Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
782s -
max time network
857s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20250113-en -
resource tags
-
submitted
17/01/2025, 11:47
Errors
Reason
Machine shutdown
General
-
Target
http://Virus exe dow
Score
10/10
Malware Config
Extracted
Path
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!Please Read Me!.txt
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Next, please find the decrypt software on your desktop, an executable file named "!WannaDecryptor!.exe".
If it does not exsit, download the software from the address below. (You may need to disable your antivirus for a while.)
rar password: wcry123
Run and follow the instructions!
�
Wallets
15zGqZCTcys6eCjDkE3DypCjXi6QWRV6V1
Extracted
Path
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\@[email protected]
Family
wannacry
Ransom Note
Q: What's wrong with my files?
A: Ooops, your important files are encrypted. It means you will not be able to access them anymore until they are decrypted.
If you follow our instructions, we guarantee that you can decrypt all your files quickly and safely!
Let's start decrypting!
Q: What do I do?
A: First, you need to pay service fees for the decryption.
Please send $300 worth of bitcoin to this bitcoin address: 115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Next, please find an application file named "@[email protected]". It is the decrypt software.
Run and follow the instructions! (You may need to disable your antivirus for a while.)
Q: How can I trust?
A: Don't worry about decryption.
We will decrypt your files surely because nobody will trust us if we cheat users.
* If you need our assistance, send a message by clicking <Contact Us> on the decryptor window.
�
Wallets
115p7UMMngoj1pMvkpHijcRdfJNXj6LrLn
Extracted
Path
C:\Recovery\README_HOW_TO_UNLOCK.TXT
Ransom Note
YOUR FILE HAS BEEN LOCKED
In order to unlock your files, follow the instructions bellow:
1. Download and install Tor Browser
2. After a successful installation, run Tor Browser and wait for its initialization.
3. Type in the address bar: http://zvnvp2rhe3ljwf2m.onion
4. Follow the instructions on the site.
URLs
http://zvnvp2rhe3ljwf2m.onion
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
-
Modifies visibility of file extensions in Explorer 2 TTPs 63 IoCs
-
UAC bypass 3 TTPs 63 IoCs
-
Wannacry
WannaCry is a ransomware cryptoworm.
-
Wannacry family
-
Deletes shadow copies 3 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Renames multiple (70) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 2 TTPs 1 IoCs
-
Drops startup file 5 IoCs
-
Executes dropped EXE 10 IoCs
-
Loads dropped DLL 16 IoCs
-
Modifies file permissions 1 TTPs 1 IoCs
-
Adds Run key to start application 2 TTPs 8 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
AutoIT Executable 13 IoCs
AutoIT scripts compiled to PE executables.
-
Sets desktop wallpaper using registry 2 TTPs 3 IoCs
-
UPX packed file 13 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
Drops file in Program Files directory 4 IoCs
-
Drops file in Windows directory 21 IoCs
-
Browser Information Discovery 1 TTPs
Enumerate browser information.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 64 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Checks processor information in registry 2 TTPs 12 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Enumerates system info in registry 2 TTPs 3 IoCs
-
Interacts with shadow copies 3 TTPs 3 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Kills process with taskkill 4 IoCs
-
Modifies Internet Explorer settings 1 TTPs 4 IoCs
-
Modifies data under HKEY_USERS 18 IoCs
-
Modifies registry class 3 IoCs
-
Modifies registry key 1 TTPs 64 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 2 IoCs
-
Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of SetWindowsHookEx 16 IoCs
-
Suspicious use of WriteProcessMemory 64 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
-
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
-
Views/modifies file attributes 1 TTPs 2 IoCs
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://Virus exe dow1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffba69346f8,0x7ffba6934708,0x7ffba69347182⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:22⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:32⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings2⤵
- Drops file in Program Files directory
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x138,0x12c,0x128,0x130,0x120,0x7ff758295460,0x7ff758295470,0x7ff7582954803⤵
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:22⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:12⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6412 /prefetch:82⤵
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2108,6643206818622466602,15495660259094193247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\System32\CompPkgSrv.exeC:\Windows\System32\CompPkgSrv.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe"C:\Windows\SystemApps\Microsoft.Windows.SecHealthUI_cw5n1h2txyewy\SecHealthUI.exe" -ServerName:SecHealthUI.AppXep4x2tbtjws1v9qqs0rmb3hxykvkpqtn.mca1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\System32\SecurityHealthHost.exeC:\Windows\System32\SecurityHealthHost.exe {E041C90B-68BA-42C9-991E-477B73A75C90} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x0 /state0:0xa39c9855 /state1:0x41c64e6d1⤵
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\launchtm.exelaunchtm.exe /31⤵
-
C:\Windows\System32\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe" /32⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SendNotifyMessage
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -p -s DispBrokerDesktopSvc1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s Themes1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\CryptoWall.exe"1⤵
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\syswow64\explorer.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\svchost.exe-k netsvcs3⤵
-
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\$uckyLocker.exe"1⤵
- Sets desktop wallpaper using registry
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"1⤵
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe"2⤵
- Checks processor information in registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=1988 -parentBuildID 20240401114208 -prefsHandle 1916 -prefMapHandle 1896 -prefsLen 27137 -prefMapSize 244658 -appDir "C:\Program Files\Mozilla Firefox\browser" - {03804132-5608-4929-b5cc-12410e8d270b} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" gpu3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=2396 -parentBuildID 20240401114208 -prefsHandle 2372 -prefMapHandle 2360 -prefsLen 27015 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {59fd0625-0f2e-4ff5-ba95-2e2884ebe3a1} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" socket3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3048 -childID 1 -isForBrowser -prefsHandle 3000 -prefMapHandle 3140 -prefsLen 22698 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {b13830dc-fa51-4106-938d-1840b6ef19c7} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=3924 -childID 2 -isForBrowser -prefsHandle 3916 -prefMapHandle 3912 -prefsLen 32389 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {38d684cb-1bc8-4516-ab02-f5058a196829} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=4564 -parentBuildID 20240401114208 -sandboxingKind 0 -prefsHandle 4620 -prefMapHandle 4616 -prefsLen 32389 -prefMapSize 244658 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {9d2f100f-8b5d-4c9d-86dd-4f482541a4c8} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" utility3⤵
- Checks processor information in registry
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5392 -childID 3 -isForBrowser -prefsHandle 5356 -prefMapHandle 5376 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {f6021514-2d91-4fef-ad34-315d309ca5ce} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5516 -childID 4 -isForBrowser -prefsHandle 5520 -prefMapHandle 5524 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2e7c5df9-d050-430c-8310-811e70c003de} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5712 -childID 5 -isForBrowser -prefsHandle 5720 -prefMapHandle 5724 -prefsLen 27097 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {77eca4a8-79a7-4f6e-9210-b04838d84a26} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
C:\Program Files\Mozilla Firefox\firefox.exe"C:\Program Files\Mozilla Firefox\firefox.exe" -contentproc --channel=5088 -childID 6 -isForBrowser -prefsHandle 6300 -prefMapHandle 6296 -prefsLen 27257 -prefMapSize 244658 -jsInitHandle 1264 -jsInitLen 234952 -parentBuildID 20240401114208 -win32kLockedDown -appDir "C:\Program Files\Mozilla Firefox\browser" - {2352affd-e0fa-4276-babd-b05904cc909c} 5940 "\\.\pipe\gecko-crash-server-pipe.5940" tab3⤵
-
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
- Drops startup file
- Adds Run key to start application
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 118911737115185.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript //nologo c.vbs3⤵
-
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe f2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im MSExchange*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Microsoft.Exchange.*2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlserver.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im sqlwriter.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe c2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c start /b !WannaDecryptor!.exe v2⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe v3⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
-
-
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\!WannaDecryptor!.exe!WannaDecryptor!.exe2⤵
- Executes dropped EXE
- Sets desktop wallpaper using registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCry.exe"1⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WinlockerVB6Blacksod.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WinlockerVB6Blacksod.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\msiexec.exe"C:\Windows\system32\msiexec.exe" /i "C:\Users\Admin\AppData\Roaming\Windows\Error file remover 1.0.0.0\install\0A01606\Error file remover.msi" AI_SETUPEXEPATH=C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WinlockerVB6Blacksod.exe SETUPEXEDIR=C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ EXE_CMD_LINE="/exenoupdates /exelang 0 /noprereqs "2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Modifies WinLogon for persistence
- Enumerates connected drives
- Drops file in Program Files directory
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 234BF801DE336A3DD14679A9EB2A757D2⤵
- Loads dropped DLL
- Blocklisted process makes network request
-
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding 54DAA9874F1A6707ED2AC4D704185566 E Global\MSI00002⤵
- Loads dropped DLL
- Drops file in Windows directory
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\WannaCrypt0r.exe"1⤵
- Drops startup file
- Sets desktop wallpaper using registry
-
C:\Windows\SysWOW64\attrib.exeattrib +h .2⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\icacls.exeicacls . /grant Everyone:F /T /C /Q2⤵
- Modifies file permissions
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\taskse.exetaskse.exe C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\@[email protected]2⤵
- Executes dropped EXE
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ifmtnfzogw121" /t REG_SZ /d "\"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f2⤵
-
C:\Windows\SysWOW64\reg.exereg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v "ifmtnfzogw121" /t REG_SZ /d "\"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\tasksche.exe\"" /f3⤵
- Adds Run key to start application
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c 231081737115198.bat2⤵
-
C:\Windows\SysWOW64\cscript.execscript.exe //nologo m.vbs3⤵
-
-
-
C:\Windows\SysWOW64\attrib.exeattrib +h +s F:\$RECYCLE2⤵
- Views/modifies file attributes
-
-
C:\Windows\SysWOW64\cmd.exe
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\@[email protected]
-
C:\Windows\SysWOW64\cmd.execmd.exe /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet4⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\Wbem\WMIC.exewmic shadowcopy delete5⤵
-
-
-
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\taskdl.exetaskdl.exe2⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\taskse.exe
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\@[email protected]
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exe"C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exe"1⤵
- Adds Run key to start application
-
C:\Users\Admin\QcwwAgUE\AcEMAQkQ.exe"C:\Users\Admin\QcwwAgUE\AcEMAQkQ.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\ProgramData\NWUccQUg\gEwAgMAE.exe"C:\ProgramData\NWUccQUg\gEwAgMAE.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"2⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"4⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock5⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"6⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock7⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"8⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock9⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"10⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock11⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"12⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV113⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock13⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"14⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock15⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"16⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock17⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"18⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV119⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock19⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"20⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock21⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"22⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock23⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"24⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock25⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"26⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock27⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"28⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock29⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"30⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock31⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"32⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock33⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"34⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock35⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"36⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock37⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"38⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV139⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock39⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"40⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock41⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"42⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock43⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"44⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock45⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"46⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV147⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock47⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"48⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock49⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"50⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock51⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"52⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock53⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"54⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock55⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"56⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock57⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"58⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock59⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"60⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock61⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"62⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock63⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"64⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock65⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"66⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock67⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"68⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock69⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"70⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV171⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock71⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"72⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV173⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock73⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"74⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV175⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock75⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"76⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock77⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"78⤵
- System Location Discovery: System Language Discovery
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV179⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock79⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"80⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock81⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"82⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock83⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"84⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock85⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"86⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock87⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"88⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock89⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"90⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV191⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock91⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"92⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock93⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"94⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock95⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"96⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock97⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"98⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock99⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"100⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1101⤵
-
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock101⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"102⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock103⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"104⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock105⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"106⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock107⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"108⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock109⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"110⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock111⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"112⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock113⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"114⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock115⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"116⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock117⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"118⤵
- System Location Discovery: System Language Discovery
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock119⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c "C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock"120⤵
-
C:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock.exeC:\Users\Admin\Desktop\The-MALWARE-Repo-master\Ransomware\ViraLock121⤵
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-