wannacry | hxxps://bazaar[.]abuse[.]ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/

Analysis

max time kernel
90s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
05-01-2025 01:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/

Score

10^/10

wannacry discovery persistence ransomware spyware stealer worm

Malware Config

Extracted

Path

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!Please Read Me!.txt

Family

wannacry

Ransom Note

Q: What's wrong with my files? A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted. If you follow our instructions we guarantee that you can decrypt all your files quickly and safely! Let's start decrypting! Q: What do I do? A: First, you need to pay service fees for the decryption. Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1 Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe". If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.) rar password: wcry123 Run and follow the instructions! �

Wallets

15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1

Signatures

Wannacry
WannaCry is a ransomware cryptoworm.
ransomware worm wannacry
Wannacry family
wannacry

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~SDA37F.tmp	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\~SDA396.tmp	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

Executes dropped EXE 6 IoCs

pid	Process
3712	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
740	!WannaDecryptor!.exe
5064	!WannaDecryptor!.exe
2388	!WannaDecryptor!.exe
4468	!WannaDecryptor!.exe
64	!WannaDecryptor!.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Update Task Scheduler = "\"C:\\Users\\Admin\\Downloads\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe\" /r"	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Desktop\\!WannaCryptor!.bmp"	!WannaDecryptor!.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	!WannaDecryptor!.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Kills process with taskkill 4 IoCs

evasion

pid	Process
3496	taskkill.exe
3352	taskkill.exe
4012	taskkill.exe
4936	taskkill.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-493223053-2004649691-1575712786-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
1356	msedge.exe
1356	msedge.exe
3284	identity_helper.exe
3284	identity_helper.exe
768	msedge.exe
768	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of AdjustPrivilegeToken 8 IoCs

description	pid	Process
Token: SeRestorePrivilege	2412	7zG.exe
Token: 35	2412	7zG.exe
Token: SeSecurityPrivilege	2412	7zG.exe
Token: SeSecurityPrivilege	2412	7zG.exe
Token: SeDebugPrivilege	4936	taskkill.exe
Token: SeDebugPrivilege	3352	taskkill.exe
Token: SeDebugPrivilege	3496	taskkill.exe
Token: SeDebugPrivilege	4012	taskkill.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
2412	7zG.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe
1356	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
740	!WannaDecryptor!.exe
740	!WannaDecryptor!.exe
5064	!WannaDecryptor!.exe
5064	!WannaDecryptor!.exe
2388	!WannaDecryptor!.exe
4468	!WannaDecryptor!.exe
64	!WannaDecryptor!.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1356 wrote to memory of 1476	1356	msedge.exe	83
PID 1356 wrote to memory of 1476	1356	msedge.exe	83
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 1168	1356	msedge.exe	84
PID 1356 wrote to memory of 4540	1356	msedge.exe	85
PID 1356 wrote to memory of 4540	1356	msedge.exe	85
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86
PID 1356 wrote to memory of 4836	1356	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://bazaar.abuse.ch/download/be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844/
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb517b46f8,0x7ffb517b4708,0x7ffb517b4718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2528 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5572 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2024,2913687812831419395,13976498315888979564,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:460

C:\Program Files\7-Zip\7zG.exe
"C:\Program Files\7-Zip\7zG.exe" x -o"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\" -ad -an -ai#7zMap20195:190:7zEvent9004
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2412

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe
"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe"
1⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:3712
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c 11941736041910.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4092
- - C:\Windows\SysWOW64\cscript.exe
    cscript //nologo c.vbs
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4904
- C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
  !WannaDecryptor!.exe f
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:740
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im MSExchange*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4936
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im Microsoft.Exchange.*
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:4012
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlserver.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3352
- C:\Windows\SysWOW64\taskkill.exe
  taskkill /f /im sqlwriter.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3496
- C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
  !WannaDecryptor!.exe c
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2388
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c start /b !WannaDecryptor!.exe v
  2⤵
  - System Location Discovery: System Language Discovery
  PID:3588
- - C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
    !WannaDecryptor!.exe v
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:4468
- C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
  !WannaDecryptor!.exe
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:64

C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe
"C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe"
1⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\4c289885-2fec-4bfe-af1b-263619cf11df.tmp

Filesize
10KB

MD5
d545dd410eb9e0f3a2b07871061c7a03

SHA1
3e65b296e9196ae7f18999db7d905d535be7cbd9

SHA256
ae8198aeb21323aa157a0aeba73bc66a7c1d226da5b1bbb83937b32eb0e93455

SHA512
65bc579be6f0ac0cf74d123e82d4118c79bcb1a7d68afe7e1600e1b082a397142e0d72b611211bf6d258ff8667677581d6df03c91c6fb01f7548864b0da6ec80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7cb450b1315c63b1d5d89d98ba22da5

SHA1
694005cd9e1a4c54e0b83d0598a8a0c089df1556

SHA256
38355fd694faf1223518e40bac1996bdceaf44191214b0a23c4334d5fb07d031

SHA512
df04d4f4b77bae447a940b28aeac345b21b299d8d26e28ecbb3c1c9e9a0e07c551e412d545c7dbb147a92c12bad7ae49ac35af021c34b88e2c6c5f7a0b65f6a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
37f660dd4b6ddf23bc37f5c823d1c33a

SHA1
1c35538aa307a3e09d15519df6ace99674ae428b

SHA256
4e2510a1d5a50a94fe4ce0f74932ab780758a8cbdc6d176a9ce8ab92309f26f8

SHA512
807b8b8dc9109b6f78fc63655450bf12b9a006ff63e8f29ade8899d45fdf4a6c068c5c46a3efbc4232b9e1e35d6494f00ded5cdb3e235c8a25023bfbd823992d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
bc1d771347b08ce0cd72c392dfc734b3

SHA1
82c71c1680bb598fd139e033c34388e1bc5d8887

SHA256
d5509ac3971767be1e36ad9dc83a2d00e91edf399f55da472add60b17724cb10

SHA512
bca1151fb215951f5f86295d5e62fa187c1b61fe52d57658c98df4b51a08ffc3a12e8598156df8f996cfee84925e00ef35f2ed48ab61d255dd2e389426404a0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
533B

MD5
595c14da6e3e1ac5994acbbaa0df54d3

SHA1
f31d741eaf3b0fd1440e5a75b4d42367cc5eb4cd

SHA256
6e0f5f8a78445fbbe78b31abea789ea7eaae23b5ea67792f74df6dced60d07cf

SHA512
329619d30cf05d67393e764e1754b19e43758abd8e2fac946e05c4826070771474d35caff7aa0261f96f953edf695efd9dc0e64258c4da1d6c89bb07c98275ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
316af9b126e969b824d027c38e374bdd

SHA1
fdc8a9c39cc495b1f9d609f2e350fe354b542e36

SHA256
fd8ed49e9b3a4eae5b7660f05444b55cacfbe8f35e52853e8966843fb44d524b

SHA512
51dcf450883b0d758637ffee57817a9021b4ef4cca16ae2a4eafc1a60a618e4134acfed8b5931fa596282e248186ee771f207ddea1ce9ea09f514c7b95360df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
07a546902d2b175da7a0eec913f675cb

SHA1
2a29385569ee9498023d7a5c6c74783fd8b6364c

SHA256
3ad0338c9470e19afa998094f9539869566afa111e1c76223d63cb1c48f18413

SHA512
22194da4073bb8fb2be737ae561ddda2af1a020e12d885e866e6f37645f1d361969c29b808f71d515e6c8b0283cf26ff7e53f5849d91f26e473ec28597021ace

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b36c5e89b178c37ca994f35a13968779

SHA1
2008f34fba20bde75aebc84c6aa208ed5426bf43

SHA256
c2815d812432caefe54cdc0c1bd63ecbc6dd0ceef5236a7d85a9e653c2fc42b1

SHA512
317fe35404b75142bc93a0a59ff31fadcd73f60c16d08fbc1cc8e5d16953f5240c84dc6d7b188ea24dd489eaa5534a00df146d4771775a5e3986801fd69f87be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44ed12e344edc816ee1c5bb282bd35a3

SHA1
988b913ceee674e12718655a12a21c25ab62e20f

SHA256
c29ffc398bcc7a10a4a913154a85a94f363d6f57348b306884d51a067a868b63

SHA512
0815f250628aef2b1faf6c5ad50b7c2b1729d0f43f06870cd3902b1131fcd251bc16e5a487c89403da748abf1999261a189033931a1b87b2f82e4aa7a3b992e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8b204892dd42d5579930d671f14516a0

SHA1
bfa44afb7411f9066f6804d193888e259f422773

SHA256
ebab902cd368ddb1c1eb6f1a0875b3840ef4132bac6bd55f7b246909aba4c69f

SHA512
77c39301941b2dd656b7181fdba12d7039374a7c5836f7d568b9851e2eebbea6977ab336bf626f2804f1fc4f1049b6e67093cad52679f5f1bd7c360aa900edd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57df06.TMP

Filesize
1KB

MD5
1dec95fc2f0db553a1d33de200f943c7

SHA1
3ae4440237602789ec9f8200a0d95f16803f8598

SHA256
63e6920603a5751966e12a325d8b6beadc9755b4188d7d752cfbe50c571845c3

SHA512
e792082ff18420d1b4f5cdbc609128da8d7b415af99a9b1fa30c2bc8a16a083db3820024a03a3e7af5cb91e04cb4631f59d1d1d7eb5a4d18893afd192374fb99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\databases\Databases.db

Filesize
28KB

MD5
f52b3e5685c4f2b98461bb84fe93ab55

SHA1
89d471548ded09933e4180cbffae6b54f3227173

SHA256
4ed3ecc79883e5c9a3d3aec94acd8d00cd5d88c311b5101e82639c258a2816f0

SHA512
2f1652f4e2522276f0b1c7dcb9db117ceebefd3df146222102016993ade3442da03218b35f0bd3b487327a09094d28cebb80d3afe258be2048b330c1bc1c9912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
812a2755c61a34a8e8b39ff350768f8b

SHA1
6799c7784c84cc82440b94afcea2bc37b6c55d19

SHA256
2e21252ff3d1fec5240c4ce0c4a91dcd4ea8a04f2e56aaa3fd16e07968307a44

SHA512
d2b41b1bfb0679dda42e39700e586190ae76a80096fc17632bc9003b90b0543b0640998c8c50b3b1dbcdb59820d6e6dc4b3e7edd83e0f16cf488d2127a1f0993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
942fbc65de4b009c2428b26a1dc577db

SHA1
5ea0f57350057cc44792dfac192bdc2db358e617

SHA256
2cb9842d865d38c68e47cc79364d0f8bdf29acee12dbfa6909445518d5538a36

SHA512
134b8c25e2a066e22fd6e047e9b019689ce8831cb362100d3d1cd0c1d1fe743787b69fce3ec7ba4751407ba1b46a9377fc8e5c5d1fe9c18f1330a69aa4a1cc39

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.zip

Filesize
190KB

MD5
76e063995d4370d6da17a9c1fa048ec0

SHA1
7a71944b07eac97a5773a22474914326254ac5ea

SHA256
ba28330e62ea472b0a33f1956fbb87efaf64eb80a97c7d277565a0822edda115

SHA512
40167315a2f5eb3113bfafe1ff64053c3f882557653a7950dbde46436ea8ace0598757c0d34fffc12f4881d0a58bd3abada8fd6f748a6d749d473edc2864382f

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!Please Read Me!.txt

Filesize
797B

MD5
afa18cf4aa2660392111763fb93a8c3d

SHA1
c219a3654a5f41ce535a09f2a188a464c3f5baf5

SHA256
227082c719fd4394c1f2311a0877d8a302c5b092bcc49f853a5cf3d2945f42b0

SHA512
4161f250d59b7d4d4a6c4f16639d66d21b2a9606de956d22ec00bedb006643fedbbb8e4cde9f6c0c977285918648314883ca91f3442d1125593bf2605f2d5c6b

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\!WannaDecryptor!.exe.lnk

Filesize
857B

MD5
0b8ea259275c3435fe08120b191a0a74

SHA1
9211d3590b23134e459ea73d1718343c3cdf6cd1

SHA256
85589f09d5e266fa8a929f0ccb31c37cda9cbd084d0324b78b81177e8fad17fc

SHA512
ce0ead5f349a3e1c8885fc8a726933f13f9fe56c2164e1153d37cda719109e49982c1b41553d3592c1b0022e3a772cf6cf71d8c8b4e1f696c640f61a69af440e

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\00000000.res

Filesize
136B

MD5
91f6635f9a9226e55cb997da374b2853

SHA1
71aa20da162e1ad907dce32d6f241a954d4374cf

SHA256
3197bc38ef826ba858c9e6184973612b2342b57383b66800cbf51ff355ff69d6

SHA512
60f619a5d4d2a513b732242b9db9062934ab3e9a1df06cf47a263f3c82d50ba9673d8aa64ae9b4d36b19c4c8ade12e3ae8c0b40a670f7ed4924ca2ef51b5f401

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\11941736041910.bat

Filesize
448B

MD5
7b845a9531faef0c611acf1db5b39272

SHA1
cd1010795dc64c5601763502cb6c6797d79113e7

SHA256
839f6d594af460b0adca518d38cb5abda01f6af97f67ab77ec745e597fc2774f

SHA512
c3531907245d5a6049d0d4ef1accae22c64f4e5f5ee62a8304fa8c399d5acb2fd56c15f8b9933493bc52a628173283d511c76beab423d1a876e6c37efc630b9c

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844.exe

Filesize
224KB

MD5
5c7fb0927db37372da25f270708103a2

SHA1
120ed9279d85cbfa56e5b7779ffa7162074f7a29

SHA256
be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844

SHA512
a15f97fad744ccf5f620e5aabb81f48507327b898a9aa4287051464019e0f89224c484e9691812e166471af9beaddcfc3deb2ba878658761f4800663beef7206

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\c.vbs

Filesize
331B

MD5
17efc7ea16703ae154059dce5ec401a0

SHA1
e5a3e2e8bf99561471d48b8026be89ec4d43b57e

SHA256
f8da031af9e291c6e5fc9b5f053937bfdeb1aa331bad561a2ca49f54e3d70b50

SHA512
0de2d600e3ee9e423489d9e7c1f6eb798624316db4642aaf921fd62abef2ec43d60dc42941207f2b5b0d74971b555859a31dad06cb5e42e0ff24832c388ef714

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\c.wry

Filesize
628B

MD5
f013ecfa10886d4024e0fd5bce73b7e9

SHA1
2d7652db1739b371fda1740f50f5f9f52636494e

SHA256
faed815e4d59aec9aef07979a8ad84bf224f71b3fc8bd261ae3a105e6a5687f9

SHA512
9f7156c90af7665f1ec6c738a3c9efc5923254a81f0e6b38246302d94353475491d87f1779bf7ac158a50b6002e4c5433cee6375ce491aca16e2b09b08114ce4

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\m.wry

Filesize
42KB

MD5
980b08bac152aff3f9b0136b616affa5

SHA1
2a9c9601ea038f790cc29379c79407356a3d25a3

SHA256
402046ada270528c9ac38bbfa0152836fe30fb8e12192354e53b8397421430d9

SHA512
100cda1f795781042b012498afd783fd6ff03b0068dbd07b2c2e163cd95e6c6e00755ce16b02b017693c9febc149ed02df9df9b607e2b9cca4b07e5bd420f496

Download Submit
C:\Users\Admin\Downloads\be22645c61949ad6a077373a7d6cd85e3fae44315632f161adc4c99d5a8e6844\u.wry

Filesize
236KB

MD5
cf1416074cd7791ab80a18f9e7e219d9

SHA1
276d2ec82c518d887a8a3608e51c56fa28716ded

SHA256
78e3f87f31688355c0f398317b2d87d803bd87ee3656c5a7c80f0561ec8606df

SHA512
0bb0843a90edacaf1407e6a7273a9fbb896701635e4d9467392b7350ad25a1bec0c1ceef36737b4af5e5841936f4891436eded0533aa3d74c9a54efa42f024c5

Download Submit
memory/3712-212-0x0000000010000000-0x0000000010012000-memory.dmp

Filesize
72KB

Download