wannacry | hxxps://github[.]com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry[.]exe

Analysis

max time kernel
104s
max time network
102s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
02-01-2025 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe

Score

10^/10

wannacry defense_evasion discovery execution impact persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware defense_evasion impact execution

File Deletion
T1070.004

Inhibit System Recovery
T1490

Windows Management Instrumentation
T1047
Downloads MZ/PE file

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDBF3.tmp	WannaCry.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDC0A.tmp	WannaCry.exe

Executes dropped EXE 5 IoCs

pid	Process
4072	WannaCry.exe
3524	!WannaDecryptor!.exe
5908	!WannaDecryptor!.exe
5984	!WannaDecryptor!.exe
4644	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\WannaCry.exe\" /r"	WannaCry.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
15	raw.githubusercontent.com
38	raw.githubusercontent.com
40	raw.githubusercontent.com

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	firefox.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WannaCry.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WMIC.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe

Checks processor information in registry 2 TTPs 8 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Signature	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Update Revision	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	firefox.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	firefox.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~Mhz	firefox.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3748	taskkill.exe
924	taskkill.exe
4620	taskkill.exe
4712	taskkill.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	firefox.exe
Key created	\REGISTRY\USER\S-1-5-21-4018527317-446799424-2810249686-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier	firefox.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
5460	msedge.exe
5460	msedge.exe
5220	msedge.exe
5220	msedge.exe
2380	msedge.exe
2380	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 2 IoCs

pid	Process
4644	!WannaDecryptor!.exe
5796	OpenWith.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 2 IoCs

pid	Process
5220	msedge.exe
5220	msedge.exe

Suspicious use of AdjustPrivilegeToken 56 IoCs

description	pid	Process
Token: SeDebugPrivilege	4936	firefox.exe
Token: SeDebugPrivilege	4936	firefox.exe
Token: SeDebugPrivilege	3692	cscript.exe
Token: SeDebugPrivilege	3692	cscript.exe
Token: SeDebugPrivilege	3692	cscript.exe
Token: SeDebugPrivilege	4712	taskkill.exe
Token: SeDebugPrivilege	3748	taskkill.exe
Token: SeDebugPrivilege	4620	taskkill.exe
Token: SeDebugPrivilege	924	taskkill.exe
Token: SeIncreaseQuotaPrivilege	1604	WMIC.exe
Token: SeSecurityPrivilege	1604	WMIC.exe
Token: SeTakeOwnershipPrivilege	1604	WMIC.exe
Token: SeLoadDriverPrivilege	1604	WMIC.exe
Token: SeSystemProfilePrivilege	1604	WMIC.exe
Token: SeSystemtimePrivilege	1604	WMIC.exe
Token: SeProfSingleProcessPrivilege	1604	WMIC.exe
Token: SeIncBasePriorityPrivilege	1604	WMIC.exe
Token: SeCreatePagefilePrivilege	1604	WMIC.exe
Token: SeBackupPrivilege	1604	WMIC.exe
Token: SeRestorePrivilege	1604	WMIC.exe
Token: SeShutdownPrivilege	1604	WMIC.exe
Token: SeDebugPrivilege	1604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1604	WMIC.exe
Token: SeRemoteShutdownPrivilege	1604	WMIC.exe
Token: SeUndockPrivilege	1604	WMIC.exe
Token: SeManageVolumePrivilege	1604	WMIC.exe
Token: SeImpersonatePrivilege	1604	WMIC.exe
Token: 33	1604	WMIC.exe
Token: 34	1604	WMIC.exe
Token: 35	1604	WMIC.exe
Token: 36	1604	WMIC.exe
Token: SeIncreaseQuotaPrivilege	1604	WMIC.exe
Token: SeSecurityPrivilege	1604	WMIC.exe
Token: SeTakeOwnershipPrivilege	1604	WMIC.exe
Token: SeLoadDriverPrivilege	1604	WMIC.exe
Token: SeSystemProfilePrivilege	1604	WMIC.exe
Token: SeSystemtimePrivilege	1604	WMIC.exe
Token: SeProfSingleProcessPrivilege	1604	WMIC.exe
Token: SeIncBasePriorityPrivilege	1604	WMIC.exe
Token: SeCreatePagefilePrivilege	1604	WMIC.exe
Token: SeBackupPrivilege	1604	WMIC.exe
Token: SeRestorePrivilege	1604	WMIC.exe
Token: SeShutdownPrivilege	1604	WMIC.exe
Token: SeDebugPrivilege	1604	WMIC.exe
Token: SeSystemEnvironmentPrivilege	1604	WMIC.exe
Token: SeRemoteShutdownPrivilege	1604	WMIC.exe
Token: SeUndockPrivilege	1604	WMIC.exe
Token: SeManageVolumePrivilege	1604	WMIC.exe
Token: SeImpersonatePrivilege	1604	WMIC.exe
Token: 33	1604	WMIC.exe
Token: 34	1604	WMIC.exe
Token: 35	1604	WMIC.exe
Token: 36	1604	WMIC.exe
Token: SeBackupPrivilege	4188	vssvc.exe
Token: SeRestorePrivilege	4188	vssvc.exe
Token: SeAuditPrivilege	4188	vssvc.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe
5220	msedge.exe

Suspicious use of SetWindowsHookEx 16 IoCs

pid	Process
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
4936	firefox.exe
3524	!WannaDecryptor!.exe
3524	!WannaDecryptor!.exe
5908	!WannaDecryptor!.exe
5908	!WannaDecryptor!.exe
5984	!WannaDecryptor!.exe
5984	!WannaDecryptor!.exe
4644	!WannaDecryptor!.exe
4644	!WannaDecryptor!.exe
5796	OpenWith.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 3884 wrote to memory of 4936	3884	firefox.exe	77
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 4204	4936	firefox.exe	78
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79
PID 4936 wrote to memory of 5052	4936	firefox.exe	79

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files\Mozilla Firefox\firefox.exe
"C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url "https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3884
- C:\Program Files\Mozilla Firefox\firefox.exe
  "C:\Program Files\Mozilla Firefox\firefox.exe" -osint -url https://github.com/Da2dalus/The-MALWARE-Repo/blob/master/Ransomware/WannaCry.exe
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - Checks processor information in registry
  - Modifies registry class
  - NTFS ADS
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:4936
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1956 -parentBuildID 20240401114208 -prefsHandle 1892 -prefMapHandle 1884 -prefsLen 23678 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {0995eb63-2fd2-4fa6-a117-94166397d283} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" gpu
    3⤵
    PID:4204
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2384 -parentBuildID 20240401114208 -prefsHandle 2376 -prefMapHandle 2364 -prefsLen 24598 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {defd28cb-b7bb-4e76-ae12-bb6eb8194468} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" socket
    3⤵
    PID:5052
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2948 -childID 1 -isForBrowser -prefsHandle 3104 -prefMapHandle 3120 -prefsLen 22652 -prefMapSize 244658 -jsInitHandle 976 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {eea77f6e-abcf-4f9f-b9f7-a0c2ef812bdf} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" tab
    3⤵
    PID:460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3876 -childID 2 -isForBrowser -prefsHandle 3872 -prefMapHandle 3868 -prefsLen 29088 -prefMapSize 244658 -jsInitHandle 976 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {6fcd1fd7-d914-4458-af39-12bb359eea7e} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" tab
    3⤵
    PID:2832
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4708 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4704 -prefMapHandle 4700 -prefsLen 29088 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {12ed8a38-9fcd-4514-a466-a1de2498d064} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" utility
    3⤵
    - Checks processor information in registry
    PID:3460
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5488 -childID 3 -isForBrowser -prefsHandle 5512 -prefMapHandle 5548 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 976 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {fe78c364-d562-46f0-81ad-447261d8ac7f} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" tab
    3⤵
    PID:1484
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5576 -childID 4 -isForBrowser -prefsHandle 5704 -prefMapHandle 5708 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 976 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {5a952fab-caf1-4b1b-bc58-a038d90fb3df} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" tab
    3⤵
    PID:1508
- - C:\Program Files\Mozilla Firefox\firefox.exe
    "C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5896 -childID 5 -isForBrowser -prefsHandle 5972 -prefMapHandle 5968 -prefsLen 26998 -prefMapSize 244658 -jsInitHandle 976 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {1afa381a-11e1-4270-9806-0b7989417075} 4936 "\\.\pipe\gecko-crash-server-pipe.4936" tab
    3⤵
    PID:2552
- - C:\Users\Admin\Downloads\WannaCry.exe
    "C:\Users\Admin\Downloads\WannaCry.exe"
    3⤵
    - Drops startup file
    - Executes dropped EXE
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:4072
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c 41411735862326.bat
      4⤵
      System Location Discovery: System Language Discovery
      PID:972
    - - C:\Windows\SysWOW64\cscript.exe
        
        cscript //nologo c.vbs
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:3692
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe f
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:3524
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im MSExchange*
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3748
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im Microsoft.Exchange.*
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4712
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlserver.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Windows\SysWOW64\taskkill.exe
      taskkill /f /im sqlwriter.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:924
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe c
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of SetWindowsHookEx
      PID:5908
  - - C:\Windows\SysWOW64\cmd.exe
      cmd.exe /c start /b !WannaDecryptor!.exe v
      4⤵
      System Location Discovery: System Language Discovery
      PID:5916
    - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
        
        !WannaDecryptor!.exe v
        5⤵
        Executes dropped EXE
        System Location Discovery: System Language Discovery
        Suspicious use of SetWindowsHookEx
        
        PID:5984
      - C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4556
        
        C:\Windows\SysWOW64\Wbem\WMIC.exe
        
        wmic shadowcopy delete
        7⤵
        System Location Discovery: System Language Discovery
        Suspicious use of AdjustPrivilegeToken
        
        PID:1604
  - - C:\Users\Admin\Downloads\!WannaDecryptor!.exe
      !WannaDecryptor!.exe
      4⤵
      Executes dropped EXE
      Sets desktop wallpaper using registry
      System Location Discovery: System Language Discovery
      Suspicious behavior: GetForegroundWindowSpam
      Suspicious use of SetWindowsHookEx
      PID:4644
    - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://en.wikipedia.org/wiki/Bitcoin
        5⤵
        Enumerates system info in registry
        Suspicious behavior: EnumeratesProcesses
        Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
        Suspicious use of FindShellTrayWindow
        Suspicious use of SendNotifyMessage
        
        PID:5220
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x120,0x124,0x128,0xfc,0x12c,0x7ffd35343cb8,0x7ffd35343cc8,0x7ffd35343cd8
        6⤵
        
        PID:5232
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1864 /prefetch:2
        6⤵
        
        PID:5444
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:5460
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2568 /prefetch:8
        6⤵
        
        PID:5540
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
        6⤵
        
        PID:5736
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
        6⤵
        
        PID:5760
      - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1848,14491827813036153713,11024455000629393341,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4116 /prefetch:8
        6⤵
        Suspicious behavior: EnumeratesProcesses
        
        PID:2380

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5828

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
PID:5796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Windows Management Instrumentation

T1047

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Web Service

T1102

Exfiltration

Impact

Defacement

T1491

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9e65169e-16e2-47fa-95a0-45ee5edc0495.tmp

Filesize
184B

MD5
69c7300aaaf49ee30185aad40abbf798

SHA1
5588321c4214e060d8f04f6f67455d1573532b83

SHA256
464848a8bfd1148a26c740521f287a4c40f649821824d229a09d899c0514ce30

SHA512
8f2eb2e6a41f14c1f982a87ad0668e45397000e31f125d60b74bdeee948ec25f5c686cf5ba1a077c73c7437c8b0c0ba14461772f7bd9b689903eb94ec49b7ac2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
48B

MD5
9fd2409bea5c649a12d2b7147a874633

SHA1
3a8dae534cbe81e5a8c996a396010adb4e8cbe3d

SHA256
8035eeb134735a801b72ad97e852d0b62b03aa96eb08e7175137c6d44fed7909

SHA512
2f9f01b09ff010712315f3e169a4aafff7fa2214f8159cbbee7408e23632d8e5e34c3feea7dfaa26410c8a30d7b5606aa0d1f760db781a970fdffebef5abe217

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c75068f33faa6c5070e480f2c537e1f5

SHA1
25c41e13b12f67171b264c7c4131971f4a638dc7

SHA256
ed943150bfc9133a3ea3c181275e27f63bba0d412bcf2bd90b56b0a40c2b5366

SHA512
08aa85cac713819fa7a5ed71e68396a52e3f4d6ae85d8068aeab45b2d1c4ae34498a95cadfaa1903bb527f23a201b807ab4dc9633acbe4b753f5829c37577f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4f0f45f781051259f2d01d4fa2e9e4d0

SHA1
acbe40258aab4cfb60fc10cded15a201446c9c2d

SHA256
251756a745085d503b54d6904a752bd3e29796f2fac91bdc714feeeeb8a1db3d

SHA512
e7777b58c79a4fb5c5ac20640c2bf298cb704f27d53ba085da9a149be6dc59079cec45869fb1f746ec20da987b8d8759fa77cffa662d2b14c4c88f6bf5a452af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
634ebe953080850dc050425e013d438c

SHA1
bc17d7375073397e4f47d59dd33e0779f3fda01c

SHA256
d30a5dfcd60a0b587bb52d569a0ad9eae62317765d7584bd2972712b8be4ca63

SHA512
211a05b7af11a87264d6d11000f76446a9b059eebd1dd3b655187b7c3926a467a0ae060d912c4896b5be02fae61d6223306e0fd71985291ee83c2f3f1c95930c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
22203bb4992f77efd125c5d84bede89a

SHA1
f20029c4e4d1a2d514400d607c307ae70a07270b

SHA256
5470e19ef5b82f0bab2c5383fef58775a38f0df7d8a1f0fa622bdc69ca910436

SHA512
bff69a848210a7285532a0abb92f5933a1fdac3e8a78d9aca86914c54f6f433c8b83b54c3664cce30db12b55fdafae3f9cf325e50ee90b684d440df17aab1976

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\activity-stream.discovery_stream.json.tmp

Filesize
19KB

MD5
fb97fa8a5b34b858708153c81b3fed9f

SHA1
630577a1e1c0dc3d75c828dcf61ba2562700396a

SHA256
dc5a142db0b09dea5317357fe4a947a945046c17a5f876781c2e5f26a8d2d090

SHA512
b46211d005f41b0843c031a19f6bc653716fc9282127228487b6336200a3107856f7a95d9fe0364c7b296d0be7b9eaa2d09942fb1d891fdecaa828e4b9b58989

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\cache2\entries\37373F56CBD822F5FCF64BA01E1320A0924D8460

Filesize
24KB

MD5
8553e271808899328e57cf150b128fc2

SHA1
3c2d617d816bded5bb8ee31df4f4934d615fc11b

SHA256
49965639e4b7ed408e02821970385417d2eda482093e95719024a000263de5d7

SHA512
8f4eccd3c090ea18b98b6323b716404463e4df989b197efea45f3182bf6f3e9c49f8893fa9c879d91daaca53a45dd29b9c6d6648e2b6206ec6e80a47e04e73d7

Download Submit
C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\74uts9gp.default-release\cache2\entries\A564048C74FB830C2130D8953171BF90187B65CE

Filesize
59KB

MD5
962c203ac8f2aba8bb1dcc61ff2b993a

SHA1
84cd9bdcfaccb3a9f0e259a481f8beed180c47b2

SHA256
5421f345c5f39b450f1ebe6e9b903c25c970ff1852ca5705688adff275c84655

SHA512
5385098108c2c50f3126d1154af1ad5d415e35df93b04ae60ccdbf057d1591a8b7341ee8c97afb927e6571c27a9d48bac07c47eb9c86fc71fc7f977999936093

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon

Filesize
479KB

MD5
09372174e83dbbf696ee732fd2e875bb

SHA1
ba360186ba650a769f9303f48b7200fb5eaccee1

SHA256
c32efac42faf4b9878fb8917c5e71d89ff40de580c4f52f62e11c6cfab55167f

SHA512
b667086ed49579592d435df2b486fe30ba1b62ddd169f19e700cd079239747dd3e20058c285fa9c10a533e34f22b5198ed9b1f92ae560a3067f3e3feacc724f1

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpaddon-1

Filesize
13.8MB

MD5
0a8747a2ac9ac08ae9508f36c6d75692

SHA1
b287a96fd6cc12433adb42193dfe06111c38eaf0

SHA256
32d544baf2facc893057a1d97db33207e642f0dacf235d8500a0b5eff934ce03

SHA512
59521f8c61236641b3299ab460c58c8f5f26fa67e828de853c2cf372f9614d58b9f541aae325b1600ec4f3a47953caacb8122b0dfce7481acfec81045735947d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\AlternateServices.bin

Filesize
6KB

MD5
2705435b7c5a83d2ba1302ed16070df5

SHA1
70330c6a5b86441c22484483c35b8495f168fd6b

SHA256
5dd13fc34d82e0383d26e3c5b5404259e67cb69bb0d1e81a3b0842f64f2bd926

SHA512
f6643d17e078fd88366c3128f58b2c37a4ddab0270193427b8d26b5da65a931dda3612996fa1bf9fcabc5dfa7d2b9133a656a827aac54b6642561b1d86f673a7

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\cert9.db

Filesize
224KB

MD5
3b8fe2f96c9a5c60ca8545733b7e64f6

SHA1
69b90423ebbdc73a2ec3a73a24ce40265ddabfdb

SHA256
7533e2d8c8b3a94ec760c59a31291a97636a2a7a8e1582b98deb27a426522a1e

SHA512
c04bb1b8a8a198f9c023a4b8ebff7a29c9cd307b3ce4ba56df559322373efe85b24bd85f4ea3fd719c9e39b05b87d37962fc560b7bb690afc7850024c0eca49e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
a2de51ca5d2e5555539e1b25b25460de

SHA1
06d41a3e692fc903516303d341606e5b611a7ff1

SHA256
dcbb061fb155de4415ac3138a99f626ab34c7f439dd0fb907eb5d86018f0e9fd

SHA512
fc315b0a3e54305154fc829bda2ebc0fb1f62374a2153a4058999dcb9de748c26f4aa35a30247635a61165a133a77bbafa0e4f912cb047faeedec86c57fef0fe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
78f2fb3496658dc5cfa0357f169d9deb

SHA1
2bd94ed926e546264e0e01e9afd8b99739334baa

SHA256
c48ef64a1fd42b9aaad353fee6c928daa63c99c3807f4b29b5669cc5deda463e

SHA512
848717bbecd5e9ff4c346e794edfc74705d1bd3c5e181e1d0aeeb658203bc78bddcd065d106a67ed6f07003841cb1d36e9d4a897d18a99f984eae5e02378cee4

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
5KB

MD5
2463dd01ac6eb3c1a9d74f55eb97f2ca

SHA1
8079b97540355a643b050949c2b40c8aac342738

SHA256
49ca05163aea343bc3a647a5beb26f5a8222b70db112587cc3f75159d806844b

SHA512
a7f11919e0405a1e62157fa5d744c936b6db3daa09d2ce0ee4681c405fffea13ba7048fc03e23114e1a9f789f12643508ad7a798df7653ca234557c9ee1ee568

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\db\data.safe.tmp

Filesize
6KB

MD5
6438d8a02ccb28d43076106f0494ba7c

SHA1
9e1e1abc36ee570a46e3b4473fc0b0e1c5fe6772

SHA256
a5f07d5eb162e9957a0cda6fc6dd9218a24b1580b058a8316e0a6e47f2c79bbd

SHA512
00b4252204efaca7967e6cf8db4e324a18851249a590c9a0ac1a8489ccb8cec087d39d4aa52fa7965e43af317a613626383355043cbcf849c5f7b6f09646fa44

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\238cc49d-5807-43b2-ad7e-abb3aada3de0

Filesize
982B

MD5
71c5b7d4165cdc9b4e8077d25b2f3d63

SHA1
cfac00dafe0a4929eafd9e41bc9d5257d6440ada

SHA256
da4fa0d2c9552690f02a11a13258b9fc99b717d37ec7e224d7b0c91b81cd6abe

SHA512
e2d8a5c5719dea8e4fd4475324d1b11770665478dcd28c499d89261b6c77e7efd2f7800e8bf450db0041edc830a401de1c3ec36f160871513b3b85954f362c0d

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\8fe38950-831f-4342-ba54-a846cb07a993

Filesize
24KB

MD5
6d201ae52cd8d5fcab82d399bf00184c

SHA1
7246413560acb3c14ea5aae650470510a2247258

SHA256
caab232c226b8dbe7e0da2f95a536da2430078dddbeaa8fa47c93d23a8138c27

SHA512
00900056e523306092c9d00d762110f951287c54cbb6d2dfdb7e441f3f7eebd9b4c2d3859e1aa7efc7bfa2072b56f007c58e1a891c4fff0d32124c3f308912e8

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\datareporting\glean\pending_pings\ba834249-3283-4a97-85cf-3e64715e91f0

Filesize
671B

MD5
e0eea422bbaa2693b584135aa7945e42

SHA1
56e0b25cc465abde1946671d4dcff74a894aa295

SHA256
c5a30b14eaddb929c1ed65e8bb0e5e195d00f568f4586577cac8a8b7dc909927

SHA512
576726387d68b8e7d78dcd59ba0336e5e2bc93950875f9dd73bb23fa8711fd979e205cfeac30c64fe01651ad27634b3765a562803a95a2317f45c46ac9ae4bfe

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.dll

Filesize
1.1MB

MD5
842039753bf41fa5e11b3a1383061a87

SHA1
3e8fe1d7b3ad866b06dca6c7ef1e3c50c406e153

SHA256
d88dd3bfc4a558bb943f3caa2e376da3942e48a7948763bf9a38f707c2cd0c1c

SHA512
d3320f7ac46327b7b974e74320c4d853e569061cb89ca849cd5d1706330aca629abeb4a16435c541900d839f46ff72dfde04128c450f3e1ee63c025470c19157

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-gmpopenh264\2.3.2\gmpopenh264.info

Filesize
116B

MD5
2a461e9eb87fd1955cea740a3444ee7a

SHA1
b10755914c713f5a4677494dbe8a686ed458c3c5

SHA256
4107f76ba1d9424555f4e8ea0acef69357dfff89dfa5f0ec72aa4f2d489b17bc

SHA512
34f73f7bf69d7674907f190f257516e3956f825e35a2f03d58201a5a630310b45df393f2b39669f9369d1ac990505a4b6849a0d34e8c136e1402143b6cedf2d3

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-widevinecdm\4.10.2710.0\manifest.json

Filesize
372B

MD5
bf957ad58b55f64219ab3f793e374316

SHA1
a11adc9d7f2c28e04d9b35e23b7616d0527118a1

SHA256
bbab6ca07edbed72a966835c7907b3e60c7aa3d48ddea847e5076bd05f4b1eda

SHA512
79c179b56e4893fb729b225818ab4b95a50b69666ac41d17aad0b37ab0ca8cd9f0848cbc3c5d9e69e4640a8b261d7ced592eae9bcb0e0b63c05a56e7c477f44e

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\gmp-widevinecdm\4.10.2710.0\widevinecdm.dll

Filesize
17.8MB

MD5
daf7ef3acccab478aaa7d6dc1c60f865

SHA1
f8246162b97ce4a945feced27b6ea114366ff2ad

SHA256
bc40c7821dcd3fea9923c6912ab1183a942c11b7690cfd79ed148ded0228777e

SHA512
5840a45cfdb12c005e117608b1e5d946e1b2e76443ed39ba940d7f56de4babeab09bee7e64b903eb82bb37624c0a0ef19e9b59fbe2ce2f0e0b1c7a6015a63f75

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\prefs-1.js

Filesize
11KB

MD5
6a0eed0d5ccfc8a60af5d237d6f8fd71

SHA1
464a197b587b9e118293e9571c97b6b6d8bc0b51

SHA256
9d343164c04f04d17bc6ca4195ab4c84cade38cf44a3221ea37c28fa66807751

SHA512
dc51307cdb01c83a2b8765a250ea4cd00bf2d44d012567232e09b17e72386c3f7cc4aad36c9f96dababa813c4d44ed5b71b5f4a82f6b70397752a2df18c7e558

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\prefs-1.js

Filesize
11KB

MD5
d40caae9e1233c30c9a2e8ef2631b634

SHA1
ed244628aa41bc0dc460dafc21638b50ac7690da

SHA256
e401c5f455eb80b4e461163ecc66e6806681c0cf0cf6aba6405dbf855bf2db41

SHA512
90519fc796d513fcb5d11d89113e8f78d4abb02db737b73c252b13f26bfe69b22aee561e42e659a7d9afaa858111335ad4e69b3178f731ea09feddd6f6655a34

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\prefs-1.js

Filesize
11KB

MD5
3ac7dc0bf4e5a1c45c36c273971a4eb2

SHA1
b016c60fb845b54c96d7594d156faab0ed9b8a40

SHA256
3d39a770bf1eda6c7e46445c52076d048c4bb23fb2213bf3d07434ad1b17768d

SHA512
7508b9e5c22f9772cd83daf88010ab2657458edc469dcdefa4f6e6c9e442a3e77cf2fe54b4c75b130487aa20a0ce783b23c9cd014ce5e6122a405e373bc55961

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\prefs-1.js

Filesize
11KB

MD5
04bea42e9684353832152170e6127ab8

SHA1
d206229c559ff8021df64f1585c68fa0cb3e8be1

SHA256
c1c13971ae38bc0ef60103f8a2e29fe56a1add2668c0546b3ea1421478fbd949

SHA512
d063d3f8fd7136682ed3209a4d21d4db984c1d98ba97f3dd8a86473c684c8ce574a82c00945017454cf147754616ca5ce8b299c40b842d120a4b9e8de8c445f1

Download Submit
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\74uts9gp.default-release\sessionstore-backups\recovery.baklz4

Filesize
3KB

MD5
676624412a0adf93a1cf3c99e864cf6a

SHA1
5842a86f910c0281ea233d45352206bfd654bf1f

SHA256
6c8d49bdf8dd0896de568788beaec8a11a7fd43062ec28753d34d103a67ab60d

SHA512
c0641cef1bf8e242be2508f64f99c17bc42c3426c6d3506c8a9f6a4243aa0a3b94c1aeacb40d8a480264f36c2d09071370cd1261aa3f7f66bbcbcb701ede2411

Download Submit
C:\Users\Admin\Downloads\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\!WannaDecryptor!.exe.lnk

Filesize
590B

MD5
5fe566259bf25138470cb9c86453ff65

SHA1
fe86ab932176bc4ed77ca877031a07faa93e52fd

SHA256
840783d38c5e2cb6a7f80c929d20f6304f82462c3a8fcb5ef6b9be458e125902

SHA512
c90112dab10b6dada4a9e49a820c9374939081f82e991e25be07506ae3a318dfdf23811216a03c5ce29e834630395acb4ecaeb61fc37c3e59f49d19f9852253b

Download Submit
C:\Users\Admin\Downloads\00000000.eky

Filesize
1KB

MD5
b7fe33a21a716ea3b69b215f7795adff

SHA1
0982db7011117664c9d2cd072d0d3c18b8653d97

SHA256
a91781a57bbeffb97bd463f517dde6ad1cfa55369ee80865d69db1cebdb1df0c

SHA512
1d8380a289f41a3b2f3dab227dd3c34ac5b21263af1f9f335ff3d7b69dcc9ce830d5a4368b9822516fe9e54581ca6f4cb98dab5f9900cb466d4fb46cdcbf23b6

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
8e17b656bc0e64d5990af6e05873218e

SHA1
02141b85c8ac4bfcbad406e1c068c74d462e0590

SHA256
c73bde0fb9619305ae1157065797ae4161e4ee58b12f316a11c9714b3777e547

SHA512
aea83b380462073668f73c212ce4756272d521b3d8673ed9cb50ab3fe6ddd317823b54c9ee72edd50cc77db39a070430494bed83d7fe82ab6a7c76d295dfe54f

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
1dfb1b86c925cca58bdd8204d42764bd

SHA1
3341d9b80cd0738673cf82e450c0d55387b534b2

SHA256
6812b195e7dfc26ae3d7329a86ebf49132d4697e3c370f8bc7095c54f8cbb223

SHA512
2e1bd9577d083b9ec827662ad558ae0f85f2911ba81dc44e174274bd78c1a1dc92111284cee36e87492b75cb158a7ff53854fd0032c23de4c6cde7e25260e471

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
2422e7d2b7ce4927c8b097a2b8368493

SHA1
ffb8b2b0ad33f310c2141d4c8a29e996c02f4069

SHA256
316e8bb08ee0b8d2e7a2cfc73883b03db739e05795b9b1acee85dd515d379ae2

SHA512
a67610badcf8f4fca5dfd1a18f30ad37a568faa2467499b4ba60b5a61ac05895c168de40edbc1ba39344f1a843d7bf252bb2815e6d30c5f88fe6c91f9ddd5c08

Download Submit
C:\Users\Admin\Downloads\00000000.res

Filesize
136B

MD5
66c3042772e02b39b5c049236527aa73

SHA1
cfac63c1c3f4e48a1403fe9d5fdd606e0380c508

SHA256
7201018775463a3f88df9b8e333f28c8a492a85b128cbd170f9ad57d5e35a62a

SHA512
294e4aa87f2bd099ed84505882c3c724754db1aa372be71be17b8959b7a9521d61989e28864cccdcb014c7d05bf5bee9fd797a13ddb019d59007f767f4af9c1c

Download Submit
C:\Users\Admin\Downloads\41411735862326.bat

Filesize
318B

MD5
a261428b490a45438c0d55781a9c6e75

SHA1
e9eefce11cefcbb7e5168bfb8de8a3c3ac45c41e

SHA256
4288d655b7de7537d7ea13fdeb1ba19760bcaf04384cd68619d9e5edb5e31f44

SHA512
304887938520ffcc6966da83596ccc8688b7eace9572982c224f3fb9c59e6fb2dcaa021a19d2aae47346e954c0d0d8145c723b7143dece11ac7261dc41ba3d40

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\WannaCry.exe:Zone.Identifier

Filesize
50B

MD5
dce5191790621b5e424478ca69c47f55

SHA1
ae356a67d337afa5933e3e679e84854deeace048

SHA256
86a3e68762720abe870d1396794850220935115d3ccc8bb134ffa521244e3ef8

SHA512
a669e10b173fce667d5b369d230d5b1e89e366b05ba4e65919a7e67545dd0b1eca8bcb927f67b12fe47cbe22b0c54c54f1e03beed06379240b05b7b990c5a641

Download Submit
C:\Users\Admin\Downloads\c.vbs

Filesize
201B

MD5
02b937ceef5da308c5689fcdb3fb12e9

SHA1
fa5490ea513c1b0ee01038c18cb641a51f459507

SHA256
5d57b86aeb52be824875008a6444daf919717408ec45aff4640b5e64610666f1

SHA512
843eeae13ac5fdc216b14e40534543c283ecb2b6c31503aba2d25ddd215df19105892e43cf618848742de9c13687d21e8c834eff3f2b69a26df2509a6f992653

Download Submit
C:\Users\Admin\Downloads\c.wry

Filesize
628B

MD5
2237b5ffcf3719a8a7d1d47ba6327404

SHA1
b73d0099726f1e327f23cc0816c7233f6e443038

SHA256
8d14e78442c1d630f4ce5fb66666951fb3ae0589e86941fe06a75bcae7b34910

SHA512
009c6a6a6c938613dc259368d0909c4e1cf8b38b22fad1846374acb44bd7fe3f75151aadb8e0c6f2485f81bc484653fbcc7cb8c5335e50bdad8882ff133f14ee

Download Submit
C:\Users\Admin\Downloads\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/4072-519-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download