
PID 3620 wrote to memory of 2572	3620	cmd.exe	105
PID 3672 wrote to memory of 2012	3672	WannaCry.exe	107
PID 3672 wrote to memory of 2012	3672	WannaCry.exe	107
PID 3672 wrote to memory of 2012	3672	WannaCry.exe	107
PID 3444 wrote to memory of 4824	3444	chrome.exe	110
PID 3444 wrote to memory of 4824	3444	chrome.exe	110
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111
PID 3444 wrote to memory of 4236	3444	chrome.exe	111

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\WannaCry.exe
"C:\Users\Admin\AppData\Local\Temp\WannaCry.exe"
1⤵
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 150421730054302.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4604
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5032
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:4380
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4636
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4452
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1956
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3356
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:1372
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3620
- - C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2572
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
      4⤵
      System Location Discovery: System Language Discovery
      PID:4376
    - - C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:656
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of SetWindowsHookEx
  PID:2012
- C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - Sets desktop wallpaper using registry
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:536

C:\Program Files\Google\Chrome\Application\chrome.exe
"C:\Program Files\Google\Chrome\Application\chrome.exe"
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffbf2decc40,0x7ffbf2decc4c,0x7ffbf2decc58
  2⤵
  PID:4824
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1760,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  PID:4236
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2156,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  PID:2168
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2244,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2424 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3312,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=3704,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files\Google\Chrome\Application\chrome.exe
  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --field-trial-handle=3712,i,14014806649201032722,11331519440426128897,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:2136

C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
"C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
1⤵
PID:3908

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3772

C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe
"C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1816

C:\Windows\system32\taskmgr.exe
"C:\Windows\system32\taskmgr.exe" /0
1⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3888

C:\Windows\SysWOW64\werfault.exe
werfault.exe /h /shared Global\c5c3eb08bd8147cb844245a3fbd8fb38 /t 3924 /p 2012
1⤵
PID:3036

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa392f855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\DawnCache\data_1

Filesize
264KB

MD5
f50f89a0a91564d0b8a211f8921aa7de

SHA1
112403a17dd69d5b9018b8cede023cb3b54eab7d

SHA256
b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

SHA512
bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

Filesize
8KB

MD5
808dcb1717f419b23690a2f3f535259d

SHA1
411b95ea94c09b67a301eb87afc5ea125383e773

SHA256
047b0096e31488fbd7b72ac92cadf8670f2f07a9e113b95d07b99a62e0f60cf9

SHA512
aa25b9f569f52f70926698a7fa31a43b8293fd6f44cdb2eb2579cabc204d59f3d61086b21353a98533cd8e92cc986e0f46773bacd78b2e28a2e619bb24508e94

Download Submit
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State

Filesize
116KB

MD5
b7a1c5f94981569cc9fa04083ff0818b

SHA1
56b6b749bc741a2027b4744e96f12c07be86dc26

SHA256
9b0fcecb2fa0fe5567f394fb0ae975d699ef4fa0785bbc9602cd9570890da0a3

SHA512
fdcce549d1993aa37f8c4f87536f83e68f75a0775182cc6e8e47318379e6d0c7a8f5c4b1bbe1b4e66f6f011948cdbd02c7cd56d6bbd6080699312036ff831d19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\images\loading_spinner.svg.WCRY

Filesize
712B

MD5
f5487d8e51b6810764292bb1ca1b425d

SHA1
b7e4e805603d1e708a2b2781f19331a361ada72f

SHA256
68b9247e681cd6c6ff4151d43d0b73004f8564f377eff8514990cfb33fdffcdd

SHA512
512dddca058c7421f7e818ce8af6329b05b2fbd35f79db00784c1ed910ea8209fa9ec6c3b190f8d8b3259a4d3789fec256b6bfb3199fe2a79c8c957583a2a373

Download Submit
C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\DCJGJO2N\3\1p7Pm8MlCViA2LDR4P2jaN0n9x8.gz[1].js.WCRY

Filesize
2KB

MD5
02f5c7765fe0b8ad64eb9314d23b8fb4

SHA1
938cb4bb7ee1182495b76c528cccb09cf36b6fec

SHA256
ce94d9c748af8830abd15b2898b5b30f166d5a769b2cfdd8461fbb2127a28991

SHA512
de3f12f48f17c1e7faa5b9bb8f6c04debf968699da58235436bff821ec30f59ee8daf2d17c805272fa2944fee915a44b43554fe770b2f40ec5117e00d464ea9e

Download Submit
C:\Users\Admin\AppData\Local\Temp\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\!WannaDecryptor!.exe.lnk

Filesize
1KB

MD5
de9c0860f5517b11f08458874a4c026d

SHA1
3013173481836707f58e533646a89861a2869a0c

SHA256
0e1e67f7dc833d5c26b0d48781cb13074f36a0d829a1025bd71976827e24e804

SHA512
8ff3c952d7812dd6da790a108e43d0003ebad82c9f90266fe2f9c049c7d6c4c7c244bd743ed778d6b9e02eadb9f369a11b557a8b2a09a48dea7f9c53ebaa19e6

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.eky

Filesize
1KB

MD5
1540520943723883b5e9cf61cf6a344c

SHA1
06b2453d9634339b8fbeed43c87e68e7990af7e1

SHA256
2275152740252e5505a451582ad40bd299249944e0f9beeea9dab75987575b5d

SHA512
dd6f5f792eb184ab066e4faf87243a3fa9c3bb37d773dfd79a7d7aa8b6fb7a3c3241da55b15aaed1621f52e76e8b8d136aba17cff79a929f5479ff56f4ad5245

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
91abd59708968af7090db058ae996df3

SHA1
acd4432176b648e49ab249bc663d164c5a545d8f

SHA256
1fa55c30db57ce318012be448e8fd8033064426461bf96f998e08e46a9bf1125

SHA512
e749d5a284f3376f4c276310e46c132cd54cc57cd0128e740714c30fb7adaae1b7cf793d8b21187c1f8597d818b727dc15d2f8e84019383e08b4a23b2f7fd5ad

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
4d96be8f224a2ec1ebec6593241dc313

SHA1
82163a5630f11672fefe8f19dea424a6e47bda13

SHA256
ae90ddef43bd3ec3dafcb67dcf84ddac8179c37fb018ef2aa89f3e9971a9e2ae

SHA512
256b0c7f9a058c635d3acdec6a6fd2c480167420ab5ea725f101a4d235982e4f586d30a1bb4f3af48c0719fa9290f694fc8cb9ba3e845cc6b4d08748978f6352

Download Submit
C:\Users\Admin\AppData\Local\Temp\00000000.res

Filesize
136B

MD5
d14c8f11bf0c5a5a42d759624dcf9d23

SHA1
3312e8d9e96c326861b18e7677f5b04548c41666

SHA256
041392bcd558cb908993504ccf8a02a9ffa3879f52a0b7b1ac878a5e2c65e872

SHA512
250d08fad035cba7ed59a6b34ab0691b5effd34104c7437742952ebb19506a452146213b26a3e0dcef5d2c20dd13f00c1404366c0c4be500f070812beba925d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\150421730054302.bat

Filesize
336B

MD5
3540e056349c6972905dc9706cd49418

SHA1
492c20442d34d45a6d6790c720349b11ec591cde

SHA256
73872a89440a2cba9d22bf4961c3d499ea2c72979c30c455f942374292fedadc

SHA512
c949d147100aef59e382c03abf7b162ae62a4d43456eebd730fbedcf5f95f5e1a24f6e349690d52d75331878a6ee8f6b88a7162ee9cf2a49e142196b12d0133c

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.vbs

Filesize
219B

MD5
5f6d40ca3c34b470113ed04d06a88ff4

SHA1
50629e7211ae43e32060686d6be17ebd492fd7aa

SHA256
0fb5039a2fe7e90cdf3f22140d7f2103f94689b15609efe0edcc8430dd772fc1

SHA512
4d4aa1abd2c9183202fd3f0a65b37f07ee0166ba6561f094c13c8ea59752c7bdd960e37c49583746d4464bc3b1dc0b63a1fe36a37ce7e5709cd76ed433befe35

Download Submit
C:\Users\Admin\AppData\Local\Temp\c.wry

Filesize
628B

MD5
8306934fad294223a8be5b42b01171b9

SHA1
710ad47977844a3d7ad9f23f2f9e2d6ba1c2076f

SHA256
5e60492a95d6bcc1837915356a53a11cef558a8ecaf4e248eaa0142d0db33b83

SHA512
b5e165f59451ace00044bf6c251182fb3e14e2a89f6007d9bc85a416131ab410084ab2a990ec0c18427d2ea5520b1e37eca1597297f8d86958d178385ab9ac70

Download Submit
C:\Users\Admin\AppData\Local\Temp\f.wry

Filesize
347B

MD5
4982559cf3f07abd8d4981c74808e9c3

SHA1
4940d542d132cec3999afba607eacd63cb357c24

SHA256
cd2eeda9da481f4ecd01d744a458b186a25949fd4661d48ef2227ec2cdbb7a0c

SHA512
951a0622850236faca891296e71a9cbfb928169a512bf4d305e03cff5980e564cd4f2079c732cdaf13f3d38ff54c460775554ea12fab7339e41cef8d2ad7ffc7

Download Submit
C:\Users\Admin\AppData\Local\Temp\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\AppData\Local\Temp\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
C:\Users\Admin\AppData\Roaming\DisableUnlock.mp4.WCRY

Filesize
450KB

MD5
3bac93064ea5eb07e70c686e4766a71c

SHA1
07aa2fadcc62edf1881df9289d4ecfbcc3f7d3f9

SHA256
36bfc904992339490ca926d43582feb7763fa70a711f66ff92e1613aad4594ca

SHA512
7d21542e993b58bf609c45dce5bf03a21f0eb7c07aaa1cf70e44f64c5e4cb3486462f8f4bcdedfe27bbfbb523c15894e69928d09c6bc2a67321f009429bab316

Download Submit
C:\Users\Admin\Documents\RenameComplete.xlsx.WCRY

Filesize
11KB

MD5
4c46abeef2b7e10bf0ba6344f50cdd26

SHA1
ca2724a4a5bfdf0631d808a13314fa9ccc65f36c

SHA256
ed8364f9cb679b000621906383ce27035131ca842df54c4cf5fa17c44e38f665

SHA512
957c0676b1419d75e0c17feb7fd107b2da302b5ec3e57c6a1f9bb5e9a6b083b8dbbe38be9226e82e8b2e3ba6f06050cb497aa11b49df162e01a046d508ba83c8

Download Submit
memory/3672-6-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download
memory/3888-1609-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1610-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1608-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1620-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1619-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1618-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1617-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1616-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1615-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download
memory/3888-1614-0x0000022A6D1D0000-0x0000022A6D1D1000-memory.dmp

Filesize
4KB

Download

Analysis

Sharing

Errors

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads